Stash

Last reviewed Aug 26, 2026 · 832 words

Stash is an organizer for adult video and image collections. Listings tend to describe it as a "media server" and file it next to Plex, and that is misleading enough to correct in the first sentence: it will play your files in a browser, but it has no TV apps, no living-room transcoding profiles and no interest in your Blu-ray rips. What it has is the best tagging, scraping and de-duplication engine I have seen in any self-hosted media tool, a single Go binary, a SQLite database, and a default configuration that leaves the front door open. For its actual purpose it is excellent. For a general library, Jellyfin is the answer and this guide is not for you.

The model is scenes, performers, studios and tags

Every video file is a scene. Scenes link to performers, a studio, tags and optionally a group, and all of those are first-class objects with their own pages, images and filters. Images and galleries get the same treatment. Once a library is tagged, the filtering is the point: every scene with two named performers from a given studio, longer than 20 minutes, rated 4 or above, not yet watched, sorted by date. That query is 5 clicks. Nothing else in this space comes close, which is why people who use Stash tend to use it obsessively.

Scanning a library also generates perceptual hashes, so duplicate detection catches the same scene re-encoded at a different bitrate, not just byte-identical files. Alongside the hashes Stash builds preview clips, scrubber sprites and optional transcodes, and that generation step is where your CPU time goes for the first few days.

Deploy: one port, five volumes

services:
  stash:
    image: stashapp/stash:latest
    restart: unless-stopped
    ports:
      - "9999:9999"
    volumes:
      - ./config:/root/.stash
      - ./generated:/generated
      - ./metadata:/metadata
      - ./cache:/cache
      - ./blobs:/blobs
      - /mnt/media/stash:/data

Config holds the SQLite database and settings; generated grows fastest and can live on slower storage; blobs holds performer and scene images. On first launch the web setup wizard asks where each of these lives and where your library is. The listed 256 MB of RAM is honest for browsing; during a full generation pass give it 1 GB and every core you can spare, or schedule the generation tasks overnight from Settings > Tasks. A single binary download does the same job without Docker, and it fetches ffmpeg itself on first run.

It ships with no login, so fix that before anything else

Out of the box Stash asks for no credentials. That is fine on localhost and dangerous the moment it is reachable from anything else, and the app knows it: it warns in the UI and has a tripwire setting that disables external access if it sees a request arrive from the public internet. Set a username and password under Settings > Security in the first 5 minutes, and do not expose port 9999 to the internet at all. Reach it over Tailscale or your VPN. Given what the library is, the threat model here is less "attacker" and more "houseguest on the Wi-Fi", and a password handles that.

Scrapers and StashDB do the tagging for you

Manual tagging of 3,000 files is not a hobby. Stash's scraper system pulls metadata from studio sites and from StashDB, a community-run database with fingerprint matching: the app hashes your file, asks StashDB whether it has seen that hash, and if so fills in title, date, performers, studio and tags in one click. Coverage for commercial content is high; for anything obscure you will still tag by hand. Scrapers are community-maintained YAML and Python in a separate repository, installed from Settings > Metadata Providers, and plugins from the same place add things like automatic tagging runs and theme tweaks. The two settings I change immediately are the stash-box endpoint (add StashDB with an API key from an account there) and running the Identify task after every scan.

What it costs you

A first scan of a large library is a day of CPU. The database and generated files for 10,000 scenes run to tens of GB. The project is single-user by design (one login, no per-user libraries), and its AGPL licence and roughly 13,000 stars tell you it is healthy, but it is a niche tool with a niche community, so support means a Discord and a wiki rather than a hundred blog posts.

What I'd do

Docker on the box that holds the files, port 9999 bound to the LAN only, credentials set on day one, Tailscale for anything remote. Connect StashDB, run a scan, let Identify and generation finish overnight, then spend an evening on the leftovers. Back up the config volume nightly; everything else is regenerable. If your collection is what Stash is built for, nothing else organizes it as well. If it is not, you wanted Jellyfin.