Obsidian

Sharpen your thinking, on local Markdown

Obsidian is a note-taking app built on local Markdown files, for Windows, macOS, Linux, iOS and Android. The app is proprietary and, since 2025-02-20, free for personal and work use with no account; revenue comes from Sync ($4/user/mo and up, annual), Publish ($8/site/mo and up, annual) and optional licenses. As of 2026-10-25 the latest public desktop build is 1.14.5, released on GitHub on 2026-10-22, and the community directory lists 9,467 plugins and 941 themes. Two desktop RCE flaws disclosed on 2026-10-09 need user action; sources differ on whether the MathJax one is fixed.

EditorialUpdated Oct 25, 202611 min read

The Obsidian interface

What it is

Obsidian is a desktop and mobile note-taking app. Notes are saved as plain Markdown text files in a folder the user chooses, which the app calls a vault. Notes link to each other with wikilinks, and the app builds backlinks and a graph view from those links. Because the data is just local files, it can be opened in another editor, tracked with Git, or synced by any file-sync service without going through Obsidian's servers.

The maintainer is Dynalist Inc. The Terms of Service name that company as the contracting party and are governed by the laws of the Province of Ontario and the federal laws of Canada; the company also holds the copyright on open-source repos such as obsidian-api. The About page lists seven people: co-founder Shida Li as CTO, co-founder Erica Xu as COO, and Steph Ango, CEO since the announcement post of 2023-02-06.

The manifesto on the About page lists five principles: Yours, Durable, Private, Malleable and Independent. The Independent principle says the company is supported entirely by its users rather than investors. That is the company's own statement.

The product has three layers: the free app itself; two paid add-ons, Sync and Publish; and a developer ecosystem with public plugin API type definitions, a sample plugin and the official plugin directory. There is also the Web Clipper browser extension, listed on the download page next to the app builds.

We believe in staying true to these principles. That’s why we are 100% supported by our users, not investors.
Obsidian manifesto, About page

Core capabilities

Local files and open formats. Notes are Markdown; the Canvas whiteboard uses .canvas files. A 2024-03-11 post renamed that format JSON Canvas and published a spec and MIT-licensed resources so other apps can read and write it. Per the 2026 changelog, version 1.14 (the first 1.14 build on GitHub, 1.14.4, was released 2026-10-05) can also open individual Markdown files outside a vault.

Bases database views. Bases turns notes with properties into tables and other views. Version 1.14 added a kanban view and group options, right-to-left support in table views, and highlight colors in the same release. The 1.15.0 beta listed in the changelog adds reorderable filters.

Plugins and themes. As of 2026-10-25 19:32 (UTC+8), the official community directory shows 9,467 plugins and 941 themes; the largest categories are Integrations (1,368), Files (1,278) and AI (1,129). A 2026-05-12 post puts total plugin downloads above 120 million, as reported by the vendor. The same post launched the new directory and developer dashboard: every version is scanned automatically for security issues, code quality and malware, each project page shows a safety scorecard, and paid plugins are labeled.

Sync. Sync is the official cross-device sync service, end-to-end encrypted by default with AES-256, file names included. It offers version history, selective sync and shared vaults, and can also run headless on a server. An encryption upgrade shipped on 2025-08-22.

Publish. Publish turns selected notes into a website with custom domains, graph view and hover previews; the product page lists hosting of up to 4 GB.

Automation. The 1.15.0 beta listed in the changelog adds URI and CLI commands that append content under a given heading; the mobile beta adds voice capture on iOS, transcribing recordings into notes, and requires iOS 26.

Who it's for / Not for

For: individuals who want long-term control of their notes. The data is plain files, the app works without an account, the privacy policy says the app collects no personal data or telemetry, and the update check can be turned off on the About tab in Settings.

For: people willing to build their own workflow. The plugin API is public and the community catalog is large, with ready-made options from task management and daily-note templates to AI assistants; themes and CSS snippets change the interface.

For: internal knowledge bases at organizations. Work use has been free since 2025-02-20 and the commercial license is now optional. The Enterprise page lists large tech companies and government bodies among supporters and says more than 10,000 organizations support Obsidian, inviting others to join them by buying a commercial license, as reported by the vendor.

Less suited: teams that need several people editing one document in real time. Shared vaults in Sync let several people sync the same vault.

Less suited: settings that cannot accept third-party code yet depend on plugins. The help docs say plugins inherit the app's full access, can read and write files on the computer, connect to the internet and add other programs, and the team cannot restrict plugins by permission. The vendor says the directory's scorecards can have false positives and false negatives.

Less suited: users who require source code they can audit or fork. The app is proprietary; only peripheral code such as the plugin API type definitions is openly licensed.

How it compares

Versus Notion: Notion is an online collaborative workspace with data on Notion's servers. Its pricing page, in the default view, shows Free at $0, Plus at $10 per member per month and Business at $20 per member per month (as of 2026-10-25). Obsidian itself is free and works offline; collaboration relies on Sync shared vaults or third-party options. Website publishing: Notion charges $8 per month per custom domain billed annually or $10 monthly, and Obsidian Publish is $8 per site per month billed annually or $10 monthly.

Versus Logseq: Logseq is also built on local Markdown files and linked notes, but it is open source under AGPL-3.0. As of 2026-10-25 the logseq/logseq repo had 45,368 stars.

Getting started

Step one: the download page covers these platforms: iOS, Android (an APK is also offered), Windows, a universal macOS build, and Linux as AppImage, Snap, Deb and ARM64, with a community-maintained Flatpak. After installation, a new or existing folder is opened as a vault, with no sign-in needed.

Step two: use only the core features for a while. Wikilinks, tags, daily notes, templates and graph view are built in. Existing Markdown notes can be used as-is by opening their folder as a vault.

Step three: plugins run only after Restricted Mode is turned off under Community plugins in Settings. The help docs say Restricted Mode is on by default to block third-party code, and that it should only be turned off for trusted plugin authors. When opening a vault from someone else, version 1.14 temporarily disables themes and CSS snippets while the "Do you trust the author of this vault" dialog is on screen.

Step four: for multiple devices, choose one route: sync the vault folder with iCloud, Git or another file-sync service, or subscribe to Sync for end-to-end encryption, version history and shared vaults. The privacy policy says that when a Sync subscription expires the server copy is kept for one month, and that a user cancelling the subscription deletes it immediately; local vaults are not affected.

Step five: for web clipping, add the Web Clipper browser extension, which saves page content as Markdown notes in the vault.

Pricing & license

The app: free for personal and work use, with no feature limits and no account. The License Overview (updated 2025-02-20) says any use, commercial and government included, is free.

Sync (prices as of 2026-10-25): Standard is $4 per user per month billed annually or $5 monthly, with 1 synced vault, 1 GB total storage, 5 MB maximum file size and 1 month of version history. Plus is $8 billed annually or $10 monthly, with 10 vaults, 10 GB, 200 MB files and 12 months of history, upgradable to 100 GB; a 2024-03-20 post priced that upgrade at $16 per month billed annually.

Publish: $8 per site per month billed annually, $10 monthly.

Optional support: Catalyst is a one-time $25 for early beta access and community badges; the commercial license is $50 per user per year and has been optional since 2025-02-20. Students, faculty and nonprofit staff get 40% off Sync and Publish. Sync and Publish can be refunded in full within 7 days; Catalyst, commercial licenses and Obsidian Credit are non-refundable.

License: the app is proprietary, and the License Overview says the company owns the code. The open parts are licensed separately: the plugin API type definitions in obsidian-api are MIT. The repo was created on 2020-10-26, and LICENSE.md was first added by commit 009a10f at 2022-10-20 06:30 (UTC+8), with the line "Copyright 2022 Dynalist Inc." The package.json of the API also says MIT.

Risks & limits

Desktop remote code execution (CVE-2026-104077). Preconditions: a desktop build before 1.14.0, the Slides core plugin enabled, a note carrying a malicious data-background-iframe attribute opened, and the presentation started manually. Per the CVE text, the attribute slips past DOMPurify and is loaded as an iframe address by the bundled Reveal.js 4.3.1; because the vault window has Node integration on and context isolation off, the injected script can call Node APIs and run system commands. The scores come from VulnCheck acting as the CVE Numbering Authority: 8.5 under CVSS 4.0 and 7.8 under CVSS 3.1. The official 1.14 changelog lists "Fixed a potential iframe injection in the Slides plugin."

MathJax filter bypass (CVE-2026-104078). Preconditions: a note with a crafted math formula that renders as a link in Live Preview, and the victim clicking that link. A TAB byte inside the URL scheme keeps MathJax's safe filter from recognizing the javascript: scheme. VulnCheck again assigned the scores: 8.4 under CVSS 4.0 and 7.8 under CVSS 3.1. The CVE text limits impact to versions before 1.14.0; the finder, CodeAnt, writes that the bug still reproduced on 1.14.x with MathJax 4.1.3, and that the upstream fix is slated for the MathJax 4.2 milestone. Both issues were reported to the vendor on 2026-09-16, and the CISA SSVC assessment records no known exploitation and not automatable.

An earlier flaw (CVE-2023-2110). On desktop builds before 1.2.8, opening a malicious Markdown file, or pasting text copied from a malicious web page, could let local files be read and sent out through app://local paths. The CNA, STAR Labs, scored it 8.2 and NVD scored it 7.1, both CVSS 3.1; version 1.2.8, released on GitHub on 2023-05-10, fixed it.

Plugin permissions. The help docs say plugins inherit the app's full access and the team cannot restrict them by permission. Since 2026-05-12 new versions must pass automated review, but plugins approved earlier stay listed for now even if they fail.

Known limits of Sync. Trail of Bits reported 11 issues in its December 2025 audit; 3 were not fully resolved and are explained on the Sync security page: file hashes are encrypted deterministically, so under specific conditions a compromised server could tell whether a given file had been uploaded; and metadata such as which device uploaded or deleted a file, when, and the mapping between encrypted paths and encrypted content is not end-to-end encrypted.

Closed source. The app's code is not public; its published security record consists of the vendor's audits and third-party research.

How it got here

The About page says Erica Xu started Obsidian in 2020. Steph Ango, who became CEO in 2023, refers in a blog post to the two co-founders as Silver and Licat and says the pair first launched Obsidian in 2020. The plugin API type-definition repo was created on 2020-10-26, with its first commit tied to version 0.9.7.

Desktop 1.0.0 shipped on 2022-10-13, adopting tabs throughout, with a redesigned interface and an overhauled theme gallery. A week later the obsidian-api repo gained its MIT license file.

On 2023-02-06 Steph Ango, author of the Minimal theme, announced joining full-time as CEO, restating that the app would stay free, built on open file formats, offline-first and customizable through plugins, and fully user-supported.

The 2024 changes centered on open formats and pricing: the JSON Canvas spec on March 11, and on March 20 a Sync Standard tier from $4 a month, with the existing plan renamed Sync Plus. On security, the first Cure53 client audit was published on 2024-01-10; its 4 vulnerabilities had been fixed in 1.5.3, released on 2023-12-26. A second client audit ended in October 2024; its 6 findings mostly concerned the then-unreleased Web viewer core plugin.

On 2025-02-20 the commercial license became optional and work use free. A 2025-09-19 post described how dependencies are kept few: versions are strictly pinned, postinstall scripts are not run, and large libraries such as pdf.js, Mermaid and MathJax are upgraded only occasionally or when security fixes land.

2026: the new community directory and automated review launched on May 12, and the two Sync audits by Cure53 and Trail of Bits were published on May 13. The first 1.14 build on GitHub, 1.14.4, was released on October 5, and on October 22, 1.14.5 moved Electron from 43.7.5 to 43.8.3 with several security fixes, and the changelog asks users to download the installer again from the website. The 1.15.0 beta listed in the changelog swaps Mermaid for the Pele library, and the changelog says that because Pele cannot run code, the setting to ask before showing Mermaid diagrams was removed.

Our verdict

Obsidian stores notes as plain Markdown files in a folder the user chooses, works without an account, and its privacy policy says the app collects no personal data or telemetry; since 2025-02-20 it has been free for personal and work use, with the optional Sync and Publish as the paid services; the plugin API is public, and as of 2026-10-25 the official community directory lists 9,467 plugins.

Its limits: the app is proprietary and its code is not public; plugins inherit the app's full access and the team cannot restrict them by permission; both desktop flaws disclosed on 2026-10-09 need user action to trigger, and the CVE text and the finder, CodeAnt, disagree on whether the MathJax issue is fixed on 1.14.x; the changelog asks for desktop 1.14.5 or later and a fresh installer from the website.

Why it stands out

Obsidian is a knowledge base built on a folder of Markdown files you own. No account is required, sync is optional, and the application has become the centre of a plugin ecosystem numbering in the thousands, built by a company of a handful of people.

Shida Li and Erica Xu, who previously built Dynalist, made a bet on local files at a moment when every competitor was moving to the cloud. That bet is the product's moat.

It works on a folder of Markdown files you own, needs no account, and has thousands of plugins, from a company of a handful of people.

Sources

Official

Updates & reading

From the builderOct 1, 2026

Obsidian October 2026

In May, we launched the new Obsidian Community , and since then the number of plugins and themes has more than doubled to over 8,000 projects!

ObsidianOfficial blogRead story

From the builderMay 13, 2026

Obsidian Sync audits by Cure53 and Trail of Bits

We’re pleased to report that all findings from these reports have been addressed via remediations and disclosures validated by the respective auditors.

ObsidianOfficial blogRead story

From the builderMay 12, 2026