Papra

Minimalistic self-hosted document archiving platform

E-books & Media Library ★ 5.6k stars Easy setup AGPL-3.0

Papra is a minimalistic, open-source document management and archiving platform for keeping your important files organized. It supports tagging, full-text search, and OCR for scanned documents.

Key features

  • Document archiving
  • Tagging and organization
  • Full-text search
  • OCR support

Pros & cons

Strengths

  • Clean modern UI
  • Easy deployment

Trade-offs

  • Newer project
  • Smaller feature set

Is Papra secure?

No confirmed vulnerabilities affect Papra's latest release (@papra/[email protected]). OSV.dev lists 5 advisories for the project and links 5 of them to this release, but their version data doesn't confirm them. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

5 unconfirmed matches

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2026-48052MediumPapra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Fixed in 26.5.0
CVE-2026-35461MediumPapra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
Fixed in 26.4.0
CVE-2026-35460MediumPapra has an HTML Injection in Transactional Emails via Unescaped User Display Name
Fixed in 26.4.0
CVE-2026-35462MediumPapra Does Not Reject Expired API Keys
Fixed in 26.4.0
CVE-2026-48051LowPapra: SSRF via HTTP redirect bypass in webhook delivery
Fixed in 26.5.0

Source: OSV.dev, checked 2026-10-14. How this is measured.

Papra replaces

Health badge

Maintain Papra? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 92 · excellent

Markdown
[![SelfHostIndex health score for Papra](https://selfhostindex.com/badge/papra-docs.svg)](https://selfhostindex.com/app/papra-docs/)
HTML
<a href="https://selfhostindex.com/app/papra-docs/"><img src="https://selfhostindex.com/badge/papra-docs.svg" alt="SelfHostIndex health score for Papra"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/papra-docs.svg
   :alt: SelfHostIndex health score for Papra
   :target: https://selfhostindex.com/app/papra-docs/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Last reviewed Sep 13, 2026 · 877 words

Most people who install Paperless-ngx use about a fifth of it. Papra is built for that fifth: drop a PDF in, it gets text-extracted and searchable, you tag it, you find it again in 2029. It is a single TypeScript container with an SQLite file behind it, needs 512 MB of RAM, has no Redis, no Postgres and no worker queue, and takes 5 minutes to run. The trade is that it also has no custom fields, no workflows, no correspondents and none of the automation that Paperless users grow into. If your archive is a few thousand household documents and the question is "can I find the boiler warranty", Papra answers it with far less to maintain.

Setup is one container

services:
  papra:
    image: ghcr.io/papra-hq/papra:latest
    ports:
      - "1221:1221"
    volumes:
      - ./papra-data:/app/app-data
    restart: unless-stopped

That is the entire stack. The web UI is on port 1221, the SQLite database and uploaded files both live under /app/app-data, and backup is one directory. Set APP_BASE_URL to your public address before putting it behind a reverse proxy so links in emails resolve correctly, and register the first account; you will want to disable open registration after that unless you are running it for a group. Papra is AGPL-3.0, first released in 2024, and sits at 5,276 GitHub stars, which for a project that young says something about how many people wanted a smaller Paperless.

The organisational model is documents, tags, and rules

There are no folders. Every document belongs to an organisation (a workspace, effectively; a household is one, a small business is another), carries any number of tags, and is found through full-text search over its extracted content. Tagging rules are the piece that makes this usable at volume: a rule matches on document name or content ("contains Octopus Energy") and applies a tag automatically on upload. Ten rules cover most of a household's recurring paperwork. Intake emails go a step further: Papra gives you an address per organisation, and anything forwarded there is ingested as a document, which is how I get PDF invoices in without touching the UI.

OCR is present, and lighter than you might be used to

PDFs with a text layer are indexed as-is. Images and scanned PDFs are run through OCR on upload, and the result is good enough for search but not for reproducing a document's layout, and it is noticeably weaker on poor scans than the Tesseract-plus-ocrmypdf pipeline behind Paperless-ngx. It also does not write the recognised text back into the PDF as a hidden layer, so a scanned file you download from Papra is the same scan you uploaded. If you feed it from a sheet-feed scanner at 300 dpi this is a non-issue; if you are photographing receipts with a phone, expect to fix a tag by hand now and then.

Where it loses to Paperless-ngx

PapraPaperless-ngx
Containers13 to 4 (app, Redis, database, optional Tika and Gotenberg)
RAM512 MB1 GB or more in practice
Custom fields, document types, correspondentsNoYes
Automatic classification that learnsNoYes
Consumption folder for scannersNo, upload or emailYes
Office document conversionNoYes with Tika and Gotenberg
Mobile app ecosystemNoneSeveral third-party

The two on that list that matter most are the consumption folder and the learning classifier. A scanner that dumps into a watched directory is the workflow that makes a paperless office run itself, and Papra does not have it yet; you email or upload. And Paperless's machine-learned matching, which after 200 documents starts guessing correspondents and types correctly, is the feature that turns a 10,000-document archive from a chore into a habit. Under a few thousand documents you will not miss either. The full setup for the bigger tool is in the Paperless-ngx guide, and Docspell is the third option if you want Paperless-level features on a JVM.

Who actually runs it

The user I see choosing Papra is someone who tried Paperless-ngx, got the compose file working, and then never set up the workflows because they only wanted search over 800 PDFs. It is also a good fit for a small club or a freelancer who wants a shared archive with two or three logins and a "forward invoices here" address. It is the wrong fit for anyone with a document-feed scanner, anyone who wants their archive to classify itself, and anyone whose archive is the legal record for a business.

What I'd do

If you have under 5,000 documents and no scanner-to-folder habit, run Papra, write eight tagging rules on day one, set up the intake email, and back up papra-data with the rest of your volumes. Revisit in a year: if you are hand-tagging more than you would like, that is the sign to move to Paperless-ngx, and since Papra stores your originals unmodified the migration is a bulk upload. The document management category has the rest of the field if neither fits.

Similar e-books & media library apps