calibre is the ebook manager most readers end up with. It keeps a library of your books with covers and metadata, converts between EPUB, AZW3, MOBI, PDF, DOCX and the rest, edits EPUB files directly, and talks to Kindle, Kobo and other e-readers over USB. It can also fetch metadata and covers from the web and turn news sites into a daily ebook.
It is on this list because nothing else covers as much. Kovid Goyal has led the project since 2006, releases arrive every couple of weeks, and the built-in content server lets you read and download your library from a browser on any device on your network. Recent versions add optional AI features that can discuss a book or look things up, using a provider you choose, including local models through Ollama or LM Studio.
The honest limits: the interface is dense and shows its age, and calibre does not remove DRM; books bought from stores that lock them need to stay in those stores' apps.
- Repository: github.com/kovidgoyal/calibre
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: Python. Stars: 26.3K. Forks: 2,731. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit e5d83c9
Who it is for
Anyone with more than a handful of ebooks, owners of Kindle and Kobo readers who want to load their own files, and people who need to convert documents to and from ebook formats.
Getting started
1. macOS with Homebrew (Windows and macOS installers are on calibre-ebook.com/download)
brew install --cask calibre2. Convert a book from the command line once it is installed
ebook-convert book.epub book.azw3On Linux the official route is a script from download.calibre-ebook.com run with sudo; the version in your distribution's package manager is often several releases behind but avoids that step.
Safety scan
We cloned kovidgoyal/calibre at commit e5d83c9 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no installer scripts with hooks and no bare-IP URLs.
- The six pattern hits are binary data written as byte strings in Python: a test JPEG in src/calibre/db/tests/base.py, a blank JPEG in src/calibre/srv/render_book.py, the LIT format's LZX control block in ebooks/lit/writer.py, a default thumbnail for Cybook readers in devices/cybook/t2b.py, and a long line of embedded data in ebooks/covers.py. None of it is decoded and run.
- The two binaries flagged as JAR are EPUB files (an EPUB is a zip archive): the quick start guide in resources/quick_start and a MathJax sample in the manual.
- The AI integrations in src/calibre/ai cover Anthropic, Google, Grok, OpenAI, OpenRouter, Ollama and LM Studio. They are off until you add a provider, and only then does text you ask about leave the machine.
- No lockfile, so no dependency advisories were queried. Four workflows, no pull_request_target and no third-party actions. Security policy, Dependabot and CodeQL present; OpenSSF Scorecard 6.2 of 10.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 6 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 2 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 4 workflows. None use pull_request_target. No third-party actions. |
| Network hosts | 40 distinct hosts referenced from source; most often sourceforge.net, github.com, bugs.launchpad.net, manual.calibre-ebook.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file. Missing contributing guide. |
| OpenSSF Scorecard | 6.2 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (6)
| Where | Rule | Match |
|---|---|---|
| src/calibre/db/tests/base.py:17 | long-hex-escape-run (test/example) | IMG = b'\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x01\x00`\x00`\x00\x00\xff\xe1\x00\x16Exif\x00\x00II*\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xdb\x00C\x… |
| src/calibre/devices/cybook/t2b.py:12 | long-hex-escape-run | DEFAULT_T2B_DATA = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xf… |
| src/calibre/devices/cybook/t2b.py:12 | very-long-line | 12569 chars |
| src/calibre/ebooks/covers.py:510 | very-long-line | 3884 chars |
| src/calibre/ebooks/lit/writer.py:114 | long-hex-escape-run | LZXC_CONTROL = b'\x07\x00\x00\x00\x4c\x5a\x58\x43\x03\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |
| src/calibre/srv/render_book.py:40 | long-hex-escape-run | BLANK_JPEG = b'\xff\xd8\xff\xdb\x00C\x00\x03\x02\x02\x02\x02\x02\x03\x02\x02\x02\x03\x03\x03\x03\x04\x06\x04\x04\x04\x04\x04\x08\x06\x06\x05\x06\t\x08\n\n\t\x08… |
Committed binaries (2)
resources/quick_start/swe.epub: JAR, 23 KBmanual/resources/mathjax.epub: JAR, 4 KB
By the numbers
| Stars | 26.3K |
|---|---|
| Forks | 2,731 |
| Contributors | 498 |
| Commits | 55K |
| Open issues | 0 |
| Open pull requests | 6 |
| Releases | 356 |
| Latest release | v9.17.0 |
| Licence | GPL-3.0 |
| Main language | Python |
| Project age | 13 years |
| Last push | Oct 26, 2026 |
| Tracked files | 4,980 |
| Lines of code | 970.6K |
| Checkout size | 54 MB |
Lines by language: Python 885.2K, C/C++ header 32.2K, C++ 25.3K, C 16.2K, HTML 3,171, JSON 2,302.
Questions
Is calibre free?
Yes. calibre is GPL-3.0, free for any use, with no paid tier. The project is funded by donations.
Can calibre put my own EPUB files on a Kindle?
Yes. Connect the Kindle by USB and calibre converts the book to a format the device reads and copies it over. It can also email books to a Kindle address.
Does calibre remove DRM?
No. calibre does not include DRM removal, and books locked by a store need that store's app or device.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.