Navidrome: Your Own Music Streaming Server (GitHub, Scanned)

Navidrome turns a folder of music files into a streaming service you run yourself. Point it at your library and it scans the tags, then serves a modern web player and an API that works with dozens of existing Subsonic-compatible apps on iPhone, Android and desktop. Each user gets their own playlists, favourites and play counts, and it transcodes on the fly, including to Opus, so a lossless library still streams well over mobile data.

It is written in Go, uses very little memory and runs comfortably on a Raspberry Pi, a NAS or a cheap VPS. It handles very large libraries, compilations and multi-disc box sets properly, reads lyrics from sidecar files and tags, and watches the library for changes. Optional integrations pull artist art and info from Last.fm and Deezer and scrobble to Last.fm and ListenBrainz.

Navidrome is GPL-3.0, at about 24,400 stars and v0.64.2 when scanned. It plays music you already own; it does not download or find music for you.

• Repository: github.com/navidrome/navidrome
• Licence: GPL-3.0 (GNU General Public License v3.0)
• Language: Go. Stars: 24.4K. Forks: 1,776. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit ec2e0a9

Who it is for

People with a large MP3 or FLAC collection who want it on their phone without uploading it to a cloud service, and self-hosters looking for a light music server for a family or a home lab.

Getting started

1. Run it with Docker, pointing it at your music and a data folder

docker run -d --name navidrome --restart=unless-stopped --user $(id -u):$(id -g) -v /path/to/music:/music -v /path/to/data:/data -p 4533:4533 -e ND_LOGLEVEL=info deluan/navidrome:latest

2. Open it and create the first account, which becomes the admin

open http://localhost:4533

Pre-built binaries for Linux, macOS, Windows and Raspberry Pi are on the releases page, and macOS users can brew install navidrome. To listen on a phone, install any Subsonic-compatible app and give it your server address.

Safety scan

We cloned navidrome/navidrome at commit ec2e0a9 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no committed binaries and no suspicious code. The one pattern hit is the Makefile's developer target that installs golangci-lint with curl | sh; it is a lint tool for contributors and never runs when you install Navidrome.
• Navidrome sends an anonymous Insights report to insights.navidrome.org by default: an instance ID, version, OS and hardware, memory use and basic library and filesystem stats, nothing about the music itself. Set ND_ENABLEINSIGHTSCOLLECTOR=false to stop it; turning off external services also disables it with Last.fm, Deezer and ListenBrainz.
• Last.fm, Deezer and ListenBrainz are the other outside hosts, all used for artwork, artist info and scrobbling. The one bare-IP URL is a TEST-NET address in a plugin test.
• Of 136 known advisories, 119 are in ui/package-lock.json, the web player's build tooling (brace-expansion, babel, browserslist), which is compiled into static files rather than shipped as packages. The Go server's go.mod has 7 (1 moderate, 6 unrated).
• 6 workflows, none using pull_request_target; none of the 11 third-party actions is pinned to a commit. Dependabot, licence, contributing guide and code of conduct present; no security policy or CodeQL. OpenSSF Scorecard 4.9.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Go 226.5K, JavaScript 47.9K, JSON 30.2K, Rust 6,941, Markdown 4,443, YAML 3,879.

Questions

Is Navidrome free?

Yes. Navidrome is free and open source under GPL-3.0. You run it on your own hardware at no cost. Some cloud hosts offer managed Navidrome for a fee and share revenue with the project, but nothing requires them.

What apps work with Navidrome?

Any app that speaks the Subsonic API, which covers dozens of players on iOS, Android and desktop. Navidrome also has its own web player that works on phones through the browser.

Can Navidrome run on a Raspberry Pi?

Yes. It has ready-made binaries and Docker images for Raspberry Pi and uses very little memory, so a Pi with a USB drive full of music is a common setup.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.