Is SillyTavern Safe? What Its Own Docs Warn About

SillyTavern itself is safe. It is open source, it runs on your own machine, and the code is there to read. The risks that actually bite people are not in the software: they come from exposing it to the internet so you can use it from your phone, from the AI backend you connect it to, and from files other people made. Its own documentation is blunter about the first of those than any review article we found.

A note on sourcing. Everything quoted below comes from SillyTavern's own documentation at docs.sillytavern.app, read on August 13, 2026. This article is written by a competitor, so weigh it accordingly, and note that the short version is "yes, it is safe, and here is how people manage to make it unsafe anyway" rather than a hit piece. SillyTavern is genuinely excellent software.

Is SillyTavern safe to download?

Yes, from the official source. It is "a free and open-source project released under the AGPL-3.0 License", published on GitHub, and the project states it "will always be free and open-sourced". Open source is not automatically safe, but it does mean the code is auditable and that a large community would notice something malicious in the main repository.

The download risk is the same one that follows every popular free tool: unofficial mirrors. Search results and forum posts offering pre-packaged builds, installers that "make it easier", or bundled versions with a model already included are not the project. There is no reason to get it anywhere other than the official GitHub repository, and no legitimate build needs to come from a file host.

The Android case has its own version of this. SillyTavern on Android runs inside Termux, a terminal emulator, and the Termux build distributed through Google Play has been unmaintained for years. The maintained releases come from F-Droid or GitHub. Any guide still telling you to install Termux from the Play Store has not been checked recently, which tells you something useful about how carefully the rest of it was written.

Is SillyTavern secure?

On a single machine, with default settings, yes. It listens only on your own computer and nothing is reachable from outside. The security questions all begin the moment you change that, and this is where the project documentation is worth quoting directly, because it does not hedge.

The remote connections guide opens with a warning in capital letters: "NEVER HOST ANY INSTANCES ON THE OPEN INTERNET WITHOUT ENSURING PROPER SECURITY MEASURES FIRST." It follows that with a disclaimer that the project is "NOT RESPONSIBLE FOR ANY DAMAGE OR LOSSES IN CASES OF UNAUTHORIZED ACCESS DUE TO IMPROPER OR INADEQUATE SECURITY IMPLEMENTATION." That is unusually direct language for a docs page, and it is there because people ignore it.

The project has also built guardrails in. Once you enable the listen setting so other devices can connect, the docs state that "you must configure at least one access control method. Otherwise, the server will not start." Refusing to boot in an unsafe configuration is a good design decision and more than most self-hosted software does.

It is honest about the limits of what it offers, too. On the simplest option it warns that "HTTP Basic Authentication does not provide strong security. There is no rate-limiting to prevent brute-force attacks," and that "Both username and password are transmitted in plain text. If you are concerned about this, you can serve ST via HTTPS." A project that tells you its own login mechanism is weak is being straight with you.

The riskiest thing people do with SillyTavern

Port forwarding, so they can reach it from a phone. This is the single most common way a safe setup becomes an unsafe one, and it happens for an entirely understandable reason: there is no official mobile app, so the obvious fix is to open the home server to the internet and connect from anywhere.

The documentation says not to. Its words: "You should not use port forwarding to expose your ST server to the internet." The recommended alternative is a VPN or a tunneling service, and it names Cloudflare Zero Trust, ngrok and Tailscale as examples. Those put an authenticated layer in front of the server instead of publishing it to everyone.

What is at stake if you get this wrong is worth spelling out. An exposed SillyTavern instance is not just a chat window someone else can open. It is your entire conversation history, your character definitions, and in many setups an API key with a live balance attached to it. A stranger who finds it can read everything and spend your money. Internet-wide scanners find open ports in hours, not months, and they are not looking for you specifically.

One small configuration trap the docs flag, because it wastes an evening otherwise: when you set up a whitelist, "Ensure 127.0.0.1 is included, or you will be unable to connect from the host machine." People lock themselves out and then loosen the rules in frustration, which is exactly the wrong direction.

Are SillyTavern character cards safe?

Mostly, with a caveat that has nothing to do with malware. A character card is a definition file that other people made and shared, and what is inside it is instructions the model reads and follows. That is the entire point of the format, and it is also the reason a card is not quite the same as a text file.

A card can contain far more than the personality description you see in the editor. Fields that shape behaviour are not always visible at a glance, and a card built to steer a conversation somewhere you did not ask for it to go will do exactly that without announcing itself. This is not a hack so much as the format working as designed with unfriendly input. Open a card in the editor and read the fields before using one from a source you do not know, particularly if it came from an aggregator rather than its author.

Most cards circulate through community sites, and those sites have their own policies worth understanding separately. We looked at one of the larger ones in our write-up of Chub AI, which is where a lot of cards originate. Extensions deserve more caution than cards do, because an extension is code running with the same access as the application, and the same rule applies: install from the official list, not from a link in a thread.

Does SillyTavern keep your chats private?

This is the question where the popular answer is wrong, and it matters more than everything above. People describe SillyTavern as private because it runs locally. The interface does. The AI does not necessarily.

The documentation is explicit that "SillyTavern is only an interface, you will need access to an LLM backend to provide inference." If that backend is a model running on your own hardware, then nothing leaves your machine and the privacy claim is completely true. It is genuinely the strongest privacy setup available in this category, better than any hosted service including ours, and that deserves saying plainly.

If that backend is a hosted API, which is how most people run it, every message goes to that provider and is handled under that provider's terms. Your retention, your logging and your training exposure are all theirs, not SillyTavern's. Running a local front end does not change what happens after the request leaves. We went through which providers actually commit to what in which AI chatbots do not train on your data, and the differences between them are large.

Is SillyTavern safe for beginners?

Safe, yes. Suitable is a different question. The documentation describes its audience as "power users" and "savvy AI hobbyists", and that is an accurate description rather than modesty. The security decisions above are ones you have to make correctly, and a beginner following a badly written guide is the realistic failure case here, not a flaw in the software.

The pattern we would watch for is this: someone installs it, enjoys it, wants it on their phone, finds there is no app, follows a tutorial that says to forward a port, and ends up with an open server they have forgotten about. Every step is reasonable and the result is bad. If you are going to run it, decide up front how you will reach it remotely, and use a tunnel from the start.

The bottom line

SillyTavern is safe software with sharp edges, and the project is more honest about those edges than the articles written about it. The three rules that cover almost everything: install it from the official repository, never expose it to the internet with a forwarded port, and remember that your privacy is decided by the model you connect rather than by the interface in front of it.

If reading that list felt like a chore rather than a Saturday project, that is a legitimate reason to want something else, and it is the honest case for a hosted product. We compared the two setups properly, including where SillyTavern wins outright, on our SillyTavern alternative page, and looked at the wider category in best AI for roleplay. If your concern is the underlying question of whether this kind of chat is safe at all, are uncensored AI chats safe covers it.

Depravity is the hosted version of the same idea: uncensored conversation for US adults 18 and over, from $15 a month, in a browser on any device, with the model and long-term memory included and nothing to secure yourself. You give up character cards, lorebooks and model swapping to get that. Which trade is right depends on whether you enjoy the setup, and plenty of people genuinely do.