Koel
koel.devSelf-hostedMusic streaming solution that turns your personal collection into a sleek, web-based listening experience. With (smart) playlists, scrobbling, podcasts, radio, Last.fm/Spotify/MusicBrainz integrations and an AI for natural-language commands.
- Homepage:koel.dev
- GitHub:github.com/koel/koel
- iOS App:apps.apple.com/app/koel-player/id1576886982
- Android App:play.google.com/.../phanan.koel.app
- Web info:web-check.xyz/check/koel.dev
Koel Source Code
Author
Description
Music streaming solution that works.
Homepage
https://koel.devRepository
- LicenseMIT
- Created06 Dec 15
- Primary languagePHP
- Size30,047 KB
- Stars17,277
- Forks2,112
- Watchers17,277
Top Contributors
@phanan (3284)
@dependabot[bot] (114)
@dependabot-preview[bot] (71)
@agigante80 (11)
@alex-phillips (9)
@pedroborges (8)
@X-Ryl669 (6)
@rundef (4)
@fieteboerner (4)
@0xcaff (3)
@mattstauffer (3)
@juliusvdijk (3)
@nebulade (2)
@renovate[bot] (2)
@funcoding (2)
@SahAssar (2)
@serima (2)
@ShetlandJ (2)
@Doppelkeks12 (2)
@DahliaWitt (2)
@christ0ph3r (2)
@Dogfalo (2)
@vesper8 (1)
@sergiustheblack (1)
@survivant (1)
@Sammyjo20 (1)
@rburchell (1)
@icewind1991 (1)
@rene-bos (1)
@Rein1n (1)
@piamancini (1)
@NamPNQ (1)
@PeterDaveHello (1)
@PBK-B (1)
@nob (1)
@MyPod (1)
@meysholdt (1)
@manfrin (1)
@MichaIng (1)
@mattsches (1)
@mattb-it (1)
@Archetipo95 (1)
@JBlond (1)
@michalmytych (1)
@red-coracle (1)
@ngiamour (1)
@loganfreeman (1)
@leowmjw (1)
@lbausch (1)
@dillonstreator (1)
@bibo38 (1)
@panzarino (1)
@WangYihang (1)
@XavRsl (1)
@wesleybliss (1)
@UrbanCMC (1)
@TowyTowy (1)
@tobbez (1)
@neobrain (1)
@tcyrus (1)
@tomdoo (1)
@tatthien (1)
@Totara-thib (1)
@ziko1153 (1)
@davidschlachter (1)
@daniele-athome (1)
@peter279k (1)
@chrisvoo (1)
@ChaitanyaPTank (1)
@BrookeDot (1)
@brett-anderson (1)
@brendt (1)
@kondratovbr (1)
@wolfpld (1)
@bartlomieju (1)
@Anduin2017 (1)
@andreybolonin (1)
@allentje (1)
@falahatiali (1)
@MelonSmasher (1)
@alex-frolov (1)
@hiimjako (1)
@acjohnson (1)
@AaronCohen21 (1)
@AEnterprise (1)
@MaciejGorczyca (1)
@lewislarsen (1)
@ktravis (1)
@kran27 (1)
@kerwynrg (1)
@Hyzual (1)
@jojoxd (1)
@joanfont (1)
@JesusRugama (1)
@javier-lopez (1)
@JanMikes (1)
@nexxai (1)
@ibonkonesa (1)
@theianspence (1)
@henriquebremenkanp (1)
Recent Commits
Phan An(11 Oct 26)
feat: play MilkDrop presets with a projectM visualizer (#2867) * feat: add a projectM visualizer that plays imported MilkDrop presets * fix: import MilkDrop presets with a button, since drops go to the uploader * feat: pick or import MilkDrop presets from a dropdown * feat: manage MilkDrop presets in a modal with search, import and delete * feat: play a MilkDrop preset by clicking it in the manager * refactor: shape the preset manager like the other modals, with fuzzy search and an Activate button * refactor: link to more presets from the browser-only note * refactor: apply presets with a text button and center the row icons * refactor: border the preset Apply button * refactor: disable Apply for the preset already applied * fix: drop deleted presets from the manager list * refactor: move preset Import into the modal header * refactor: put preset Import and Close in the modal footer * refactor: show the browser-only note under the preset modal buttons * refactor: hide preset search until there are presets * refactor: show the browser-only note above the preset modal buttons * refactor: put preset Import back in the modal header * docs: explain visualizers and importing MilkDrop presets * docs: show projectM in the visualizers page * docs: use the Urchin Kali Mod preset for the projectM screenshot * docs: use a livelier frame for the projectM screenshot * docs: word the preset note more warmly * feat: load projectM from the @koel-project/projectm-wasm package * chore: drop Butterchurn now that projectM plays MilkDrop presets
Phan An(11 Oct 26)
fix: stop visualizers when they close, and draw them more cheaply (#2866) * fix: stop visualizers when they close, and draw them more cheaply * fix: draw Color Pills inside the shared loop so it stops on close * chore: drop sketch-js, which nothing uses anymore
Phan An(11 Oct 26)
fix: skip the daily scan when songs aren't on local storage (#2864)
Phan An(11 Oct 26)
fix: keep smart playlist edits and results in step with what users do (#2865) * fix: keep smart playlist edits and results in step with what users do * fix: keep the item count next to the smart playlist limit notice
Phan An(11 Oct 26)
fix: apply library access to every smart playlist rule group (#2861) * fix: apply library access to every smart playlist rule group * test: keep other users' private songs out of later smart playlist groups
Phan An(11 Oct 26)
fix: create the default organization without the model during migration (#2863)
Phan An(11 Oct 26)
fix: make smart playlist rules match what users expect (#2862) * fix: make smart playlist rules match what users expect * refactor: compare text rules through the raw path for every operator
Phan An(11 Oct 26)
refactor: share one favorites-only toggle across list screens (#2860)
Phan An(11 Oct 26)
refactor: label icon controls with screen-reader text instead of title (#2859)
Phan An(11 Oct 26)
feat: let the song context menu's sections be reordered, removed or added to (#2858)
Phan An(11 Oct 26)
refactor: drop guards for rare failures (#2857)
Phan An(11 Oct 26)
refactor: skip guards for rare failures (#2856) * docs: skip review findings about edge cases that never happen * refactor: drop guards for edge cases that never happen * fix: keep a song paused when paused while it loads
Phan An(11 Oct 26)
feat: stream audio through short-lived signed URLs (#2855) * feat: stream audio through short-lived signed URLs * fix: keep signed URLs valid for long songs and renew them before resuming * fix: skip straight to the next song, and address review findings * fix: keep reloading expired URLs during long episodes * fix: don't start a song paused while its URL was loading * fix: use the unsigned URL only for songs saved offline * fix: don't save a song offline after it was removed while loading * fix: don't save a song offline after it was deleted while loading
Phan An(11 Oct 26)
fix: keep an uploaded avatar when signing in with SSO (#2854)
Phan An(11 Oct 26)
fix: match the Subsonic default cover to the web one (#2853)
Phan An(11 Oct 26)
perf: index foreign key columns on Postgres (#2852)
Phan An(11 Oct 26)
fix: keep context menus on screen when they grow after opening (#2851) * fix: keep context menus on screen when they grow after opening * fix: stop a context menu's opening once it has closed * fix: let only the latest context menu opening position and watch the menu
Phan An(11 Oct 26)
refactor: build the song context menu from small, self-contained parts (#2850) * refactor: build the song context menu from small, self-contained parts * refactor: name the playlist in the Add To menu loop
Phan An(11 Oct 26)
feat: subscribe to podcasts from Apple Podcasts links (#2849) * feat: subscribe to podcasts from Apple Podcasts links * fix: show a missing Apple Podcasts feed on the field, and keep lookup failures apart
Phan An(10 Oct 26)
fix: fill the remote volume slider from the very bottom (#2848)
Phan An(10 Oct 26)
feat: retry background requests that fail on a temporary error (#2845) * feat: retry background requests that fail on a temporary error * fix: send queue, playback position and preference saves one at a time * fix: report failed in-order saves and survive a send that throws * refactor: name the saving helper after the rule it enforces
Phan An(10 Oct 26)
fix: broadcast through Pusher when its keys are set up (#2847) * fix: broadcast through Pusher when its keys are set up * test: restore every copy of the environment after the broadcasting config tests
Phan An(10 Oct 26)
fix: lay out the remote controller's volume slider (#2846) * fix: lay out the remote controller's volume slider * fix: center the remote volume handle on its track
Phan An(10 Oct 26)
test: check that list endpoints don't run a query per record (#2844) * test: check that list endpoints don't run a query per record * test: require a successful Subsonic response in the query count tests
Phan An(10 Oct 26)
feat: let users write their own artist and album descriptions (#2843) * feat: let users write their own artist and album descriptions * feat: clean fetched artist and album text the same way as user-written text * docs: match the description note's wording * fix: limit description length to what the column can hold * fix: keep the discard prompt, the source link and toolbar states accurate * fix: leave an Information tab that disappears and name the description editor * fix: keep partial albums out of the album store when fetching their info
Phan An(10 Oct 26)
feat: replace the user cards' gradient border with a hover highlight (#2842)
Phan An(10 Oct 26)
feat: show the brand logo as the sidebar's Home button (#2841)
Phan An(10 Oct 26)
feat: scroll the screen header away and slide it back in on scrolling up (#2840) * feat: scroll the screen header away and slide it back in on scrolling up * chore: remove the unused swipe direction composable * fix: follow the active scroll box and ignore overscroll bounce * fix: stop the header slide when another scroll box takes over
Phan An(10 Oct 26)
feat: move Users into Settings and show the section in the header (#2839)
Phan An(10 Oct 26)
feat: add a Kameleon theme that takes its colors from what's playing (#2838) * feat: add a Chameleon theme that takes its colors from what's playing * feat: name the theme Kameleon * fix: color statistics charts with the current theme colors * fix: keep Kameleon out of embeds and cover its branches with tests * docs: explain why embeds leave out Kameleon * fix: stop watching theme colors when a statistics chart unmounts
Koel Security
Security Advisories (15)
- mediumPatchedCVSS 5.4
GHSA-53v7-mcc9-3p5j[CWE-863] Plus edition: any low-privilege user can rewrite other users' public songs via PUT /api/songs and delete their empty album/artist entities (7.0.0 to 9.14.1)
- mediumPatchedCVSS 5.4
GHSA-52pp-r28f-2qx2SSRF in Koel branding update: logo/cover URL fetched via unprotected ImageWriter::fetch()
- mediumPatchedCVSS 6.8
GHSA-68gh-wqjq-wpm2Last.fm connect flow leaks a non-expiring, full-ability (`['*']`) Sanctum personal access token via the `cb` callback URL
- highPatchedCVSS 8.1
GHSA-gmx6-r3hc-5xw5Unauthenticated Host header injection poisons the password reset link, enabling account takeover
- mediumPatchedCVSS 6.4
GHSA-9rr8-qrh3-f5v8SSRF via podcast feed URL
- highPatchedCVSS 8.5
GHSA-j6cj-g7xw-rw4qFull-read SSRF via octal-encoded IP bypassing the public-address guard
- criticalPatchedCVSS 9.3
GHSA-9mxf-qvfv-whr6SSO callback posts the bearer token to the opener with a wildcard target origin
- mediumPatchedCVSS 6.5
GHSA-mgpx-2jrm-v5w8DNS-rebinding TOCTOU SSRF in RadioStreamProxy::openStream() (incomplete fix of GHSA-6qvr-wjmv-v8mm)
- highPatchedCVSS 7.1
CVE-2026-54491Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
- mediumPatchedCVSS 4.3
CVE-2026-54492Authenticated Blind SSRF via Subsonic Podcast Channel Creation
- highPatchedCVSS 7.7
CVE-2026-54493Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
- mediumPatchedCVSS 6.4
GHSA-8q6q-m837-fv64Authenticated Subsonic podcast feed URL SSRF in Koel
- mediumPatchedCVSS 6.3
CVE-2026-50552Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
- mediumPatched
CVE-2026-54494Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
- highPatchedCVSS 7.7
CVE-2026-47260SSRF via Podcast Episode Enclosure URLs
Koel Website
Website
Koel
Music streaming server that works
Redirects
Does not redirect
Security Checks
2 security checks failed (63 passed)
- Domain Recently Created
- Domain Very Recently Created
Server Details
- IP Address98.84.224.111
- Hostnameec2-98-84-224-111.compute-1.amazonaws.com
- LocationAshburn,Virginia,United States of America,NA
- ISPAmazon Technologies Inc.
- ASNAS14618
Associated Countries
US
Safety Score
Website marked as safe
100%
Trackers
No known trackers found
Blacklist Check
koel.dev was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Koel iOS App
App Info
Koel Player
The official mobile player for Koel (https://koel.dev), the open-source self-hosted music streaming service. With Koel Player you can connect to and stream your music from your own Koel server. Koel Player supports most of the features found in the web-based version: - Queue and play music - Like/unlike songs - Manipulate playlists - View lyrics and media information In addition, Koel Player allows caching music for local playback. More features are planned.
Rating
Version Info
- Current Version2.2.11
- Last Updated02 Sept 26
- First Released25 Jul 21
- Minimum iOS Version16.0
- Device Models Supported130
App Details
- IPA Size25.10 Mb
- Price$9.99 (USD)
- Age Advisory4+
- Supported Languages1
- DeveloperAn Phan
- Bundle IDdev.koel.koel
Screenshots
Koel Reviews
More Media Servers
Self-hosted server for streaming your own films, TV, music and live TV to apps on most devices. Volunteer-run, with no telemetry or paid tiers. Some media endpoints don't require login, so avoid exposing it directly to the internet.
About the Data: Koel
Change History
- Added #851
Edit Koel Data
You can edit Koel's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Koel's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/koelThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Koel
Help your friends compare Media Servers, and pick privacy-respecting software and services.
Share Koel and Awesome Privacy with your network!