Jellyfin is a media server you run yourself. Point it at folders of films, TV shows, music, books or photos and it fetches artwork and metadata, organizes everything into a library, and streams it to a web browser, phones, smart TVs, Kodi and a long list of other clients, transcoding on the fly when a device cannot play the original file. Live TV and DVR with a tuner, multiple user accounts and parental controls are included.
It is the free alternative to Plex and Emby: no account with a company, no premium licence and no feature held back behind a subscription. This repository is the server backend and API, written in C# on .NET; the web client and the apps live in sibling repositories in the same organization. With about 58,600 stars and close to 1,900 contributors it is one of the largest community-run media projects.
Honest limits: you need a machine that stays on, hardware transcoding takes some setup per GPU, and remote access outside your home network is yours to configure, usually with a reverse proxy or VPN.
- Repository: github.com/jellyfin/jellyfin
- Licence: GPL-2.0 (GNU General Public License v2.0)
- Language: C#. Stars: 58.6K. Forks: 5,715. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit ed21176
Who it is for
People with a collection of their own media who want to stream it at home and away without paying for or depending on Plex, and home-lab tinkerers who want a server they can fully control.
Getting started
1. Get the official Docker image (installers for Windows, macOS and Linux are on jellyfin.org/downloads)
docker pull jellyfin/jellyfin2. Or build and run the server from source (needs the .NET 10 SDK and ffmpeg)
git clone https://github.com/jellyfin/jellyfin.git && cd jellyfin && dotnet run --project Jellyfin.Server --webdir /absolute/path/to/jellyfin-web/distOnce it is running, open http://localhost:8096 to create the admin account and add libraries. Running from source needs the web client files from the jellyfin-web repository or an existing install; most people should use the packaged downloads.
Safety scan
We cloned jellyfin/jellyfin at commit ed21176 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs across roughly 368,000 lines of C#.
- The one installer script, .devcontainer/install-ffmpeg.sh, uses sudo inside a GitHub Codespaces development container to add Jellyfin's own apt repository and install jellyfin-ffmpeg. It is not part of any install on your machine.
- The outside hosts are the metadata and artwork sources a media server is expected to call (TheMovieDB, TheTVDB, fanart.tv, TheAudioDB, IMDb links) and Jellyfin's own repo.jellyfin.org. Metadata providers can be switched per library.
- The advisory lookup found no lockfile to check, because the .NET projects do not commit NuGet lock files. Dependency updates are handled by Renovate, and CodeQL runs on the code.
- 15 workflows. Two use pull_request_target, for project-board automation and merge-conflict labelling, and neither checks out pull request code. 14 of 15 third-party actions are pinned to a commit. OpenSSF Scorecard 7.4 out of 10.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script (one can call sudo) |
| Committed binaries | None. |
| CI workflows | 15 workflows. 2 use pull_request_target, none check out the pull request head. 1 of 15 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often media.example.com, github.com, repo.jellyfin.org, www.imdb.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file. Missing security policy, contributing guide. |
| OpenSSF Scorecard | 7.4 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- .devcontainer/install-ffmpeg.sh, 33 lines, uses sudo; talks to repo.jellyfin.org
Workflows worth a look
- .github/workflows/project-automation.yml: pull_request_target
- .github/workflows/pull-request-conflict.yml: pull_request_target
By the numbers
| Stars | 58.6K |
|---|---|
| Forks | 5,715 |
| Contributors | 1,877 |
| Commits | 30.2K |
| Open issues | 473 |
| Open pull requests | 359 |
| Releases | 118 |
| Latest release | v12.3 |
| Licence | GPL-2.0 |
| Main language | C# |
| Project age | 7 years |
| Last push | Oct 26, 2026 |
| Tracked files | 2,658 |
| Lines of code | 396.9K |
| Checkout size | 16 MB |
Lines by language: C# 368.2K, JSON 25.6K, HTML 1,321, YAML 1,119, Markdown 627, Shell 57.
Questions
Is Jellyfin free?
Yes. Jellyfin is free software under GPL-2.0, with no paid tier, no premium features and no account with a company. The project runs on volunteer work and donations.
What is the difference between Jellyfin and Plex?
Both stream your own media library to your devices. Plex is a company product with an account, a paid Plex Pass for features such as hardware transcoding and offline downloads, and some traffic through its servers. Jellyfin is community-run open source: everything is free, and the server talks to no company service apart from the metadata sources you enable.
Can I watch Jellyfin away from home?
Yes, but you set it up yourself. The usual approaches are a reverse proxy with HTTPS on your own domain, or a VPN such as WireGuard or Tailscale into your home network. There is no relay service run by the project.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.