What is OpenAList?

This project is a community-maintained fork of the Alist file listing tool, created to strengthen security, broaden storage compatibility, and make self-hosting easier. It integrates with more than 60 cloud storage providers, object storage systems, local drives, and virtual storage drivers. The application exposes WebDAV, FTP, SFTP, and S3-compatible interfaces so users can reach all configured storage backends through standard protocols. Security hardening covers path traversal, cross-site scripting, server-side request forgery, TLS weaknesses, redirect manipulation, and unsafe remote downloads. Pre-built binaries and Docker images for amd64 and arm64 are published, with optional bundles that add FFmpeg for media handling, aria2 for download management, or both. The web UI offers a dark theme, password-protected paths, preview capabilities for video, audio, office documents, PDFs, source code, and images, browser-streamed package downloads, batch folder downloads via aria2, single sign-on with automatic account provisioning, offline torrent retrieval, and client-side encryption that keeps stored data opaque to the storage provider. An embedded SQLite database removes the requirement for a separate database server. The source code is licensed under AGPL-3.0.

Should you self-host OpenAList?

OpenAList scores 52/100 on selfhost.directory (how scoring works) and ranks #16 of 34 in File Management. It has 253 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v3.45.31, came out on 22 October 2026.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is AList (83/100, 50 365 stars). It scores higher overall, so compare the two before you pick. See OpenAList vs AList side by side.

Features

Crypt encryption
File Preview
FTP access
Multi-storage Support
Offline Download
Package and batch download
Protected Routes
S3-compatible API
Security hardening
SFTP access
Single Sign-On (SSO)
Text editor and README/HTML render
WebDAV Access

FAQ

Why do I get 413 HTTP code when uploading a file?

The 413 error indicates the request entity is too large. Increase the client_max_body_size in your reverse proxy configuration (e.g., nginx).

Why can't package download work?

Package download requires a modern browser with Stream API support. Ensure you are using a compatible browser.

Why do I get 'failed get storage: can't find storage with rawPath: /' after install/upgrade?

This error occurs when no storage is configured or the root storage mount is missing. Add at least one storage driver in the admin panel.

How to get password if I forget it?

For versions lower than v3.25.0, run ./alist admin in the terminal. For v3.25.0 and higher, use ./alist admin random to generate a new password or ./alist admin set NEW_PASSWORD to set a specific password.