ArchiveBox keeps your own copy of the web. Give it URLs one at a time, or point it at bookmarks, browser history, RSS feeds, Pocket or Pinboard exports, and it saves each page in several redundant formats: the original HTML with its assets, a SingleFile HTML, a screenshot, a PDF, a WARC, the article text and headers. Media pages get their video or audio through yt-dlp, and git links get a clone. Everything lands in ordinary files and folders plus a SQLite index, so the archive stays readable without ArchiveBox, and you can drive it from a web UI, a CLI, a browser extension, a Python API or a REST API.
It has been around since 2017, led by Nick Sweeting, and has about 28,900 stars, 151 contributors and more than 9,200 commits. It is MIT-licensed and run as a US 501(c)(3) fiscally sponsored project funded by donations, with no paid tier. Development is busy: the 0.9 line is new, with v0.9.77 released on 27 October 2026, and pip still treats 0.9 as a pre-release, which is why the install commands ask for it explicitly.
People use it for bookmark backups, research collections, preserving sources for journalism and saving evidence for legal cases before a page changes or disappears. It can also archive pages behind a login using a saved browser profile, which is powerful and worth reading the security notes about first.
- Repository: github.com/ArchiveBox/ArchiveBox
- Licence: MIT (MIT License)
- Language: Python. Stars: 28.9K. Forks: 1,623. Last push: Oct 28, 2026.
- Scan: safe, Oct 28, 2026, commit 6efff9f
Who it is for
Researchers, journalists and archivists preserving sources, people who want their bookmarks to outlive the sites they point to, and self-hosters comfortable with Docker and a little configuration.
Getting started
1. Make a folder and download the Docker Compose file (Docker required)
mkdir -p ~/archivebox/data && cd ~/archivebox && curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml2. Start it, then open http://admin.archivebox.localhost:5797 to finish setup
docker compose up -d --wait3. Archive your first URL
docker compose run --rm archivebox add 'https://example.com'4. Or, without Docker, install with uv and create a collection
uv tool install --python 3.13 --prerelease explicit --upgrade 'archivebox>=0.9.0rc0,<0.10' && archivebox initBy default every URL you add is also submitted to the Internet Archive, and the snapshot index is public to anyone who can reach your server. For private material, set ARCHIVEDOTORG_ENABLED=False, PUBLIC_INDEX=False and PERMISSIONS=private before you add anything. The optional curl | bash setup script uses sudo to install packages.
Safety scan
We cloned ArchiveBox/ArchiveBox at commit 6efff9f on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no binaries and no bare-IP URLs across 1,066 files and about 233,000 lines, mostly Python.
- The raw-socket hit in archivebox/cli/archivebox_persona.py is os.dup2 handing a payload file to a child command as its standard input before it starts; no socket is involved. The two curl | sh hits are in bin/setup.sh: its own one-line install instruction, and fetching the uv installer from astral.sh.
- bin/setup.sh, the optional one-line installer, is 519 lines. It uses sudo to install system packages, and run under sudo it creates a system-owned deployment in /var/lib/archivebox. The Docker install avoids it entirely and is what the project recommends.
- uv.lock pins 192 Python packages and none has a known advisory. Chrome, wget, yt-dlp and SingleFile are installed separately (inside the Docker image, or by ArchiveBox's plugin installer) and were not part of this check, so keep them updated.
- 17 workflows, none using pull_request_target; 30 of 38 third-party actions are pinned to commits. Security policy, Dependabot, CodeQL, licence, contributing guide and code of conduct all present. Archived JavaScript is untrusted, and the default server security mode isolates or disables its replay depending on your hostname.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 3 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 3 installer scripts (one fetches and runs a remote script; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 17 workflows. None use pull_request_target. 8 of 38 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, archivebox.io, archivebox.localhost, blog.sweeting.me. No URLs to bare IP addresses. |
| Known vulnerabilities | 0 advisories across 192 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. uv.lock: 192 packages, 0 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | 5.5 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (3)
| Where | Rule | Match |
|---|---|---|
| archivebox/cli/archivebox_persona.py:617 | raw-socket-shell | os.dup2(payload_file.fileno(), 0) |
| bin/setup.sh:6 | download-piped-to-shell | # curl -fsSL 'https://raw.githubusercontent.com/ArchiveBox/ArchiveBox/main/bin/setup.sh' | bash |
| bin/setup.sh:259 | download-piped-to-shell | curl -LsSf https://astral.sh/uv/install.sh | sh |
Installer scripts (3)
- bin/deploy_dev_demo.sh, 118 lines
- bin/setup.sh, 519 lines, uses sudo, fetches and runs a remote script; talks to admin.archivebox.localhost, astral.sh, docs.docker.com, example.com, get.archivebox.io, github.com, raw.githubusercontent.com, redsymbol.net, www.gnu.org
- bin/setup_monorepo.sh, 338 lines; talks to github.com
By the numbers
| Stars | 28.9K |
|---|---|
| Forks | 1,623 |
| Contributors | 151 |
| Commits | 9,217 |
| Open issues | 158 |
| Open pull requests | 1 |
| Releases | 41 |
| Latest release | v0.9.77 |
| Licence | MIT |
| Main language | Python |
| Project age | 9 years |
| Last push | Oct 28, 2026 |
| Tracked files | 1,066 |
| Lines of code | 232.8K |
| Checkout size | 22 MB |
Lines by language: Python 135K, Markdown 50K, HTML 21.3K, CSS 13.8K, Shell 4,730, YAML 3,884.
Questions
Is ArchiveBox free?
Yes. ArchiveBox is MIT-licensed and free to self-host, with no paid tier; the project is funded by tax-deductible donations through its fiscal sponsor. Your only costs are the machine it runs on and the disk space, which grows quickly if you save video.
Does ArchiveBox send my URLs anywhere?
By default, yes: each URL is also submitted to the Internet Archive for a public copy, and pages are fetched from the sites themselves. Turn off ARCHIVEDOTORG_ENABLED for local-only archiving, and make the index private if your server is reachable by others.
Is it legal to archive websites with ArchiveBox?
Keeping copies for private study, research, journalism or evidence is widely done, and in the US libraries and researchers rely on fair use for it, but republishing archived pages can infringe copyright and the rules differ by country. Archive only what you have access to, keep logged-in captures private, and respect removal requests if you publish an archive.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.