Firefox Sync: How It Works, What Encrypts What, and Self-Hosting Options

Firefox Sync is more privacy-preserving than most people realize. Here's how it actually works and what it does (and doesn't) sync.

The Key Difference: End-to-End Encryption

Firefox Sync encrypts your data before it leaves your device. Mozilla's servers store ciphertext — they cannot read your bookmarks, passwords, or history.

This is different from Chrome Sync, which encrypts data in transit but Google has the keys and can read your data.

Firefox Sync uses:

1. A Sync Key derived from your Firefox Account password via PBKDF2 (100,000 iterations)
2. AES-256 encryption of all synced data
3. Mozilla servers receive only encrypted payloads

The encryption/decryption happens locally on your devices. Even if Mozilla's sync servers were breached, your data would be unreadable without your password.

What Syncs

• Bookmarks: Full bookmark tree including folders
• History: URLs, titles, visit times (up to 60 days by default)
• Passwords: Logins with encrypted credentials
• Open Tabs: Which tabs are open on each device (shows as "Tabs from other devices" in sidebar)
• Add-ons: Extension list (which extensions are installed, not their settings)
• Preferences: Some Firefox settings
• Address Autofill: Saved addresses (not cards)

What Doesn't Sync

• Cookies and sessions: You'll need to log in again on each device
• Extension settings and data: Extensions need their own sync (some have it, some don't)
• Pinned tabs: These don't transfer
• Containers and container assignments: Multi-Account Containers config doesn't sync
• Tab groups: New native tab groups don't sync yet
• Saved credit cards: Stored locally only

Setting Up Sync

1. Create a Firefox Account at accounts.firefox.com
2. In Firefox: Settings → Sync → Sign in
3. On additional devices: same Settings → Sync → Sign in

Recovery key: Critical for account recovery. Save it in a password manager. Without it, if you lose access to your account, your data is unrecoverable (it's encrypted with a key derived from your password).

Selective Sync

Settings → Sync → Choose what to sync.

You can enable/disable each category independently. If you don't want history syncing (e.g., work computer), disable it selectively while keeping passwords and bookmarks.

Disconnect Without Deleting

When signing out: "Disconnect" keeps local data but stops sync. "Disconnect and delete" removes the local copy.

If you're signing out of a shared or lost device, you can remotely disconnect it via accounts.firefox.com → Devices.

The Technical Detail: BrowserID and FxA

Firefox Accounts (FxA) uses a token server for authentication, separate from the storage server. The flow:

1. Authenticate with FxA → receive OAuth token
2. Exchange token at Token Server → receive storage server URL and credentials
3. Sync engine pushes/pulls encrypted data to storage server

Sync records are stored as JSON blobs in a Sync server (Mozilla's, or self-hosted). Each record is encrypted with the Sync Key.

Self-Hosting Firefox Sync

You can run your own sync server using Syncstorage-rs (Rust implementation) or the older Python syncserver.

Basic Docker setup:

services:
  syncserver:
    image: mozilla/syncserver:latest
    environment:
      - SYNCSERVER_PUBLIC_URL=https://sync.yourdomain.com
      - SYNCSERVER_SECRET=your-secret-here
      - SYNCSERVER_ALLOW_NEW_USER=true
    ports:
      - "5000:5000"

Configure Firefox to use your server:
about:config → identity.sync.tokenserver.uri → https://sync.yourdomain.com/token/1.0/sync/1.5

Self-hosting gives you full control over sync data storage. You still need a Firefox Account for authentication — you cannot self-host the FxA identity service easily (it's complex to operate).

Open Tabs Across Devices

One underused feature: synced tabs.

In Firefox sidebar → Synced Tabs → shows open tabs from all signed-in devices.

This is useful for:

• Continuing reading something on mobile that you started on desktop
• Checking what's open on your work machine from home
• Finding a URL you had open yesterday but closed

The URL list is encrypted and synced; Mozilla can't see which sites you had open.

Storage Limits

Firefox Sync has a storage quota per account. The exact limit varies but is generally 5GB+ for free accounts. Most users never hit it (bookmarks and passwords are tiny; history is more significant).

You can check usage: about:sync-log → current sync engine storage.

Why Not Just Use a Password Manager?

Good question. For passwords specifically, a standalone password manager (Bitwarden, 1Password) offers:

• Cross-browser support
• Better sharing features
• More detailed audit trails
• Often better mobile apps

Firefox Sync's password sync is convenient if you're all-in on Firefox, but if you use multiple browsers or want to share passwords with others, a dedicated password manager is better.

For bookmarks and tabs specifically, Firefox Sync has no real alternative — bookmark sync services are surprisingly scarce and most require sharing data with a third party.