Note, I did not want to give my full Nextcloud username and password to the plugin, since I assume it just saves it to plugins/.obsidian/webdav-sync/data.json (Iâm not sure?) Edit: it does not. It uses the Obsidian keychain to hide your password in a Chromium/Electron SecretStorage which is stored on your OS somewhere. That is very secure. Still, I would rather keep it out Obsidian if I can!
So I set up a dedicated share and a dedicated password using this guide for setting up a dedicated webdav sync folder for Zotero and the Nextcloud documentation on WebDAV shares. Hereâs my best effort at instructions. I have edited them a few times. However, please note the security note at the bottom.
Using WebDAV with a dedicated share folder / dedicated password (see security note)
- Create a folder in Nextcloud. The name likely doesnât matter (it does for Zotero but doesnât appear to for this plugin). I created a folder
/Obsidian sync
- Click the folder and select Info - then External Shares - then mark it âanyone with link can upload or delete.â
- Important: Add a share password and note it down somewhere. Letâs call it
fold3rpassw0rd.
- The link will look like
https://nextcloud.example.com/s/1337R4nd0mSh4r3S3cret
- Test your new share by copying it from the Nextcloud share link and then opening an Incognito window and opening the link. It should say âThis folder is password protected.â
- Open the WebDAV Sync plugin settings.
- WebDAV server URL:
http://nextcloud.example.com/public.php/webdav
- Account:
1337R4nd0mSh4r3S3cret â use the folder name from step #3
- Credential: click to open the Add Secret window.
- ID is
anonymous. This is required by Nextcloud as of 2026.
- Secret is
fold3rpassw0rd â your folder share password from step 3.
- Click âCheck connectionâ and see if it is successful. If it is not, recheck your URL, Account name, and Secret.
- Remote directory: whatever you want. I made it my Vault name, so now my Vault is recognizable on my Nextcloud web portal as
/Obsidian sync/vault
- Change other settings as you see fit
- Go back to the Note view. Bring up the command panel (Ctrl+P on Windows and Linux). Type âwebdavâ and select the option to sync now.
- The sync menu will ask you which local vault folders to sync. I unselected any dot folder which showed up just to avoid sync conflicts, and made sure all my notes were checkmarked
Security note:
Pros: the plugin can only access its own folder. This access is easily revoked from the Nextcloud web portal without touching your username, password, or MFA, or finding and deleting its app password (see instructions below). Since scope is limited, if an attacker finds it, only the vault folder is vulnerable.
Cons: your vault is theoretically publicly accessible to anyone with the link, but I think the risk is minimal for two reasons. First, you presumably set a good folder share password. If you did not set a folder password, anyone who finds the share link can read, edit, add, or delete notes. I tested this myself from an incognito window without a password. With a password, they have no access.
Secondly, because the link is obscure. I suppose thereâs a non-zero chance someone might run a random link generator bot on your server and come across it, and then access your notes. Claude says there are ~36^15 possibilities so this is unlikely. In my case, my notes are not sensitive.
I am not a security professional. Maybe your regular Nextcloud username and password is the way to go, I donât know!
Normal private access, I think this gives the plugin full access but it also avoids exposing your folder to the public internet
If I had to guess, this is how youâd use your Nextcloud username and password like a normal person, assuming you have MFA set up:
- Your private WebDAV link is
http://nextcloud.example.com/remote.php/webdav. You can find it in the Nextcloud web view, select Files, then the gear at the bottom right. Copy the WebDAV link supplied.
- Generate an app password.
- In that same screen in the Nextcloud Files settings, it may say âCreate an app password. This is required because Two Factor Authentication is set up for this account.â
- Alternatively, go to Nextcloudâs Personal Settings, Security, and scroll way down to âGenerate a new app password.â
- In WebDAV Sync settings, follow the instructions above, but using your private WebDAV URL, your real account username, and your generated app password. Test the connection and then sync.