Mastodon

mastodon.social
Awesome Privacy➔ Social➔ Social Networks➔ Mastodon
Mastodon

An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.

Avoid

  • facebook
  • twitter
  • instagram
  • linkedin
  • snapchat

Also Consider

Open Source

Mastodon Privacy Policy

Privacy Policy Summary

  • The user is informed about security practices
  • The service can delete your account without prior notice
  • This service is only available to users of a certain age
  • The service provides two factor authentification for your account
  • User logs are deleted after a finite period of time
  • You have the right to leave this service at any time
  • There is a date of the last update of the agreements
  • Your personal data is not sold
  • The service allows you to use pseudonyms
  • Private messages can be read
  • This service collects your IP address, which can be used to view your approximate location
  • The posting of untagged pornographic content is prohibited
  • This service offers a symbolic but nonbinding statement about a matter of opinion, ethics, society, or politics
  • You shall not interfere with another person's enjoyment of the service
  • You agree not to submit libelous, harassing or threatening content
  • Terms may be changed any time at their discretion, without notice to you
  • Details are provided about what kind of information they collect
  • This service gives your personal data to third parties involved in its operation
  • The publishing of personally identifiable information without the owner’s consent is not allowed
  • The service is open-source
  • You are prohibited from sending chain letters, junk mail, spam or any unsolicited messages
  • This service reserves the right to disclose your personal information without notifying you

Score

C

Documents

Domains Covered by Policy

  • mastodon.social
  • joinmastodon.org
  • mastodon.online
  • mastodon.cloud

About the Data

This data is kindly provided by tosdr.org. Read full report at: #639

Mastodon Source Code

Author

mastodon

Description

Your self-hosted, globally interconnected microblogging community

#activity-stream#activitypub#docker#fediverse#mastodon#microblog#social-network#social-web#webfinger

Homepage

https://joinmastodon.org

Repository

  • LicenseAGPL-3.0
  • Created22 Feb 16
  • Primary languageRuby
  • Size401,219 KB
  • Stars50,217
  • Forks7,484
  • Watchers50,217

Language Usage

Language Usage

Project Health

  • Last commit23 minutes ago
  • Open issues4,483
  • Latest releasev4.7.0-rc.1

Top Contributors

Recent Commits

  • Echo(17 Aug 26)

    Create SortableList helpers (#40182)

  • Matt Jankowski(17 Aug 26)

    Convert admin/disputes/appeals controller to system spec (#40124)

  • Claire(17 Aug 26)

    Fix `/deck` being removed from path when resizing window (#40180)

  • renovate[bot](17 Aug 26)

    Update dependency @unhead/react to v3.3.2 (#40144) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency eslint-plugin-jsdoc to v64 (#40104) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency @formatjs/unplugin to v1.2.4 (#40119) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency pg to v8.23.0 (#40120) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency postcss-preset-env to v11.4.0 (#40177) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency rollup-plugin-visualizer to v7.1.1 (#40168) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency terser to v5.50.0 (#40130) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • Renaud Chaput(17 Aug 26)

    Update Renovate to wait 3 days after package release before opening a PR (#40181)

  • Renaud Chaput(17 Aug 26)

    Automatically update JS transitive dependencies (#40121)

  • github-actions[bot](17 Aug 26)

    New Crowdin Translations (automated) (#40173) Co-authored-by: GitHub Actions <[email protected]>

  • renovate[bot](17 Aug 26)

    Update dependency simplecov to v1.1.1 (#40141) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot](17 Aug 26)

    Update dependency brakeman to v8.0.6 (#40140) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • diondiondion(14 Aug 26)

    Fix badge spacing in redesign (#40170)

  • diondiondion(14 Aug 26)

    Navigation redesign: Add footer (#40169)

  • Echo(14 Aug 26)

    Removes typescript-plugin-css-modules (#40165)

  • Echo(14 Aug 26)

    Composer redesign: Fixes bug with new post button (#40166)

  • Claire(14 Aug 26)

    Bump version to v4.8.0-alpha.1 (#40164)

  • Echo(14 Aug 26)

    Composer redesign: Text editing improvements (#40150)

  • diondiondion(14 Aug 26)

    Start main navigation redesign (#40158)

  • github-actions[bot](14 Aug 26)

    New Crowdin Translations (automated) (#40162) Co-authored-by: GitHub Actions <[email protected]>

  • diondiondion(13 Aug 26)

    Update Badge component styles for redesign (#40154)

  • Juan Hernández(13 Aug 26)

    Remove reference to tmp/cache/vite/last-build*.json file in test-ruby workflow (#40159)

  • Echo(13 Aug 26)

    Composer redesign: Poll duration (#40148)

  • Claire(13 Aug 26)

    Update `mastodon:setup` task warning about trademark to match `masto` but ignore subdomains (#40143)

  • github-actions[bot](13 Aug 26)

    New Crowdin Translations (automated) (#40142) Co-authored-by: GitHub Actions <[email protected]>

  • Echo(13 Aug 26)

    Redesigned composer feedback (#40125)

  • Claire(13 Aug 26)

    Remove redundant index `index_keypairs_on_account_id` (#40138)

Mastodon Security

Security Advisories (54)

  • mediumPatched

    GHSA-vwhj-3g83-v276SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

  • highPatchedCVSS 7.5

    GHSA-hx34-2pfw-2qfjPersonally-identifying information disclosure due to incorrect access control validation

  • highPatchedCVSS 7.5

    GHSA-7jvv-fhmg-wpfwDenial of Service through insufficient authentification of statistics endpoints

  • highPatchedCVSS 7.4

    CVE-2026-59825Unwanted deactivation of SSL/TLS certificate verification

  • highPatchedCVSS 7.5

    CVE-2026-50129DoS via unhandled NoMethodError in MATH_TRANSFORMER

  • mediumPatchedCVSS 5.3

    CVE-2026-50128Spoofing of attribution domains

  • highPatchedCVSS 7.5

    CVE-2026-47777Consent-check bypass in remote Collections

  • highPatchedCVSS 8.6

    CVE-2026-47389SSRF protection bypass on older Ruby versions (incomplete remediation for GHSA-xfrj-c749-jxxq)

  • highPatched

    CVE-2026-46348SSRF Bypass via IPv6 Unspecified Address (::)

  • mediumPatchedCVSS 5.3

    CVE-2026-46349LD-Signature Bypass via JSON-LD Named-Graph Restructuring

  • highPatched

    CVE-2026-41259Insufficient verification of email addresses

  • mediumPatchedCVSS 4.8

    CVE-2026-33869Denial of service for quote authorization

  • mediumPatchedCVSS 4.3

    CVE-2026-33868GET-Based Open Redirect via '/web/%2F<domain>'

  • highPatched

    CVE-2026-27468Allowing unconfirmed FASP to make subscriptions

  • lowPatched

    GHSA-46w6-g98f-wxqmSSRF via unvalidated FASP Provider base_url

  • mediumPatchedCVSS 6.5

    CVE-2026-25540Signature-dependent ActivityPub collection responses cached under signature-independent keys

  • mediumPatchedCVSS 5.3

    CVE-2026-23961Remote suspension bypass

  • mediumPatchedCVSS 6.5

    CVE-2026-23964Insufficient access control to push notification settings

  • highPatchedCVSS 7.5

    CVE-2026-23962Denial of Service from a single post (client/server)

  • highPatched

    CVE-2026-22245SSRF Protection bypass

  • mediumPatchedCVSS 6.5

    CVE-2026-22246Local users can enumerate and access severed relationships of every other local user

  • lowPatchedCVSS 3.7

    CVE-2025-67500Inconsistent error handling allows anonymously checking existence of known private posts

  • mediumPatchedCVSS 4.3

    CVE-2025-62605Quotes control bypass

  • mediumPatchedCVSS 4.3

    CVE-2025-62176Streaming server allows OAuth clients without the `read` scope to subscribe to public channels

  • lowPatchedCVSS 3.5

    CVE-2025-62174Changing a user's password via CLI does not revoke sessions & access tokens

  • mediumPatchedCVSS 4.3

    CVE-2025-62175Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards

  • mediumPatchedCVSS 5.3

    CVE-2025-54879Mastodon confirmation e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

  • lowPatched

    GHSA-x2rc-v5wx-g3m5Lack of sanitization of user-facing URLs for remote objects can lead to XSS in misconfigured servers

  • mediumPatchedCVSS 5.3

    CVE-2025-27157Missing rate-limit on sign-up email verification

  • mediumPatchedCVSS 5.3

    CVE-2025-27399Domain blocks & rationales ignore user approval when visibility set as "users"

  • lowPatched

    GHSA-mq2m-hr29-8gqfOEmbed embeds allow <embed> tag (blocked by CSP)

  • mediumPatchedCVSS 4.3

    CVE-2026-23963Missing length limits on list names, filter names, and filter keywords

  • mediumPatchedCVSS 5.3

    GHSA-5wxh-3p65-r4g6Partial Denial of Service due to insufficient validation of remote actors

  • mediumPatchedCVSS 5.3

    GHSA-3m9q-ww7w-qc5jSubdomains allow spoofing of accounts in search results

  • highPatchedCVSS 7.5

    GHSA-jpxp-r43f-rhvxPotential Polynomial regular expression used on uncontrolled data

  • mediumPatchedCVSS 5.3

    GHSA-58x8-3qxw-6hm7Insufficient permission checking on multiple API endpoints

  • highPatchedCVSS 8.2

    CVE-2024-37903Improper authorship check on audience extension for existing posts

  • lowPatchedCVSS 2.6

    GHSA-vp5r-5pgw-jwqxStreaming continues to send events for a user after access token is revoked

  • lowPatched

    GHSA-5fq7-3p3j-9vrfPrivate mention filtering can be bypassed

  • mediumPatchedCVSS 5.9

    GHSA-q3rg-xx5v-4mxhMissing rate-limit to password change endpoint

  • mediumPatchedCVSS 6.5

    CVE-2026-48028Removal of integrity-protected JSON entries from signed activities

  • mediumPatchedCVSS 4.8

    CVE-2023-49952Bypassing rate limiting with X-Forwarded-For header

  • highPatchedCVSS 8.5

    CVE-2024-25623Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

  • criticalPatchedCVSS 9.4

    CVE-2024-23832Remote user impersonation and takeover

  • lowPatchedCVSS 3.1

    CVE-2024-25619Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed

  • mediumPatched

    CVE-2024-25618External OpenID Connect Account Takeover by E-Mail Change

  • highPatchedCVSS 8.3

    CVE-2023-42452Stored XSS through the translation feature

  • mediumPatchedCVSS 5.4

    CVE-2023-42450Server-side request forgery

  • highPatchedCVSS 7.7

    CVE-2023-42451Invalid domain name normalization

  • mediumPatchedCVSS 5.4

    CVE-2023-36462Verified profile links can be formatted in a misleading way

  • highPatchedCVSS 7.5

    CVE-2023-36461Denial of Service through slow HTTP responses

  • criticalPatchedCVSS 9.9

    CVE-2023-36460Arbitrary file creation through media attachments

  • criticalPatchedCVSS 9.3

    CVE-2023-36459XSS through oEmbed preview cards

  • highPatchedCVSS 7.7

    CVE-2023-28853Blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

Mastodon Website

Website

Mastodon

The original server of Mastodon, operated by Mastodon GmbH for the common good.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address151.101.193.55
  • LocationSan Francisco,California,United States of America,NA
  • ISPFastly Inc.
  • ASNAS54113

Associated Countries

  • USUS

Safety Score

Website marked as safe

100%

Blacklist Check

mastodon.social was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Mastodon Docker

Container Info

mastodon

Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..

#Social

Run Command

docker run -d \

Compose File

version: 3.8

Mastodon Reviews

More Social Networks

View More...

About the Data: Mastodon

Edit Mastodon Data

You can edit Mastodon's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Mastodon Submit Edit to Mastodon Add alternative

API

You can access Mastodon's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/mastodon

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Mastodon

Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Mastodon and Awesome Privacy with your network!

← Previous

Discourse

View Social Networks (4)
Next →

nostr