Evaluating Obsidian
Published 2026-10-03
I have recently been evaluating Obsidian, the cross-platform note-taking app.
The good stuff
Simple, plain text notes
Obsidian works with "vaults" of notes, each of which map directly to a folder in your file system. Notes are plain text markdown files, and can be freely accessed and manipulated outside of Obsidian. It follows that there is no risk of data lock-in, and backing up notes is easy.
Obsidian is also an example of local-first software. Your notes are primarily stored on your own device, and there is no need to create an account to use most Obsidian features.
Cross-platform
As a web-based application Obsidian works on desktop and mobile devices, including iOS, albeit sometimes a little clunkily on mobile.
It is built on the Electron framework—which does have a reputation for bloated and memory-hungry apps—but so far performance has been acceptable and resource usage has not seemed excessive.
UI
While sometimes slightly awkward, the UI is usable and has some genuinely nice features too. I am especially liking the split pane views and command palette.
Sync
There are two paths for cross-device synchronisation of Obsidian notes to consider:
- Core sync plugin (paid/subscription only)
- A community sync plugin
The second option does not require payment but—as discussed below—has some trade-offs that must be considered carefully. The core sync plugin requires an Obsidian subscription. Pricing starts at $5/month including 1GB of storage.
For me, syncing notes between devices is a must-have feature and is the main reason I have paid for a subscription. So far Obsidian has synced notes between my Linux laptop and iOS devices reliably.
The bad stuff
Closed source
I strongly prefer free (libre) software over proprietary, and would especially like to avoid a non-free program for managing my personal notes. It's a shame that Obsidian's clients are not open source, although this is somewhat mitigated by the absence of any data lock-in.
Plugin security
Obsidian's community plugins have a large security blast radius. As the documentation states:
- Community plugins can access files on your computer.
- Community plugins can connect to internet.
- Community plugins can install additional programs.
In other words, don't get this wrong or you will be very sorry indeed. To be fair, Obsidian tries to mitigate the risks with a plugin directory that provides some visibility over version history, and by performing automated security scans of all plugins as well as manual reviews of popular ones[1]. But with consequences this severe the only reasonable starting point is to treat community plugins as untrusted and potentially malicious code.
This puts a lot of responsibility on the end user to both verify plugin authenticity, and decide what level of risk profile they are prepared to tolerate. I like Obsidian and want to use its community plugins but I am not open to excessive risk. This is especially the case on my personal laptop given that Linux has weak inter-app isolation compared to some other operating systems. Recent reports of a wave of targeted credential-harvesting attacks [2, 3] only increase my level of caution.
As if to underline the point, while researching community sync plugins I managed to mistakenly install a vibe-coded clone of the established vrtmrz/obsidian-livesync plugin and use it without realising for several days. A few anxious hours followed until I was happy that the plugin was nothing worse than benign slop. There may have been an element of carelessness here but it also underlined how easy it is in this space to shoot a nail into one's foot.
So for now I am choosing to pay a premium for Obsidian's own synchronisation service, despite maintaining a home server on which I would prefer to store my notes. This way I can reduce my community plugin exposure to a minimum (the tasks and Kanban plugins are both excellent), share my notes between devices and as a bonus support the Obsidian project until such a time that a libre alternative may be available.