QNAP TS-233-US
D2 Cloud-Optional — Full function with the router off.
The unplug test
Your files are still on the drives and still reachable over SMB, AFP, NFS, or the QTS web interface at the NAS's LAN address — none of that depends on QNAP's servers. What you lose is remote access from outside your network via myQNAPcloud (which QNAP disables by default right after setup anyway) and anything that explicitly calls out to the internet, like package-center app downloads or firmware update checks. Set it up once locally with Qfinder Pro or a browser pointed at the NAS's IP, and it never needs to talk to QNAP again for daily file storage.
Why this tier: QNAP operates a vendor cloud (myQNAPcloud) for this device, which places it above D1, but setup can be completed entirely on the local network: QNAP's own documentation describes a Qfinder Pro / direct-browser initialization path that creates a local administrator account — a credential stored on the NAS itself, not a QNAP account — distinct from the separate 'cloud installation website' path that explicitly requires creating or signing in to a myQNAPcloud account. Core NAS function — SMB/AFP/NFS file storage, the QTS local web admin — runs over the LAN; myQNAPcloud only adds remote access and is disabled by default after initialization. Recorded as account_required: none on that basis. The admin username and password you set during Qfinder Pro initialization live on your own hardware; nothing is registered with QNAP, and the myQNAPcloud path that would require a vendor account is one option among several rather than the only way in.
Specifications
| Account required | none |
|---|---|
| Works offline | partially |
| Lost when offline | myQNAPcloud remote access from outside the LAN, App Center package downloads and firmware update checks (a firmware file can still be applied manually if downloaded elsewhere), Any QNAP first-party apps that themselves depend on an internet service (e.g. some backup/sync apps) |
| Forced firmware updates | yes |
| Radios | none |
| FCC ID | no intentional-radiator grant found |
| Local control | rest, unknown |
| Phones home | unknown |
| Self-hostable | partial — partly replaceable on your own hardware File storage itself needs no replacement — SMB/AFP/NFS are native and local. Remote access without myQNAPcloud can be self-hosted via WireGuard/Tailscale to the LAN; some first-party QNAP apps that lean on QNAP's own cloud services (certain backup/sync targets) don't have a documented drop-in local substitute. |
| Parts available | yes |
| Availability | in stock |
| Price band | $225-250 (diskless enclosure, no drives) (seen 2026-09-03) |
| Vendor risk | 2 / 3 — 2 incidents on record |
Where to buy
Open questions
- Whether myQNAPcloud Link/remote-connect is truly opt-in from a cold boot on a brand-new unit, or whether some current QTS versions nudge/require it during the very first Smart Installation Guide screen before it can be dismissed — sources describe it as disabled-by-default post-initialization but the first-run flow itself (Smart Installation Guide) was not traced screen-by-screen.
- Exact local_api surface (QNAP has a documented REST-ish API for some apps, e.g. Container Station, File Station) was not itemized.
- firmware_ota_forced is now 'yes' on the strength of the January 2022 DeadBolt response, where QNAP force-installed 5.0.0.1891 on units with automatic updates switched off. What is still not established is whether that was a one-off emergency power or the normal behaviour of the update channel — i.e. whether a QTS unit with auto-update disabled is reliably left alone in ordinary times. Treat 'yes' as the safe reading until someone documents the mechanism.
Sources
Class A is primary (manual, FCC filing, teardown). Class B is corroborated community reporting. Class C is never sufficient alone.
- A https://docs.qnap.com/operating-system/qts/5.1.x/en-us/initializing-qts-using-the-cloud-installation-website-72BF4E0D.html
QNAP's own QTS documentation: the 'cloud installation website' initialization path explicitly requires creating or signing in to a myQNAPcloud account, and is presented as one option among others (Qfinder Pro, HDMI) in the initialization table of contents — confirming a vendor-account path exists but is not the only one. — accessed 2026-09-03 - A https://www.qnap.com/en-us/how-to/faq/article/how-do-i-set-up-my-nas
QNAP's own setup FAQ: describes locating the NAS with Qfinder Pro and, if that fails, connecting via Ethernet cable and accessing the QTS interface directly through a browser — a local setup path with no account-creation step described. — accessed 2026-09-03 - A https://www.qnap.com/en-us/product/ts-233/specs/hardware
Manufacturer hardware spec sheet: TS-233-US has one Gigabit Ethernet port and no built-in Wi-Fi or Bluetooth radio (a USB-to-5GbE adapter is an optional accessory, not built in). — accessed 2026-09-03
History
- 2026-09-03 — First published at D2.
- 2026-09-03 — account_required corrected for_setup -> none. The record's own reasoning established that the only mandatory account is a local administrator credential on the NAS; 'for_setup' means a VENDOR account and is a REJECT trigger, so the field contradicted the D2 it was filed under.
- 2026-09-14 — vendor_risk 0 -> 2 and firmware_ota_forced unknown -> yes, applying the newly adopted rule on forced security patches: the forced install alone would have been firmware_ota_forced only, but it removed function from shipped devices, which is a ledger incident regardless of motive. Tier unchanged at D2.
Last verified 2026-09-03 — 12 days ago.