Rocket.Chat

rocket.chat
Awesome Privacy➔ Communication➔ Team Collaboration➔ Rocket.Chat
Rocket.Chat

Easy-to-deploy, self-hosted Slack alternative with polished cross-platform apps. End-to-end encryption is supported, but off by default - without it, workspace admins can read all messages. Usage statistics are sent by default.

Avoid

  • slack
  • microsoft teams
  • google chat
  • discord
  • asana
  • trello
  • basecamp

Also Consider

Open Source

Rocket.Chat Source Code

Author

RocketChat

Description

The Secure CommsOS™ for mission-critical operations

#chat#collaboration#foss#free#hacktoberfest#javascript#meteor#mit#real-time#slack#webrtc

Homepage

https://rocket.chat/

Repository

  • LicenseOther
  • Created19 May 15
  • Primary languageTypeScript
  • Size2,147,831 KB
  • Stars46,224
  • Forks13,953
  • Watchers46,224

Language Usage

Language Usage

Project Health

  • Last commit6 days ago
  • Open issues4,192
  • Latest release8.9.0

Top Contributors

Recent Commits

  • Guilherme Gazzo(07 Oct 26)

    test: target sidebar collapsers by listitem role (#42623)

  • Diego Sampaio(07 Oct 26)

    fix: ddp-streamer not listening when client versions fail to load (#42336)

  • Guilherme Gazzo(07 Oct 26)

    feat(video-conf): optional call features for LiveKit calls (#42443)

  • Guilherme Gazzo(07 Oct 26)

    test: drop listitem assertion that targets mocked RoomListCollapser (#42615)

  • Guilherme Gazzo(07 Oct 26)

    chore(api): add licenseRequired option to enforce a valid license (#42610)

  • Guilherme Gazzo(07 Oct 26)

    fix(a11y): wrap room list group headers in listitem (#42554) Co-authored-by: Douglas Fabris <[email protected]>

  • Guilherme Gazzo(07 Oct 26)

    test: fix flaky global search jump to message (#42611)

  • Guilherme Gazzo(07 Oct 26)

    chore: extract personal access tokens UI into @rocket.chat/ui-account (#42427)

  • Guilherme Gazzo(07 Oct 26)

    test: update RichTextMessageBox snapshot for spoiler block markup The snapshot added in #42368 was recorded before #42495 changed how the composer renders spoiler blocks, breaking unit tests on develop.

  • Martin Schoeler(07 Oct 26)

    chore(realtime-composer): Add storybook and snapshot tests (#42368)

  • khizar shah(07 Oct 26)

    fix: prevent duplicate image uploads when dragging from browser (#42571)

  • Diego Sampaio(07 Oct 26)

    fix: livechat transcript uploaded truncated to one of its rooms (#42337)

  • Tasso Evangelista(07 Oct 26)

    chore: move markdown lib out of app/ and convert it to TypeScript (#42382)

  • dependabot[bot](07 Oct 26)

    chore(deps): bump the codeql-action group across 1 directory with 3 updates (#42409) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  • Tasso Evangelista(07 Oct 26)

    chore: move icons into the monorepo (#42607)

  • Guilherme Gazzo(07 Oct 26)

    fix: hide voice-call icon for users without a phone extension (#40862)

  • Guilherme Gazzo(07 Oct 26)

    fix(uikit): only open safe URLs from buttons and overflow options (#42560) Co-authored-by: Tasso Evangelista <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>

  • Tasso Evangelista(06 Oct 26)

    chore: upgrade Jest and ESLint tooling and drop redundant test dependencies (#42527) Co-authored-by: Claude Opus 5.5 <[email protected]>

  • Martin Schoeler(06 Oct 26)

    fix(realtime composer): Undesired newline added while in edit mode (#42330)

  • Martin Schoeler(06 Oct 26)

    fix(realtime composer): spoiler block not rendering correctly (#42495)

  • Guilherme Gazzo(06 Oct 26)

    regression: make every user card wait out the hover delay (#42598)

  • Guilherme Gazzo(06 Oct 26)

    fix(uikit): associate input block labels with their fields (#42564)

  • Ricardo Garim(06 Oct 26)

    feat: add status visibility admin actions (#42050)

  • Harmeet Kour(06 Oct 26)

    test: cover omnichannel channel matching (#42549) Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Kevin Aleman <[email protected]>

  • Guilherme Gazzo(06 Oct 26)

    fix(uikit): close the modal on a modal.close response (#42558)

  • Guilherme Gazzo(06 Oct 26)

    fix(uikit): show option descriptions in checkboxes and radio buttons (#42567)

  • Kevin Aleman(06 Oct 26)

    chore: type fixes extracted from TS 6 upgrade branch (#41283)

  • Ricardo Garim(06 Oct 26)

    test: cover list parsing and blocklist priority in upload content-type restrictions (#42577)

  • Tasso Evangelista(06 Oct 26)

    refactor: drop TranslationKey casts from client t() calls (#42374) Co-authored-by: Claude Opus 5.5 <[email protected]>

  • dougfabris(06 Oct 26)

    fix(ui): room members and team channels rows grow when hovered (#42563) Co-authored-by: Claude Opus 5.5 <[email protected]>

Rocket.Chat Security

8.7/10

Repo Security Summary

Updated 24 Aug 26

  • Code-Review9/10
  • Maintained10/10
  • Security-Policy10/10
  • PackagingN/A
  • CII-Best-Practices0/10
  • Dangerous-Workflow10/10
  • License9/10
  • Token-Permissions9/10
  • Signed-ReleasesN/A
  • Branch-Protection8/10
  • Binary-Artifacts10/10
  • Fuzzing10/10
  • Pinned-Dependencies6/10
  • SAST7/10

Security Advisories (21)

  • mediumPatched

    GHSA-6x96-99rg-wg67Blind Server-Side Request Forgery (SSRF) In The downloadPublicImportFile Endpoint

  • mediumPatchedCVSS 5.4

    GHSA-r3v3-v742-55j5Arbitrary notify-user event injection via stream-notify-room-users forward (incomplete fix of GHSA-27jx)

  • mediumPatchedCVSS 4.3

    CVE-2026-72919Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams

  • criticalPatched

    CVE-2026-55666Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

  • highPatchedCVSS 7.4

    CVE-2026-55759Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

  • lowPatched

    GHSA-7c6v-m68v-v73rsendForgotPasswordEmail Meteor Method Lacks DDP Rate Limit

  • highPatched

    CVE-2026-45677Lack of SAML Signature Check During Logout Could Lead To DoS

  • criticalPatchedCVSS 9.1

    CVE-2026-45689Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

  • criticalPatchedCVSS 9.1

    CVE-2026-45688Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

  • highPatchedCVSS 8.5

    CVE-2026-45687Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage

  • highPatched

    CVE-2026-46423SAML signature validation skipped when IdP certificate field is empty

  • mediumPatchedCVSS 6.7

    CVE-2026-49278Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation

  • highPatchedCVSS 8.1

    CVE-2026-55762Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint

  • mediumPatched

    CVE-2026-49277OAuth access and refresh tokens remain valid after account deactivation

  • lowPatched

    CVE-2026-45757users.deactivateIdle deactivates accounts without revoking existing login tokens

  • lowPatched

    CVE-2026-47733Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images

  • highPatched

    CVE-2026-308312FA bypass and login of deactivated users via EE ddp-streamer

  • highPatched

    CVE-2026-30833NoSQL injection in the EE ddp-streamer-service

  • criticalPatched

    CVE-2026-28514Users can login with any password via the EE ddp-streamer-service

  • highPatchedCVSS 7.7

    CVE-2026-23477Unauthorized Access to OAuth App Details (Versions ≤ 6.12.0)

  • mediumPatchedCVSS 5.4

    CVE-2026-72918Insecure implementation of websocket notifications

Rocket.Chat Website

Website

Rocket.Chat | Secure CommsOS® for Mission-Critical Operations

Centralize real-time messaging, voice, video, AI, and apps for secure, reliable and unified communication among internal and external stakeholders.

Redirects

Redirects to https://www.rocket.chat/

Security Checks

All 65 security checks passed

Server Details

  • IP Address198.202.211.1
  • LocationSan Francisco,California,United States of America,NA
  • ISPWebflow Inc
  • ASNAS209242

Associated Countries

  • USUS
  • CACA

Safety Score

Website marked as safe

100%

Trackers

Loads 3 third-party trackers

  • clarity.msMicrosoft Corporation
  • googletagmanager.comGoogle Ads
  • redditstatic.comReddit Inc.

Blacklist Check

www.rocket.chat was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Rocket.Chat Android App

APK Info

De-Googled Compatibility

Native2.00/ 41 ratings
microG4.00/ 42 ratings

Tested on Android 13–14 · Updated 19 Sept 24 · View on Plexus →

Trackers

No trackers found

    Permissions

    • Access Network State
    • Access Wifi State
    • Bluetooth
    • Camera
    • Foreground Service
    • Internet
    • Manage Own Calls
    • Modify Audio Settings
    • Read Calendar
    • Receive Boot Completed
    • Record Audio
    • System Alert Window
    • Vibrate
    • Wake Lock
    • Write Calendar
    • Write External Storage

    Rocket.Chat iOS App

    App Info

    Rocket.Chat

    Rocket.Chat Secure CommsOS™ is a communication platform that unifies messaging, voice, video, AI, and mission-critical applications—ensuring uncompromising security, compliance, and operational efficiency for governments, defense, and critical infrastructure organizations operating in high-stakes environments. The result is an increase in productivity and customer satisfaction rates. Everyday, tens of millions of users in over 150 countries and in organizations such as Deutsche Bahn, The US Navy and Credit Suisse trust Rocket.Chat to keep their communications completely private and secure. By opting for Rocket.Chat, users also benefit from free audio and video conferencing, guest access, screen and file sharing, LiveChat, LDAP Group Sync, two-factor authentication (2FA), E2E encryption, SSO, dozens of OAuth providers and unlimited users, guests, channels, messages, searches and files. Users can set up Rocket.Chat on cloud or by hosting their own servers on-premises. With thousands of contributors and stars on Github, Rocket.Chat has the world’s largest community of chat developers in the open source communication sector. When you choose Rocket.Chat, you join an ever-growing passionate community that constantly improves our platform with us :) KEY FEATURES: * Open Source Software * Hassle-free MIT license * BYOS (bring your own server) * Multiple Rooms * Direct Messages * Private & Public Channels/Groups * Desktop and Mobile Notifications * 100+ available integrations * Edit and Delete Sent Messages * Mentions * Avatars * Markdown * Emojis * Choose between 3 themes: Light, Dark, Black * Sort conversations alphabetically or group by activity, unread or favourites * Transcripts / History * File Upload / Sharing * I18n - [Internationalization with Lingohub] * Hubot Friendly - [Hubot Integration Project] * Media Embeds * Link Previews * LDAP Authentication * REST-full APIs * Remote Locations Video Monitoring * Native Cross-Platform Desktop Application

    Rating

    Rated 4.41 out of 5 stars by 3,706 users

    Version Info

    • Current Version4.75.0
    • Last Updated03 Aug 26
    • First Released08 Mar 17
    • Minimum iOS Version15.1
    • Device Models Supported128

    App Details

    Screenshots

    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot

    Rocket.Chat Docker

    Container Info

    rocketchat

    Rocket.Chat - the open-source team communication platform: channels, DMs, threads, voice/video, an apps marketplace, and omnichannel (livechat/email/social). MIT core. The app is stateless - all state lives in MongoDB.

    #Business Apps

    Run Command

    docker run -d \
  -e MONGO_URL=${MONGO_URL} \
  -e ROOT_URL=${ROOT_URL} \

    Compose File

    version: 3.8
services:
  rocket-chat:
    environment:
      MONGO_URL: "mongodb://mongo:27017/rocketchat?replicaSet=rs0"
      ROOT_URL: "http://localhost:5000"

    Environment Variables

    • Var NameDefault
    • MONGO_URLmongodb://mongo:27017/rocketchat?replicaSet=rs0
    • ROOT_URLhttp://localhost:5000

    Rocket.Chat Reviews

    More Team Collaboration

    • Element

      Element

      element.io

      Privacy-focused messenger using the Matrix protocol. The Element client allows for group chat rooms, media sharing, voice and video group calls. End-to-end encryption by default for message content, but not metadata, which remains visible to the home server operator.

      Security Audited Open Source element-hq/element-web
      View Element Report
    • Mattermost

      Mattermost

      mattermost.com

      Self-hostable Slack alternative with native desktop, mobile and web apps, and many integrations. There's no end-to-end encryption, so the server can read all messages, and telemetry is on by default. The open source edition caps at 250 users.

      Open Source mattermost/mattermost
      View Mattermost Report
    • Xeres

      Xeres

      xeres.io

      A decentralized, encrypted P2P friend-to-friend app for chat, forums, channels, boards, voice calls and anonymous file sharing. Best for trusted contacts, as it isn't anonymous unless you route it through Tor (off by default).

      Open Source zapek/Xeres
      View Xeres Report
    • Zulip

      Zulip

      zulip.com

      Open source team chat organized around topic-based threading, which keeps busy conversations easier to follow than channel-only tools. Can be self-hosted, or used as a paid cloud service. The threading model takes some getting used to.

      Open Source zulip/zulip
      View Zulip Report
    View More...

    About the Data: Rocket.Chat

    Change History

    • Amended (description, tosdrId) by @lissy93 #770
    • Amended (androidApp, iosApp)

    Edit Rocket.Chat Data

    You can edit Rocket.Chat's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    Delete Rocket.Chat Submit Edit to Rocket.Chat Add alternative

    API

    You can access Rocket.Chat's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/rocket-chat

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Rocket.Chat

    Help your friends compare Team Collaboration, and pick privacy-respecting software and services.
    Share Rocket.Chat and Awesome Privacy with your network!

    View Team Collaboration (5)
    Next →

    Element