Immich: A Self-Hosted Google Photos Replacement (GitHub, Scanned)
A self-hosted Google Photos alternative with phone backup, face recognition and smart search.
Scanned 5 min read
Loading…
/** @github-tools */
Best Self-Hosted Apps on GitHub
These apps run on your own server, NAS or spare computer and replace a cloud service you would otherwise pay for or trust with your data: photos, films, smart home, paperwork, backups and more. Good ones are widely used, updated often and have a big community to help when setup gets tricky. Most need Docker or an always on machine, so start with the one that replaces a subscription you already have.
15 repos, each cloned and scanned
// top 10, ranked
Updated 30 October 2026 · moves since 26 October 2026 · re-ranked every 3 days on what readers use, never sponsored
- 1
Uptime Kuma: Self-Hosted Uptime Monitoring and Status Pages (GitHub, Scanned)
up 4Watches your sites and servers and alerts you when one goes down, with public status pages.
- 2
Immich: A Self-Hosted Google Photos Replacement (GitHub, Scanned)
down 1A self hosted Google Photos with phone backup, face recognition and search, for anyone leaving the cloud.
- 3
Jellyfin: Free Self-Hosted Media Server, No Subscription (GitHub, Scanned)
down 1Streams your own films, shows and music to every device, with no paid tier or account.
- 4
Home Assistant: Local, Private Home Automation (GitHub, Scanned)
down 1Ties thousands of smart home devices together on your own hardware, backed by thousands of contributors.
- 5
Paperless-ngx: Scan, OCR and Search Your Paperwork (GitHub, Scanned)
down 1Scans, OCRs and tags your paper documents so you can find any bill or letter again in seconds.
- 6
Syncthing: Sync Folders Between Your Devices, No Cloud (GitHub, Scanned)
no changeKeeps folders in sync across your computers and phones directly and encrypted, no cloud needed.
- 7
Pi-hole: Block Ads on Every Device in Your Home (GitHub, Scanned)
no changeBlocks ads and trackers for every device on your home network, including smart TVs and phones.
- 8
Stirling PDF: 50+ PDF Tools You Run Yourself (GitHub, Scanned)
no changeAn all in one PDF toolkit for merging, editing, OCR and signing, run on your own server so files stay private.
- 9
Frigate: Local AI Object Detection for Security Cameras (GitHub, Scanned)
no changeRecords your security cameras and spots people, cars and animals locally, with no cloud subscription.
- 10
Navidrome: Your Own Music Streaming Server (GitHub, Scanned)
no changeStreams your own music collection to any phone or browser, like a personal Spotify you host.
// all 15 in Self-Hosted Apps
Stirling PDF: 50+ PDF Tools You Run Yourself (GitHub, Scanned)
An all-in-one PDF toolkit for editing, merging, OCR, signing and converting, run locally or self-hosted.
Scanned 6 min read
Uptime Kuma: Self-Hosted Uptime Monitoring and Status Pages (GitHub, Scanned)
A self-hosted monitor for sites, servers and services, with alerts and public status pages.
Scanned 5 min read
Home Assistant: Local, Private Home Automation (GitHub, Scanned)
Open-source home automation that runs on your own hardware and ties thousands of devices together.
Scanned 5 min read
Syncthing: Sync Folders Between Your Devices, No Cloud (GitHub, Scanned)
Keep folders in sync across your own computers and phones, directly and encrypted, with no cloud.
Scanned 4 min read
Pi-hole: Block Ads on Every Device in Your Home (GitHub, Scanned)
A DNS sinkhole for your home network that blocks ads and trackers on every device, no apps needed.
Scanned 4 min read
Jellyfin: Free Self-Hosted Media Server, No Subscription (GitHub, Scanned)
Stream your own films, shows and music to every device from a server you run, with no premium tier.
Scanned 4 min read
Paperless-ngx: Scan, OCR and Search Your Paperwork (GitHub, Scanned)
A self-hosted document archive that OCRs, tags and indexes every scan so you can find any paper again.
Scanned 5 min read
Frigate: Local AI Object Detection for Security Cameras (GitHub, Scanned)
A self-hosted camera recorder that spots people, cars and animals locally, built for Home Assistant.
Scanned 6 min read
changedetection.io: Self-Hosted Website Change and Price Alerts (GitHub, Scanned)
Watch any web page for changes, price drops or restocks, and get alerts on Discord, email and more.
Scanned 4 min read
Karakeep: Self-Hosted Bookmarks With AI Tagging (GitHub, Scanned)
Save links, notes, images and PDFs to your own server, with AI tags, summaries and full-text search.
Scanned 5 min read
Navidrome: Your Own Music Streaming Server (GitHub, Scanned)
Stream your own music collection to any browser or phone, like a personal Spotify.
Scanned 5 min read
ConvertX: Self-Hosted File Converter for 1,000+ Formats (GitHub, Scanned)
A self-hosted web app that converts images, video, documents and e-books between 1,000+ formats.
Scanned 4 min read
FreshRSS: Your Own Self-Hosted RSS Reader (GitHub, Scanned)
A self-hosted RSS reader for your own server, with multi-user accounts and an API for mobile apps.
Scanned 5 min read
Audiobookshelf: Your Own Audiobook and Podcast Server (GitHub, Scanned)
A self-hosted server for your audiobooks and podcasts, with apps that sync progress everywhere.
Scanned 5 min read
// How we scan
Before a repository gets a post here we clone it and run the same checks on every one. The scanner is a script in this site's own repository, its findings are written out with file and line, and a person reads every hit before writing the verdict in the post. The last full run was on Oct 28, 2026.
- Pinned commit
- A fresh clone of the default branch. The commit and date are on every report, so the findings are about one snapshot, not the repository in general.
- Secrets
- Credential patterns with a known shape: cloud access keys, API tokens for OpenAI, Anthropic, Slack, GitHub, Google and Stripe, chat webhooks, private key blocks.
- Suspicious code
- Code that decodes a string and then executes it, pipes a download straight into a shell, opens a raw socket to a shell, reaches a known exfiltration service, mines cryptocurrency, or looks packed.
- Install-time code
- npm lifecycle scripts, setup.py command classes, Cargo build scripts, and installer shell scripts: whether they use sudo, edit your shell profile, or fetch and run remote code.
- Committed binaries
- Executables and compiled objects identified by their bytes, not their file extension, so a renamed binary still shows up.
- CI workflows
- GitHub Actions that run on pull_request_target and check out the pull request head (a classic way to leak secrets), write-all permissions, and third-party actions pinned to a tag instead of a commit.
- Network hosts
- Every host the source code talks to, so an unexpected one stands out.
- Known vulnerabilities
- Every pinned dependency in the repository's lockfiles looked up in OSV.dev, counted by severity. Includes development dependencies, which is why the counts are not zero for a large web app.
- Project hygiene
- A security policy, automated dependency updates, CodeQL, a licence, contributing guidelines.
- OpenSSF Scorecard
- The Open Source Security Foundation's independent score, where the project has one.
Safe means no credential patterns, no decode-and-execute code, no exfiltration hosts, no undocumented install-time behaviour, no risky workflow, and nothing in the findings a reviewer could not explain. Anything you should know before installing (an installer that pipes to a shell, a tool that reads a credential you already have, a licence with conditions, or a lockfile with unpatched advisories) is the note beside the badge.
Not covered: we do not run the software, audit its logic, or review commits made after the scan. The date and commit are on every report. Check them, and read the code yourself before you trust it with anything that matters.
// Questions
- Are these GitHub AI tools free to use?
- All of them are free to download, run and modify. The licences differ: most are MIT or Apache 2.0, ComfyUI is GPL-3.0, and Open WebUI and Dify ship their own licences with conditions on rebranding and multi-tenant hosting. Each post says which licence applies and what it asks of you.
- What does it mean that a repository was scanned?
- We cloned it at a specific commit and ran the checks listed under How we scan: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. Every hit was read by a person before the verdict was written, and the findings are in each post.
- Why do known vulnerabilities show up in a scan marked safe?
- Because a lockfile pins development dependencies too. A large web app carries thousands of packages and OSV knows of advisories in some of them; most affect build tooling and never reach a user. Each post shows the counts per lockfile and the worst entries so you can see where they sit, and the notes say whether any of it ships to you.
- How current is a scan?
- The date and commit are printed in every post. Active projects merge dozens of commits a week, so treat a report as a snapshot of that commit, not a standing guarantee, and re-check the repository before installing anything on a machine you care about.
- Which of these should I start with?
- To run a model on your own computer, install Ollama and add Open WebUI for a chat interface. For images and video, ComfyUI. To build an app or agent without much code, Dify. To let an agent write code or use a browser, OpenHands, Codex or browser-use. If you already use Claude Code or Codex, cost-xray shows what each session actually costs.