Seafile vs Syncthing on a VPS

Seafile vs Syncthing: the short answer

Seafile vs Syncthing is a choice between two designs. Seafile is a central file server: your devices sync to it, and it gives you a web interface, share links and per-library history. Syncthing has no server at all. Every device is an equal peer, and your VPS is simply the one peer that never sleeps.

Pick Seafile when people outside your own devices need to reach the files, through a browser or a link. Pick Syncthing when you only want your own machines to hold the same folders, with no web application to patch and expose to the internet.

If you are still choosing between more tools than these two, the wider survey of self-hosted Dropbox alternatives covers the rest of the field. This guide goes deeper on the operational details: how each one stores data, what an encrypted setup still shows the server, how versions and conflicts behave, and what each needs from a small VPS.

Which versions this guide covers

Syncthing v2.1.7 is the current stable release. It was published on 21 October 2026, and its notes list fixes for SQLite statement handling and garbage collection.

The 2.x line matters because Syncthing 2.0 moved its database backend from LevelDB to SQLite. The first launch after an upgrade from 1.x runs a migration, and the release notes say it "can be lengthy for larger setups". They give no duration, so plan for downtime on a box that holds many files. Syncthing 2.0 also brought these changes:

• Two v2 devices now open multiple connections by default: one for index metadata and two for data.
• Deleted items are forgotten from the database after six months, unless you change --db-delete-retention-interval.
• Single-dash long options are gone. A script that passes -home must now pass --home.
• Some platforms lost their prebuilt binaries, because SQLite made cross-compiling harder.

For Seafile, this guide uses the 13.0 line. The Community Edition (CE) compose file pulls seafileltd/seafile-mc:13.0-latest, and the newest 13.0 patch in Seafile's changelog is 13.0.29, from 4 November 2026. This patch fixes multiple security vulnerabilities, so update existing 13.0 installs. Seafile 14.0.9 exists, but the changelog marks it "beta" (14 October 2026), and the 14.0 manual now includes upgrade notes and configuration changes for 14.0. Stay on 13.0 until 14.0 leaves beta. One more 13.0 change shapes the install: deploying the CE from a binary package is no longer supported, so Docker is the install path.

How Seafile and Syncthing differ on a VPS

Seafile 13.0 is a Docker Compose project. The .env file it ships sets COMPOSE_FILE='seafile-server.yml,caddy.yml,seadoc.yml', so a default start brings up five containers:

• seafile, the server itself, which serves the web app and the sync protocol.
• db, running mariadb:10.11.
• redis, the default cache. The image is redis with no tag, which means it floats to whatever the latest image is. Memcached is no longer bundled by default in Seafile 13.
• Caddy (lucaslorentz/caddy-docker-proxy:2.12-alpine), which publishes ports 80 and 443 and proxies to Seafile.
• SeaDoc, the collaborative document editor, which the env file turns on with ENABLE_SEADOC=true.

Syncthing is one program run by systemd, one unit per user account. It listens on port 22000 over TCP, and on 22000 over UDP for QUIC (a UDP-based transport). It uses 21027/UDP for local discovery broadcasts. Its web GUI listens on 127.0.0.1:8384 by default, so it is not reachable from the internet until you change that setting.

That difference drives everything below. Seafile owns your files and hands them out. Syncthing only copies files between disks that you control.

Install Syncthing 2.x on a VPS as an always-on peer

Syncthing runs its own apt repository with a stable-v2 channel. These are the commands from that repository's page:

sudo mkdir -p /etc/apt/keyrings
sudo curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpg
echo "deb [signed-by=/etc/apt/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable-v2" | sudo tee /etc/apt/sources.list.d/syncthing.list
sudo apt-get update
sudo apt-get install -y syncthing
apt-cache policy syncthing

apt-cache policy should show an installed version starting with 2.1, taken from apt.syncthing.net. A 1.x version means apt picked the package from another source, so check that the .list file was written correctly.

Run Syncthing as its own unprivileged user, not as root. The systemd unit syncthing@<user>.service runs as the user named after the @, and keeps its config in that user's home directory.

sudo useradd --create-home --shell /usr/sbin/nologin stsync
sudo systemctl enable --now syncthing@stsync.service
systemctl status syncthing@stsync.service
ss -tln | grep 8384

systemctl status should show active (running). The ss line should show the GUI on 127.0.0.1:8384 only. Leave it there. Reach it from your laptop through an SSH tunnel instead of opening it to the world:

ssh -L 8384:127.0.0.1:8384 you@your-vps

Then open http://127.0.0.1:8384 in your laptop's browser. Set a GUI username and password in the settings before you do anything else, because anyone with a shell on the VPS can reach that port.

Open the sync port. Syncthing's firewall docs give these commands:

sudo ufw allow syncthing
sudo ufw status verbose

The docs also show sudo ufw allow syncthing-gui, and say it is not necessary for a typical install. With the SSH tunnel above you do not need it. If ufw answers Could not find a profile matching 'syncthing', the profile file is missing on your system, so open the ports by number with sudo ufw allow 22000/tcp and sudo ufw allow 22000/udp. Many providers also run a separate network firewall in their panel. Open 22000 there too, or your devices may fall back to talking through a relay. Relays cannot read your data (the FAQ says relays "do not and can not see the data transmitted via them"), but a relayed connection is usually slower than a direct one.

Install Seafile 13.0 with Docker Compose

This assumes Docker and the Compose plugin are already installed. If they are not, start with Docker Compose basics on a VPS. These are the download commands from Seafile's CE Docker page:

sudo mkdir /opt/seafile
cd /opt/seafile
sudo wget -O .env https://manual.seafile.com/13.0/repo/docker/ce/env
sudo wget https://manual.seafile.com/13.0/repo/docker/ce/seafile-server.yml
sudo wget https://manual.seafile.com/13.0/repo/docker/seadoc.yml
sudo wget https://manual.seafile.com/13.0/repo/docker/caddy.yml
sudo apt-get install -y pwgen
pwgen -s 40 1

Edit /opt/seafile/.env before the first start. Four values are required:

• JWT_PRIVATE_KEY: a random string of at least 32 characters. Paste the output of pwgen -s 40 1.
• SEAFILE_MYSQL_DB_PASSWORD: the password for the seafile database user.
• SEAFILE_SERVER_HOSTNAME: the domain name that points at this VPS.
• INIT_SEAFILE_MYSQL_ROOT_PASSWORD: the database root password. It is used only on the first start.

Also change INIT_SEAFILE_ADMIN_EMAIL and INIT_SEAFILE_ADMIN_PASSWORD. Their defaults are me@example.com and asecret, and both are printed in Seafile's public docs. Set SEAFILE_SERVER_PROTOCOL=https. The default is http, and the Caddy label on the seafile service builds the site address from that value plus the hostname, so leaving it at http serves the site without TLS (transport layer security).

If you do not need the online document editor, you can skip SeaDoc on a small VPS: remove seadoc.yml from COMPOSE_FILE and set ENABLE_SEADOC=false. Both lines are in the same .env file. Then start the stack:

cd /opt/seafile
sudo docker compose up -d
sudo docker compose ps

docker compose ps should list every service as running. Point your DNS record at the VPS before the first start, and make sure ports 80 and 443 are open, because Caddy serves the site on them and uses them to obtain its certificate. For more on how that proxy layer works, see Caddy as a reverse proxy on a VPS.

How Seafile stores files on disk, and what that means for backups

Seafile does not store your files as files. Each library is split into objects, each kind in its own directory under seafile-data/storage/: commit objects in commits/<repo_id>, file-system tree objects in fs/<repo_id>, and file content in blocks/<repo_id>. With the Docker defaults, that tree sits under /opt/seafile-data/seafile/seafile-data/storage/ on the host. You cannot browse it and copy a document out. You need Seafile, or one of its tools, to turn the objects back into files.

Seafile also de-duplicates blocks. Its garbage collection docs say "The underlying data blocks will not be removed immediately after you delete a file or a library." Disk space comes back only after you run garbage collection (GC), so a full disk does not empty itself when users delete files.

The backup order matters. Back up the databases (ccnet_db, seafile_db, seahub_db) first, and the data directory second. If you copy the data first, the database dump can reference objects that were written after your data copy, and those libraries are then broken in the backup. The database container is named seafile-mysql:

sudo mkdir -p /backup/databases /backup/data
cd /backup/databases
sudo docker exec seafile-mysql mariadb-dump -useafile -p'YOUR_DB_PASSWORD' --opt ccnet_db | sudo tee ccnet_db.sql > /dev/null
sudo docker exec seafile-mysql mariadb-dump -useafile -p'YOUR_DB_PASSWORD' --opt seafile_db | sudo tee seafile_db.sql > /dev/null
sudo docker exec seafile-mysql mariadb-dump -useafile -p'YOUR_DB_PASSWORD' --opt seahub_db | sudo tee seahub_db.sql > /dev/null
sudo rsync -az /opt/seafile-data/seafile /backup/data/

Seafile's docs advise writing each dump to a new file rather than overwriting the last one, so add a date to the names in a real script. For Docker installs, the parts of /opt/seafile-data/seafile that matter are conf, seafile-data and seahub-data.

After a restore, check the result. seaf-fsck.sh with no arguments runs a read-only integrity check of every library:

sudo docker exec -it seafile bash
cd /opt/seafile/seafile-server-latest
./seaf-fsck.sh

--repair replaces corrupted items with empty files or directories, so read the check output before you use it. --export writes library files out to a normal file system and does not need the Seafile database, which makes it your last-resort escape route. It works only for unencrypted libraries.

seaf-fuse is still documented for 13.0. It mounts libraries as a read-only FUSE file system, with one top-level folder per user email and one <library_id>-<library-name> folder per library. In Docker it needs privileged: true, cap_add: SYS_ADMIN, and a bind mount with propagation: rshared. Inside the container you start it with ./seaf-fuse.sh start /seafile-fuse from /opt/seafile/seafile-server-latest/. Encrypted libraries cannot be read through it.

Syncthing is the opposite. Every synced folder on the VPS is a plain directory of ordinary files, so rsync or restic reads it directly. The catch is in Syncthing's own FAQ: it "is not a great backup application", because every change, including a deletion, travels to all devices. Back up the VPS copy with a separate tool that keeps its own history.

Encrypted libraries vs untrusted devices: what the server can see

Both tools can keep file contents away from the VPS. They hide different things.

A Seafile encrypted library encrypts file contents on the client. The password is not stored on the server, and Seafile's help page says "even the server administrator can't access your file contents." Two limits matter. First, the library "only encrypts the contents of the files, but not the folder and file names", so the server sees your whole directory tree and every file name. Second, when you open an encrypted library in the web app, you type the password into the server. Seafile then caches it, in encrypted form, for one hour, and does not write it to disk. If you do not trust the server, use encrypted libraries only from the desktop and mobile clients.

Syncthing's "Untrusted (Encrypted)" devices go further. An untrusted device cannot see file data, file metadata (names, times, hashes) or the directory structure. The docs say "your directory structure is not replicated, even in encrypted-name form". What it can still see is the folder ID, the folder label and the approximate file sizes. Encryption uses XChaCha20-Poly1305 and AES-SIV, with a key derived from the password and the folder ID using scrypt.

To set it up, you set the password on a trusted device, per device and per folder, in the share tab of the folder or device edit dialog. On the VPS, the folder type must be "Receive Encrypted". Each untrusted device can have its own password. If you ever need the plaintext from the VPS copy, run syncthing decrypt on a trusted machine, never on the VPS itself.

Two warnings before you rely on it. Syncthing's docs still say "This feature should still be considered beta / testing only." And a rename on a trusted device becomes a full delete and re-transfer on untrusted devices, which costs bandwidth on a folder where people reorganise often.

How versioning and conflicts work in each

Seafile keeps history for every library as snapshots. From the File History button you can restore any version of a file, and you can restore a whole library to an earlier snapshot. The library owner sets the retention period. An admin can set a server-wide default with keep_days in the [history] section of seafile.conf. Old versions stay on disk until GC removes the blocks that fall outside the history limit.

Syncthing keeps no old copies by default. Versioning is off until you choose a type per folder: Trash Can, Simple, Staggered or External. Old copies go to .stversions inside the folder by default. The trap is in the docs: "Versioning applies to changes received from other devices." Turn on versioning on the VPS, and it keeps old copies when your laptop overwrites a file. It does nothing for a file edited directly on the VPS. Enable it on every device whose incoming changes you want to be able to undo.

Conflicts are handled in opposite ways. In Syncthing, when two devices change the same file, the copy with the older modification time is renamed to <filename>.sync-conflict-<date>-<time>-<modifiedBy>.<ext>. If both times are equal, the device with the larger device ID gets the conflict copy. The folder option maxConflicts keeps 10 conflict copies per file by default. Set -1 for no limit, or 0 to keep no conflict copies at all.

Seafile keeps the first version that reached the server unchanged. The other copy becomes a conflict file whose name ends with the author's email and the time, for example test.txt (SFConflict name@example.com 2015-03-07-11-30-28). Because the name says who made the change, a team can work out who should merge it.

The state of the mobile apps in November 2026

Seafile has official clients on both phone platforms. On iOS the app is called "Seafile Pro". It is free, the current version is 4.0.9, and it needs iOS 16.0 or later. The name refers to the client, not to a server licence, so it is not a sign that you need Seafile Pro on the server. On Android, F-Droid carries the official "Seafile" app at version 4.0.15, added on 6 November 2026.

Syncthing has no official mobile app left. The official Android app is discontinued, and its repository was archived on 3 December 2024. The README names no replacement. The active project is Syncthing-Fork, a community wrapper for Android. Its latest release is v2.1.7.0, published on GitHub on 21 October 2026 and on F-Droid on 25 October 2026. Its version numbers follow the Syncthing 2.1.x line. You install it from GitHub releases, F-Droid or Obtainium.

On iOS the Syncthing FAQ says "There are no plans by the current Syncthing team to officially support iOS in the foreseeable future." Syncthing's FAQ lists Möbius Sync for iOS. It is a separate, commercial, third-party app. If your phones are iPhones and the files must be on them, Seafile is the simpler path.

Community vs Pro: Seafile's limits and prices

The Community Edition is free and open source. Seafile Pro is free for up to three users: the pricing page says "You don't need a license file to run the pro edition for 3 users". Above that, as listed on the pricing page on 8 November 2026, prices are per year:

• 9 users: $100 in total. This is a special offer for small businesses, and it does not include email support.
• 10 to 249 users: $48 per user (€44).
• 250 to 499 users: $44 per user (€40).
• 500 to 749 users: $40 per user (€35).
• 750 to 999 users: $35 per user (€30).
• 1,000 users or more: contact Seafile.

The same page has a feature comparison between the two editions. Its rows include file locking, fine-grained folder permissions, full-text search, LDAP and Active Directory login, SSO (single sign-on) through ADFS and Shibboleth, two-factor authentication, audit logs, antivirus integration and S3 storage. Check the live page for which edition ticks which row before you plan around a feature. For a team of three or fewer, Pro costs nothing, so the comparison only starts to matter at the fourth account.

Note one 13.0 change if you use LDAP: WebDAV no longer accepts LDAP account logins, so those users must create a WebDAV token.

Syncthing has no paid edition and no user accounts. You share each folder with device IDs, one device at a time. That is fine for one person with five devices. It does not scale to a team the way Seafile's accounts and groups do.

How much RAM Seafile and Syncthing need on a small VPS

Seafile documents a minimum of 2 GB of RAM and 2 CPU cores for the Community Edition. Pro, in the default Docker setup, needs 4 cores and 4 GB, or 2 cores and 2 GB if Elasticsearch runs on another server or you use SeaSearch instead. These figures are for the whole stack: the Seafile container, MariaDB and Redis together. The compose file sets no memory limits, so measure your own box:

sudo docker stats --no-stream

Two settings in seafile.conf affect Seafile's memory. fs_cache_limit (in MB) defaults to 2G, and a lower value cuts RAM use. worker_threads defaults to 10. Dropping SeaDoc, as described in the install section, removes one container from the count.

Its tuning page gives settings for small machines instead. maxFolderConcurrency=1 syncs folders one at a time, which lowers peak memory. numConnections=1 cuts the overhead per device, since each connection has a memory and CPU cost. The GOMEMLIMIT environment variable gives the Go runtime a soft memory limit. Set it with a systemd drop-in:

sudo systemctl edit syncthing@stsync.service

[Service]
Environment=GOMEMLIMIT=400MiB

sudo systemctl restart syncthing@stsync.service
systemctl status syncthing@stsync.service

systemctl status prints the unit's current memory use, so you can compare it before and after. On a 1 GB VPS, Seafile sits below its own documented minimum, and Syncthing is the realistic choice. If you are pricing a VPS against a paid sync service, whether self-hosted storage is cheaper than Dropbox works through the disk and bandwidth side of that sum.

Running Seafile and Syncthing side by side on one VPS

Treat this layout as a suggestion from this guide, not a vendor recipe. The two do not compete for ports. Seafile's Caddy takes 80 and 443. Syncthing takes 22000 over TCP and UDP, and keeps its GUI on 127.0.0.1:8384.

Keep their data apart. Seafile writes to /opt/seafile-data and /opt/seafile-mysql. Syncthing writes into the home directory of stsync, or wherever you point each folder. Never point a Syncthing folder at /opt/seafile-data. It holds block and commit objects that only Seafile can read, and a peer that edits or deletes them there breaks libraries.

A split that works: Seafile holds shared team files that need links and a web interface. Syncthing holds your personal folders, with the VPS as a "Receive Encrypted" peer so the box never sees those names. Budget RAM for Seafile's documented 2 GB minimum first, and add Syncthing on top.

Which one to pick, by situation

• You need share links for people with no account: Seafile. Syncthing has no web sharing.
• You want the VPS to hold your files without seeing names or folder structure: Syncthing with a "Receive Encrypted" folder, accepting that the feature is still beta. A Seafile encrypted library still shows every file name.
• Your team uses iPhones: Seafile, which has a free official iOS client. Syncthing has no official iOS app.
• Your VPS has 1 GB of RAM: Syncthing. Seafile's documented minimum is 2 GB.
• You want backups you can read with plain tools: Syncthing, whose folders are ordinary files. Seafile needs its database and its own tools to rebuild files.
• You need accounts and groups for more than a handful of people: Seafile. Pro is free for three users, and the Community Edition is free and open source.

If Nextcloud is also on your list, the same trade-offs are worked through in Seafile compared with Nextcloud and Syncthing compared with Nextcloud.

FAQ

Can I copy files straight out of Seafile's data directory?

No. Seafile stores each library as commit, fs and block objects under seafile-data/storage/, not as normal files. To get files out, use the web app or a sync client. On the server, you can mount libraries read-only with seaf-fuse, or run seaf-fsck.sh --export. The export works without the database but skips encrypted libraries.

Is Syncthing's encrypted untrusted device feature safe to use?

It works, but Syncthing's own docs still say it "should still be considered beta / testing only." An untrusted device cannot see file contents, file names or the directory structure. It can see the folder ID and label and approximate file sizes. Keep a separate backup on a trusted device while you rely on it.

What replaced the official Syncthing Android app?

Nothing official. The official app was discontinued and its repository archived on 3 December 2024. The active Android option is Syncthing-Fork, a community wrapper whose latest release is v2.1.7.0 (October 2026). You install it from F-Droid, GitHub releases or Obtainium.

How many users can Seafile Pro have for free?

Three. Seafile's pricing page says you do not need a licence file to run the Pro edition for three users. A nine-user licence costs $100 a year in total, and larger teams pay per user per year, starting at $48. The Community Edition is free and open source.

Does Syncthing keep old versions of my files?

Not by default. You turn on versioning per folder, choosing Trash Can, Simple, Staggered or External. It only saves copies of changes that arrive from other devices, so a file edited directly on the VPS gets no old copy there. Conflicting edits are saved separately as .sync-conflict- files, up to 10 per file by default.