MFA ignored in sync

[Stuff-etc]

I set up a server with TOTP. But I don't exactly understand the benefits if clients can still sync without TOTP? (even the initial sync)
I am sorry if this explained somewhere, but I can't find it.

[dosubot[bot]]

Hi @Stuff-etc! I'm Dosu and I’m helping the Trilium team.

Enabling TOTP (MFA) in Trilium adds an extra layer of security for web logins and API token creation—users must provide a time-based code in addition to their password, making unauthorized access much harder even if the password is compromised. However, sync operations (including the initial sync) do not use TOTP for authentication. Instead, sync relies on a document secret and a timestamp-based HMAC hash to verify that both sides of the sync are legitimate; this process does not involve the user's password or TOTP code, which is why clients can sync without TOTP even when MFA is enabled. This is an intentional design choice and is documented in both the code and issue discussions (source, source).

If you want to enforce MFA/TOTP for sync, you would need to add authentication at the reverse proxy level, as Trilium's built-in sync mechanism does not support this (source).

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[Stuff-etc]

I had expected TOTP to protect new device sync as well, so it’s somewhat disappointing to see that it only applies to web logins. As a result, a compromised password could still allow an attacker to access my notes through a new client. Am I correct in understanding that TOTP is generally intended to prevent a leaked password from being used in this way?

[dosubot[bot]]

You're correct—TOTP in Trilium is only enforced for web logins and API token creation, not for sync operations or new device authentication. Sync uses a document secret and HMAC-based verification, so a compromised password could still allow an attacker to access your notes through a new client, since TOTP isn't part of the sync flow. This is an intentional design choice in Trilium's authentication model, and if you want to enforce MFA/TOTP for sync, you'd need to add it at the reverse proxy level in front of the Trilium server, not within Trilium itself. More details are discussed here.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.