Pair Syncthing Devices Safely Verify Device IDs Before You Trust a Connection
There is no Syncthing account and no password. Your entire security is one long code — the Device ID — and the habit of verifying it properly. This guide shows how pairing works and how to do it without ever trusting the wrong machine.
✍️ Technical Anshu🖥️ Windows / Linux / Android⏱️ Read before your first pairing
🎥 Device pairing is shown live in the main Syncthing setup video — watch the IDs being exchanged
Every Syncthing installation creates a pair of cryptographic keys and shows you a fingerprint of the public one: the Device ID, a string of groups like XXXXXXX-XXXXXXX-.... Two devices will only ever talk after each has been given the other's ID and accepted it. That design is genuinely strong — but it depends on one human moment: making sure the ID you accept really belongs to the machine sitting in front of you, and not to somebody else.
Device ID panel — Actions, Show ID (example values)
MY DEVICE ID (share this, it is not a password)
PBIKQTO-4KZ2H7A-9XLMN3D-QWER5TY-U7IOPA2-S3DFGHJ-KLZXCVB-N4M6Q8A
This ID is a fingerprint of this device's public key.
Safe to share — it identifies the device, it cannot unlock it.
The matching private key never leaves this machine.
REMOTE DEVICE wants to connect:
Name shown ............ "DESKTOP-9F31KQ"
ID ends with .......... ...N4M6Q8A
Do not accept until you have matched the FULL ID
with the person holding that device.
Illustrative panel — example IDs only; always compare the complete ID, not the first group
1
Why the ID Is the Whole Security Model
When two Syncthing devices connect, they perform a TLS handshake using the certificates behind their Device IDs. Each side checks: "is the certificate at the other end exactly the one whose ID I accepted?" If not, the connection is dropped. This means:
There is no central server that can be hacked to reach your files. There is no server.
A stranger who learns your Device ID learns almost nothing — it is a fingerprint, not a key. They still cannot connect, because you must accept their ID before anything flows.
The one real attack is social: tricking you into accepting the wrong device. All the checks below exist to defeat exactly that moment.
2
The Safe Pairing Routine
Do it the same way every time:
Best: scan the QR code. On the new device choose Show ID; it displays a QR code. Scan it from the other device or the Android app. Scanning removes typing errors entirely.
Good: read the ID aloud, in person or on a call with the person holding the other device, and compare it in full on both screens — all eight groups, not just the start.
Weak: sending the ID through chat or email and accepting it unseen. The ID itself is not secret, but this path never proves the other screen belongs to your device. Use it only between your own machines, and verify the first connection while both are in front of you.
Name each device clearly at pairing time — "Office Hub", "Anshu Laptop", "Moto Phone". Six months later, "DESKTOP-9F31KQ" tells you nothing when you are deciding whether to panic.
3
Both Sides Must Accept — And That Is the Point
New users often think the pending request on the second device is a glitch. It is the design. When you add a device on the hub, the other device shows "Device X wants to connect" and waits. Nothing syncs until a human there taps accept.
If a pairing request ever appears for a device you do not recognise, reject it and investigate. It means someone has your ID (harmless alone) and is hoping you will tap accept without looking (the actual attack).
The same double-accept applies per folder. Accepting a device does not share any folder; folders are offered and accepted separately.
Removing a device is equally deliberate: delete it on both sides, or it will sit forever in a disconnected state.
4
Extra Protection for Devices You Do Not Control
Sometimes a Syncthing device lives somewhere you only half-trust — a PC at a relative's home holding a family photo copy, or an office machine you do not administer. Syncthing has a setting for exactly this: when adding such a device, you can mark it Untrusted and set an encryption password for it.
Data sent to an untrusted device is encrypted with that password before it leaves your machine.
The untrusted device stores and forwards only encrypted blocks. It can keep your copy safe without being able to read it.
Your trusted devices use the same password to decrypt. Lose the password and that encrypted copy is unreadable — keep it in your password manager.
For your own machines in your own home, normal pairing is enough. This feature is for copies that live outside your control.
🔴 The one rule that keeps Syncthing safe: never accept a device or a folder just because a dialog appeared. Every acceptance should answer the question “which physical machine is this, and do I want it to have my files?” If you cannot answer, reject it and pair again properly.
🎥 See Safe Pairing Done in the Video
The main setup video pairs the hub, laptop and phone step by step — including the accept-on-both-sides moment.
No. The Device ID is a fingerprint of a public key and is safe to share — Syncthing's own interface displays it openly for pairing. Without you accepting their device ID in return, that person cannot connect or see a single file.
Can I pair devices without both being in the same room?
Yes. Read the full ID over a phone call or video call and compare it carefully on both screens, group by group. The verification matters, not the distance. What you should avoid is accepting an ID you received silently with no live check at all.
I replaced my phone. What happens to the old pairing?
Install Syncthing on the new phone — it generates a new Device ID, because the keys live in the app's data. Pair it with the hub like a fresh device, share the folders, let it sync, and then remove the old phone's entry from the hub when you are sure the new one is complete.
This guide is part of the Syncthing series by Technical Anshu • Watch the main setup video for the full live build 🙏