Is Obsidian open source? No, and the closed part that matters is the server

No. Obsidian is not open source. Its own release repository says so in one line, "Obsidian is not open source software and this repo DOES NOT contain the source code of Obsidian", and the app ships under a licence that reserves the rights to its code. What is open is a good deal of what sits around the app: your notes are plain markdown files, and several of Obsidian's side projects are MIT.

That answer is short, and most pages that rank for this question stop there. The more useful question is the one underneath it: what does the closed part actually stop you doing? For one person writing in their own vault, very little. For a team sharing a vault, the closed part is exactly the part that holds the shared copy and decides who can open it, and that is where it starts to matter. It is also the part Baalda, the app this site is for, publishes under Apache-2.0, which is why this page goes further than a yes or no.

Is Obsidian open source or not?

Not. As of 16 October 2026, these are the facts from Obsidian's own pages:

• The app is closed source. The obsidianmd/obsidian-releases repository hosts the installers and the community plugin and theme lists, and its README states the app's source is not in it. The licence page says Obsidian owns and reserves "rights to our content, including text, images, and code in the app".
• The app is free. The same licence page, last updated 20 February 2025, says "Obsidian is free for all purposes, including personal, commercial, and non-profit use." That was a change: before that date, people at companies of two or more were required to buy a Commercial license. It is now optional, at $50 per user per year.
• The paid services are closed too. Sync is $4 per user per month billed annually ($5 monthly), and Publish is $8 per site per month billed annually ($10 monthly). Both run on Obsidian's servers, and there is no official way to run either yourself.

So "is Obsidian free and open source" gets two different answers. Free, yes. Open source, no.

Which parts of Obsidian are open?

More than people expect, and none of it is the editor:

The first row is the one Obsidian is known for. Steph Ango, who helps make Obsidian, wrote the argument down in 2023 as "File over app": "if you want to create digital artifacts that last, they must be files you can control." Obsidian is closed, but it stores your notes in a format no company owns, so leaving it is a copy, not an export.

Why isn't Obsidian open source?

The fullest answer from the company is still a forum post from 4 August 2020, by Silver, one of Obsidian's two co-founders, in the long-running "Open Sourcing of Obsidian" thread. It makes four points, and they are fairer than the thread's tone suggests:

1. "Open source does not necessarily guarantee safety." A real audit costs money, and Silver put it at "anywhere between 5-20k dollars".
2. "Open source does not necessarily mean faster improvement." Reviewing outside code can take longer than writing the fix.
3. "Open source projects do not necessarily last forever." A sustainable business keeps an app alive too.
4. "Doing open source right is a significant effort", more than putting code on GitHub. For what was then "our small team of 2", it did not pay.

The post closes that open sourcing "does not make sense given the current circumstances", and mentions a pledge to open up code access if Obsidian is ever discontinued as a good idea. That post is six years old. We could not find a newer official statement that replaces it, and Obsidian's About page answers the trust question a different way: "we use simple, open file formats that prevent lock-in."

Does it matter that Obsidian is closed source?

For a single person, mostly no, and it is worth saying that plainly. Your notes are files on your disk. If Obsidian changed its terms tomorrow, you would open the same folder in another editor and lose your plugins, not your writing. Closed source costs you the ability to read the code and to fork the app, and for a personal vault the file format already covers most of what open source would have bought.

It starts to matter when the vault stops being personal. A shared vault lives in two places: the files on each person's disk, and the server that moves changes between them and decides who gets them. In Obsidian, the second half is Sync. Its security page says end-to-end encryption is the default, that the servers are hosted by DigitalOcean, and that "Some metadata is not end-to-end encrypted". You can believe all of that, and you probably should, but you cannot check it, and you cannot run it on your own machine. The guide to sharing an Obsidian vault covers what Sync's sharing model costs a team and what it lets each person do.

That is the line worth drawing. The open file format protects your notes. It does not protect the layer a team depends on: the shared copy, the list of who can read which folder, and the code that enforces that list. If you want that layer to be something you can read and run, the client's licence was never the part to look at.

What does an open source shared layer look like?

This is the part Baalda was built for. It keeps the model Obsidian made popular, every note a plain .md file in a folder on your disk, so moving an existing vault in is a copy. What it changes is the licence on the half Obsidian keeps closed.

Baalda is Apache-2.0, and that includes the sync server, not only the app. Permissions are per folder and per note, and they are enforced on the server rather than hidden in the interface. Before a device syncs a note it asks the server for a per-document token, and the server works out the effective permission and returns a read-write token, a read-only one, or a 403. The code that makes that decision is in the public repository at app/apps/server/src/permissions/resolver.ts, so a team that wants to know who can open its notes can read the answer rather than trust a help page. The same gate applies to an AI assistant connecting over MCP, which gets exactly the access a person with its grant would.

Running that server yourself is a Node service and a Postgres database. The compose bundle in the repository brings both up:

cd deploy/compose
cp .env.example .env    # POSTGRES_PASSWORD, JWT_SECRET, BETTER_AUTH_URL
docker compose up -d

The deploy guide covers TLS, backups and upgrades, and how access works covers the permission model in full. If you would rather not run a server, the managed backend is free for 2 people and 1 synced vault, and Team is $10 per seat a month.

Where Baalda is the wrong answer

Open source does not settle every question, and Silver's first point applies to us as much as anyone: public code is only safer if somebody reads it. A few honest limits:

• Not everything in the repository is open source. The ee/ directory is reserved for future commercial features such as SSO, SAML and audit logs, under a separate source-available licence that requires a paid subscription for production use. Everything outside it is Apache-2.0, and the project's rule is that ee/ can add features but never take away one that shipped in the open core.
• The name is not covered. Apache-2.0 lets you fork and host the code commercially, but the Baalda name and logo are trademarks, so a fork needs its own name.
• Obsidian's plugins do not come with you. Community plugins are written against Obsidian's own API and run only inside Obsidian. If your vault leans on Dataview or a dozen other plugins, that syntax stays as plain text.
• There is no iOS app yet. Baalda runs on macOS, Windows and Linux, with iOS planned. Obsidian has official mobile apps today.
• For one person, Obsidian is a fine choice. A free app over files you own, with optional end-to-end encrypted sync, is a good deal. If nobody else edits your vault, the closed licence costs you very little.

If what you want is an open source app for a personal vault, there are several good ones, and the Obsidian alternatives round-up ranks them, from Logseq to Reflect Open. If you want to keep using Obsidian and only replace its sync with something you run, the community plugin Self-hosted LiveSync is MIT-licensed and syncs through your own CouchDB or object storage. It moves files between your devices; it does not add permissions or a shared editing session.