9 picks · data-backed ranking
Best privacy-focused self-hosted apps
The best self-hosted apps for privacy are Vaultwarden for password managers, frp for proxy & VPN and Keycloak for identity & SSO. Vaultwarden leads with 68,572 GitHub stars. One pick per category: password managers, proxy & VPN, identity & SSO, file sync & storage, photo galleries, note-taking & editors, analytics, network utilities & DNS and email servers.
Privacy here means control: each pick replaces a cloud service with one that keeps your data on hardware you run. The top app per privacy-relevant category is listed.
Updated · data from GitHub, refreshed nightly
Top picks
- Rank 1:
Vaultwarden
dani-garcia/vaultwarden
Lightweight Bitwarden server API implementation written in Rust.
FeaturedPassword ManagersRustDockerTop pick for password managers: Vaultwarden has 68,572 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 181 commits in the last year; it replaces Bitwarden and 1Password.
- Rank 2:
frp
fatedier/frp
Fast reverse proxy that exposes local servers behind NAT to the internet.
Proxy & VPNGoDockerTop pick for proxy & VPN: frp has 109,755 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 165 commits in the last year; it replaces ngrok.
- Rank 3:
Keycloak
keycloak/keycloak
Open-source identity and access management with SSO, OIDC, SAML and user federation.
Identity & SSOJavaDockerTop pick for identity & SSO: Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta.
Full ranking
All 9 picks, ranked
Ranked by GitHub stars and recent activity. Open any pick for live stats and licence details.
- 1
VaultwardenFeatured
Lightweight Bitwarden server API implementation written in Rust.
Password ManagersDockerTop pick for password managers: Vaultwarden has 68,572 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 181 commits in the last year; it replaces Bitwarden and 1Password.
- 2
frp
Fast reverse proxy that exposes local servers behind NAT to the internet.
Proxy & VPNDockerTop pick for proxy & VPN: frp has 109,755 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 165 commits in the last year; it replaces ngrok.
- 3
Keycloak
Open-source identity and access management with SSO, OIDC, SAML and user federation.
Identity & SSODockerTop pick for identity & SSO: Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta.
- 4
Syncthing
Syncthing is an open source peer-to-peer file synchronisation tool.
File Sync & StorageDockerTop pick for file sync & storage: Syncthing has 89,175 GitHub stars, uses the MPL-2.0 license, ships a Docker image and had 223 commits in the last year; it replaces Google Drive and Dropbox.
- 5
ImmichFeatured
Photo and video backup solution directly from your mobile phone (alternative to Google Photos).
Photo GalleriesDockerTop pick for photo galleries: Immich has 115,648 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 2,638 commits in the last year; it replaces Google Photos and Adobe Photoshop.
- 6
Excalidraw
Virtual hand-drawn style whiteboard for diagrams and sketches.
UtilitiesDockerTop pick for note-taking & editors: Excalidraw has 133,574 GitHub stars, uses the MIT license, ships a Docker image and had 272 commits in the last year; it replaces Figma and Lucidchart.
- 7
Metabase
Easy way for everyone in your company to ask questions and learn from data.
AnalyticsDockerTop pick for analytics: Metabase has 49,547 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 6,378 commits in the last year; it replaces Metabase Cloud and Tableau.
- 8
Pi-hole
Blackhole for Internet advertisements with a GUI for management and monitoring.
Network Utilities & DNSDockerTop pick for network utilities & DNS: Pi-hole has 61,167 GitHub stars, uses the EUPL-1.2 license, ships a Docker image and had 215 commits in the last year.
- 9
Stalwart Mail Server
All-in-one mail server with JMAP, IMAP4, and SMTP support and a wide range of modern features.
Email ServersDockerTop pick for email servers: Stalwart Mail Server has 14,971 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 679 commits in the last year; it replaces Twilio SendGrid and Mailgun.
What are the best self-hosted apps for privacy?
The best self-hosted apps for privacy are Vaultwarden for password managers, frp for proxy & VPN and Keycloak for identity & SSO. Vaultwarden leads with 68,572 GitHub stars. One pick per category: password managers, proxy & VPN, identity & SSO, file sync & storage, photo galleries, note-taking & editors, analytics, network utilities & DNS and email servers.
Is Vaultwarden free?
Yes. Vaultwarden is open-source software released under the AGPL-3.0 license, so you can self-host it at no cost. You only pay for the server it runs on, and some projects also offer an optional paid cloud plan.
Can I self-host these apps with Docker?
Yes, all of them. Vaultwarden, frp and Keycloak publish Docker images, so you can run them on a VPS or home server with Docker Compose.
Are all of these apps open source?
All 9 apps on this list are open source. You can self-host and modify each one under its license.
Which of these apps is the most actively developed?
Metabase, with 6,378 commits in the last 12 months and a latest release, v0.63.19, from October 2026. Activity is a good sign that bugs and security issues get fixed.
The weekly digest
New self-hosted apps, every week
Fresh releases, rising projects and one deploy guide a week. Join home labbers and engineers who self-host.