Academy

ntfy review: open-source alerts you control

A phone on a kitchen counter beside a small home server in evening light.

ntfy (pronounced “notify”) offers free open-source push notifications. 1 It carries a short alert from a script, a backup, or a small home server to your phone or to a browser on your desk. You can use the public server at ntfy.sh with no account, or run the same program on a computer you look after. 1

Last checked October 28, 2026.

At a glance

  • What it is: You publish a message to a named topic, and subscribed phones or browsers receive it. 1
  • Works on: Android (Google Play and F-Droid), an iOS app (App Store), and a web app. The server runs on Linux, Windows, and Docker. On a Mac the command-line tool is supported; the server is currently unsupported. 5 8
  • Price: Free on ntfy.sh with no sign-up (250 messages a day, 2 MB attachments). Paid plans: Supporter $6 and $5 a month, Pro $12 and $10, Business $25 and $20. Free to run yourself. 1 3
  • Licence: Apache 2.0 and GPLv2, dual-licensed. 1
  • Best for: A plain alert when a job at home finishes, fails, or notices something.
  • Official site: ntfy.sh

What ntfy does (and how it protects your privacy)

ntfy is a simple HTTP-based notification service. HTTP is just the normal web request a script already makes. You send text to a topic, a name, and everyone subscribed to that name gets the alert. A short curl command is enough. 1

The public server needs no account, so the topic name is the secret. The publishing guide says the topic is essentially a password: letters, numbers, underscores, and dashes, up to 64 characters, and hard to guess. It also says all topics on ntfy.sh are public. 3

When the message is sensitive, the privacy policy says you can run your own server. 2 A Duplicati backup or a Frigate camera can send the ping while the files stay at home.

Key features of ntfy

  • Phones and a desktop browser. Android is on Google Play and F-Droid, iOS is on the App Store, and the web app can show a desktop notification. 5 1
  • Priority, tags, and buttons. You can set a priority, and add tags, emoji, and action buttons. 1
  • Pictures and other files. On ntfy.sh an attachment is limited to 2 MB and expires after 3 hours by default. 3
  • UnifiedPush on Android. ntfy can pass alerts to other apps that use UnifiedPush, a standard that does not require Google’s Firebase Cloud Messaging. 5
  • Users and reserved names. Your own server can require a login, with read and write rights per topic. Paid ntfy.sh plans can reserve topic names. 4 1

Pros and cons of ntfy

Pros

  • No account and no fee on the public server, and you can run the program yourself. 1
  • Open source, and dual-licensed under the Apache 2.0 and GPLv2 license. 1
  • Official apps for Android and iPhone, plus desktop notifications in the browser. 5 1
  • A private server can deny anonymous access until you grant it. 4
  • Other Android apps can use ntfy as a UnifiedPush distributor. 5

Cons

  • On ntfy.sh, knowing the topic name is enough to read it, and message text is cached for 12 hours by default. 3 2
  • The Play Store app and the iOS app may send message content through Google’s Firebase. The privacy policy says Google’s policy applies to that handling. 2
  • Free ntfy.sh use is capped at 250 messages a day, 5 emails a day, and 2 MB per attachment. 3
  • A new server lets everyone read and write every topic until you change that. The docs say ntfy.sh is set up the same way. 4
  • The F-Droid build does not include Firebase, so every subscription uses instant delivery and that cannot be turned off. 5
  • An access token can act as the whole account, apart from password changes and deletion. Narrower tokens are not available yet. 4

Is ntfy safe and private?

Philipp Heckel makes ntfy. It is dual-licensed under the Apache 2.0 and GPLv2 license. The release notes list current stable versions as server v2.34.0 (24 October 2026), Android v1.25.2 (23 July 2026), and iOS v1.7.0 (30 May 2026). 1 6

The ntfy.sh privacy policy, updated 15 June 2026, says the service will not monetize or sell your information, and that anonymous use is allowed. Messages are cached for 12 hours by default, attachments for 3 hours, then deleted. Connections use TLS. Passwords are bcrypt hashes, and message content is not logged by default. The configuration guide says ntfy.sh is hosted and sponsored by DigitalOcean. Card numbers are handled by Stripe and are not stored by ntfy. 2 4

For the Play Store and iOS apps, message content may pass through Firebase Cloud Messaging. Firebase Analytics is off in the Android app. The F-Droid build has no Google services and uses a direct connection. The Play build uses Firebase only for ntfy.sh, and the iOS app uses Firebase via Apple’s push service. The web app keeps subscriptions in the browser and does not use tracking cookies. 2 5

On a server you run, you control storage, and nothing is shared with ntfy.sh unless you turn on those outside services. The default is still open to everyone. Set auth-default-access to deny-all, then add users. A cache duration of zero keeps each message only long enough to hand it to people who are already connected. 2 4

How to get started with ntfy

  1. Choose where messages live. Sending to ntfy.sh needs no install: curl is enough. To keep alerts at home, use the install guide and the build named in the release notes (server v2.34.0, 24 October 2026). 8 6
  2. Install a receiver. Android: F-Droid or Google Play. iPhone or iPad: the App Store. On a computer, open ntfy.sh/app and allow notifications. 5 7
  3. Pick a topic of up to 64 characters (letters, numbers, underscores, dashes) and treat it like a password. 3
  4. Subscribe to that exact name in the app or the web app. 1
  5. Send a test with curl -d "Backup finished" ntfy.sh/your-topic-name, using the name you chose. 3
  6. Before private text, lock access. On your server, set auth-default-access to deny-all and grant a user only the topics you need. 4

Who should use ntfy (and who might prefer something else)

ntfy fits people who want a phone ping from something they already run at home: a finished backup, a camera note, or a sensor in openHAB.

KDE Connect connects a phone and a computer for everyday tasks. Gotify is another notification server you can run yourself, if you want a different starting point.

Frequently asked questions

Is ntfy free?

Yes. ntfy.sh needs no account and no fee, within 250 messages a day and 2 MB attachments. The homepage lists Supporter at $6 and $5 a month, Pro at $12 and $10, and Business at $25 and $20. You can also run the server yourself. 1 3

Is ntfy safe?

The trip to ntfy.sh uses HTTPS, and the privacy policy says the service will not monetize or sell your information. The server still keeps the message for the cache period, topics there are public, and the Play and iOS apps may pass the text through Firebase. For a private note, host ntfy, set access to deny-all, and use F-Droid or your own server. 2 3 5

Does ntfy work on iPhone?

Yes. An iOS app is on the App Store. Release notes list v1.7.0 (30 May 2026), with image and attachment support. Alerts on iOS use Firebase via Apple’s push service. 5 6 2

Can I run ntfy on my own server?

Yes. Install options include a Linux binary, deb and RPM packages, Docker (amd64, armv6, armv7, and arm64), and Windows. On a Mac, the command-line tool is supported and the server is currently not. Set anonymous access to deny-all before private messages. 8 4

Sources

  1. ntfy: Send push notifications to your phone via PUT/POST
  2. ntfy: Privacy policy
  3. ntfy: Sending messages
  4. ntfy: Configuration
  5. ntfy: Subscribe from your phone
  6. ntfy: Release notes
  7. ntfy: From the web app
  8. ntfy: Installation

BellCrier breach check

Is your email already in a data breach?

Most people are, and never hear about it. BellCrier checks your email against known data breaches for free, then alerts you when it turns up in a new one, with exactly what leaked and how to fix it.

  • Free instant check
  • No password needed
  • Alerts for you and your family

Opens bellcrier.com with your email filled in. Nothing is checked until you confirm there.