Nectenda

End-to-end encrypted real-time collaborative editing for Obsidian.

Live cursors, offline editing, shared folders and attachments — on a server that cannot read your notes. Content is encrypted on your device before it is sent; the server stores ciphertext it has no key for, and document paths are HMACs rather than filenames.

This repository

The Obsidian plugin and the shared library it is built from, source-available under the PolyForm Shield License 1.0.0.

This is the code that does the encrypting, and it is why the repository is published: every security property Nectenda claims is enforced here, on your device, before anything leaves it. The server relays ciphertext it cannot read and is not published — doing so would prove little, since nobody can verify which build an operator is actually running.

Start with docs/security-model.md: it states exactly what the server can and cannot see, and names the code implementing each claim so you can check rather than believe.

The published main.js is not minified, so the file that runs in your vault is one you can read directly.

This plugin requires an account and a server

Nectenda is a client for a sync server. It does nothing on its own: there is no offline-only or local-only mode, and with no account nothing syncs. Say so plainly before you install it.

There are two ways to run it, and they differ in what reaches us:

Hosted at nectenda.com. We operate the server, so your encrypted notes pass through our infrastructure and are stored on it. We cannot read them: content is encrypted on your device before it is sent, the keys are derived from your passphrase and never leave, and document paths are HMACs rather than filenames. What the server does see is real and is listed exhaustively in docs/security-model.md — which accounts share which folders, update sizes and timings, device records, and the display name you choose for a shared folder. Signing in talks to accounts.nectenda.com, the one address the plugin knows without being told.

A server you run. The plugin talks to whatever address you give it, and a vault pointed at your own server sends us nothing at all — not the ciphertext and not the metadata above. The server is not something you can obtain today: it will be sold as a licensed image, and that is not yet available. Said here because the plugin will happily connect to a self-hosted server and you should know which of the two you are in.

Both modes run the same encryption. The plugin talks to the server you point it at and to no third party.

What leaves your machine

Nothing about what you do. There is no analytics of any kind.

When you are signed in to the hosted service, the plugin reports its own crashes to an error tracker Nectenda runs itself — not a third party. It is on unless you turn it off, and it sends nothing until it has shown you what a report contains. A report carries the exception and its message, stack frames as line and column numbers in the published main.js, the plugin and Obsidian versions, the platform, and the install identifier every request already carries. It carries no note content, no note, folder or attachment name, no file path, not your vault's name, and no token or key.

The payload is built from a fixed list of fields rather than filtered down from a larger one — packages/plugin/src/error-report.ts, and there is no error-reporting library behind it, because a library owns the event and we would be subtracting from it. docs/security-model.md states the rule and names the code.

Running your own server? None of this applies. The address reports would go to is supplied by the server you sign in to; a self-hosted one supplies none, so none are sent.

Installing

Not in Obsidian's community plugin browser yet. Listing it starts an automated review of every future version, and we would rather take that step deliberately than as part of a first release. Two ways to install it meanwhile:

With BRAT, which also keeps it updated: add Nectenda/nectenda-plugin as a beta plugin.

By hand, from the latest release: take main.js, manifest.json and styles.css, put all three in <your vault>/.obsidian/plugins/nectenda/, and enable the plugin under Settings → Community plugins.

Then open Settings → Nectenda and sign in. Signing in creates your own organisation on the free plan; share a folder from the plugin's pane and anyone you invite sees your edits as you type.

What it costs

The plugin is free and always will be. The hosted service is what is paid for, and an organisation is the billable unit — a person can belong to several and takes one seat in each.

Free is not a trial: it does not expire and it is not a reduced version of a paid plan. Text sync is never blocked on any plan, and nothing is deleted if you stop paying — an organisation that lapses returns to Free with everything it stored still downloadable.

Plans are bought inside Obsidian rather than on a web page, because the keys that encrypt your vault are derived on your own device from a passphrase that never reaches us. An account cannot be created for you remotely; the last step is always yours. Full pricing at nectenda.com/pricing.

Build

pnpm install
pnpm build          # produces packages/plugin/main.js

Building it yourself is the point of publishing it: scripts/verify-build.mjs rebuilds from this source and compares the result byte for byte against the main.js in a release, so you can check that the file you installed is the file you just read.

Documentation

• Security model — what the server can and cannot see
• Sync limitations — every known case two vaults can disagree
• Key storage — where keys live and what an attacker gets
• Accounts — accounts, plans and devices
• Identity — signing in, and what the identity service holds

Licence

PolyForm Shield 1.0.0 — source-available, not open source.

Any purpose is permitted, commercial use included, except providing a product that competes with Nectenda. Reading this code, auditing it, modifying it for your own use, and building it to check the result against the main.js you installed are all expressly permitted — that is what publishing it is for.

If you redistribute any part of it, PolyForm Shield requires you to pass on the licence terms and this line, which also travels inside every built main.js:

Required Notice: Copyright (c) 2026 Nerchure Ltd (https://nectenda.com)

Getting help, and reporting a vulnerability

Support: [email protected] — accounts, subscriptions and refunds. We reply within three business days.

Security: if you have found a vulnerability, please write to [email protected] rather than opening an issue, and give us a reasonable chance to fix it before disclosing. We will confirm receipt within three business days, tell you what we find, and credit you unless you would rather we did not.

Every claim in docs/security-model.md is meant to be checkable against this code. If you can show one of them is wrong, that is the report we most want.

Generated from Nectenda's development repository; issues and pull requests are welcome here, and changes are applied upstream and mirrored back.