Firefly III review: self-hosted spending records

Firefly III is a free open-source personal finance manager for people who want a clear record of income and spending.¹ You install it on your own web server and open it in a browser.⁴ Budgets, categories and reports show where the money goes. Keeping those books on hardware you manage is the privacy benefit.

Last checked October 28, 2026.

At a glance

What it is: A personal finance manager with budgets, categories, tags and reports.¹

Works on: A web browser, after you install it. Docker images are built for linux/amd64 and linux/arm64.⁶ A self-managed server needs PHP 8.5 and MySQL, MariaDB or SQLite.⁴

Price: Free and open source.¹ You provide the computer it runs on.

Licence: GNU Affero General Public License v3.0 or later.³

Best for: A detailed household spending record on a server you manage.

Official site: firefly-iii.org

What Firefly III does (and how it protects your privacy)

Firefly III uses double-entry bookkeeping.¹ Every payment is written twice: money leaves one account and arrives in another. You can keep more than one currency.¹

You install it with Docker, or on a web server you already run.⁵⁴ The records sit in its database.² A database is the program’s store for those rows. A few optional features call other servers. With those left off, the documentation says Firefly III contacts no outside servers.² A separate Data Importer can bring records in later.¹

Firefly III key features

Double-entry transactions: money leaves one account and arrives in another, in more than one currency.¹
Budgets, categories and tags: cap a budget, then sort purchases with categories and tags.¹
Reports: expenses by week, month or year, plus comparisons of budgets or tags.¹
Rules: expand shorthand, or tidy a messy file from your bank.¹
Data Importer: a separate tool that brings outside records into your installation.¹
An API: a way for other programs to talk to Firefly III, including creating transactions and reading charts.¹
Sign-in protections: two-factor authentication is included, and new registrations are blocked after the first account.²
A data export: a signed-in user can download a copy of their data.²

Firefly III pros and cons

Pros

The software is free, and you can run it on a server you control.¹⁴
Outside connections are optional. Left off, the app is documented as contacting no other servers.²
Two-factor sign-in is included, and login attempts are capped.²
The install guide calls version 6.7.9 the latest release.⁴

Cons

You need a server. Docker Compose is the documented easy path, or you can use PHP 8.5 with a database.⁵⁴
The database is not encrypted, and uploaded files are stored unencrypted.²
TLS is not included. TLS is the padlock that encrypts traffic between the browser and the server.²
Docker images cover linux/amd64 and linux/arm64. They do not run on a Raspberry Pi Zero, Raspberry Pi 1 or a Compute Module.⁶
The opening tutorial asks you to set accounts up so they match your bank statements.⁸
James Cole maintains it, and the documentation calls the work a side gig.³

Is Firefly III safe and private?

Firefly III is built and maintained by James Cole, a software developer from the Netherlands, who started it in 2012.³ The self-managed install guide calls v6.7.9 the latest version.⁴ That release was published on 11 October 2026, and Docker users get it from the latest tag.⁷ The licence is the GNU Affero General Public License v3.0 or later.³

The database is not encrypted, and the rows are readable by a person who can open it.² No encryption of data at rest is used. Data at rest means the files on the disk. The notes point you to the operating system’s disk encryption.² Uploaded attachments are stored unencrypted.² Duplicati can schedule backup copies to a destination you choose.

Firefly III does not come with TLS enabled.² TLS is the padlock on the connection. The Docker image can sit behind a reverse proxy, a small web server that turns that padlock on.² An encrypted link to MySQL or PostgreSQL is supported and turned off by default.² Registration can check your password with the Have I Been Pwned password API, and you can disable that check.² The app can also ask version.firefly-iii.org about updates, load Mapbox maps, use a Matomo tracker you configure, or download exchange rates from an Azure bucket.² The version-check server is described as a Linux machine hosted on Azure.² Apart from those options, the page says Firefly III contacts no outside servers.²

The first person to register becomes the owner, and later registrations stay blocked until they are turned on again in settings.² Two-factor authentication is built in, login attempts are capped, and a sign-in from a new IP address sends an email.² An IP address is the number that identifies a device on the network. Signed-out pages do not show personal information, and password reset does not reveal whether an account exists.² Leave debug mode off. With APP_DEBUG set to true, a bug can show secrets and passwords.²

How to get started with Firefly III

Use an official install path. Docker Compose is the documented easy path, and the compose file is provided.⁵ A self-managed server needs PHP 8.5, a database, and the release from GitHub.⁴
Set the database password first. Change it before the first start. A later change leaves the old password in the database volume.⁵
Open the site at http://localhost, or at the address and port you chose.⁵
Create the owner account and stop there. The first user becomes the owner, and further registrations are blocked.² You can turn off the Have I Been Pwned password check while you register.² Try the password in BellCrier’s free password checker first.
Enter yesterday’s balance, not today’s, after you choose a currency and language. That lets you add today’s transactions, and Firefly III calculates today’s balance.⁸
Create a few transactions. The tutorial’s check is Accounts, then Asset accounts, where yesterday’s balance is listed.⁸
Turn on two-factor authentication. If the site is on the internet, put TLS in front of it and leave debug mode off.² Keep a backup elsewhere.

Who should use Firefly III (and who might prefer something else)

Firefly III fits someone who wants a detailed spending record and is willing to look after a small server. Budgets, reports and two-factor sign-in all live on that machine.

For household accounts in a desktop program, start with GnuCash. For envelope budgeting that can stay on one computer, read about Actual Budget. For a record of investments, Ghostfolio follows a portfolio. Firefly III is the fit for day-to-day spending on a server you run.

Frequently asked questions about Firefly III

Is Firefly III free?

Yes. The project describes it as a free and open source personal finance manager.¹ The licence is the GNU Affero General Public License v3.0 or later.³

Is Firefly III safe?

It depends on the server. The database and uploaded files are not encrypted, and TLS is not turned on for you.² Two-factor sign-in, a cap on login attempts and an email for a new IP address are included.² Use v6.7.9, which the install guide calls the latest version, and leave debug mode off.⁴²

Does Firefly III work on iPhone?

The install guide has you open Firefly III in a web browser at the server’s address.⁵ A phone browser can use that same address when the phone can reach the server. The project also describes a JSON API for mobile users, which other programs can use.¹

Do I have to connect my bank?

No. The first tutorial has you create accounts that match your bank statements, then create transactions.⁸ The Data Importer is a separate tool for bringing records in when you want that.¹