Mastodon

Awesome Privacy➔ Social➔ Social Networks➔ Mastodon

An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.

Homepage:mastodon.social
GitHub:github.com/mastodon/mastodon
Privacy:mastodon.social/privacy-policy
Web info:web-check.xyz/check/mastodon.social

Open Source

Mastodon Privacy Policy

Privacy Policy Summary

The user is informed about security practices
The service can delete your account without prior notice
This service is only available to users of a certain age
The service provides two factor authentification for your account
User logs are deleted after a finite period of time
You have the right to leave this service at any time
There is a date of the last update of the agreements
Your personal data is not sold
The service allows you to use pseudonyms
Private messages can be read
This service collects your IP address, which can be used to view your approximate location
The posting of untagged pornographic content is prohibited
This service offers a symbolic but nonbinding statement about a matter of opinion, ethics, society, or politics
You shall not interfere with another person's enjoyment of the service
You agree not to submit libelous, harassing or threatening content
Terms may be changed any time at their discretion, without notice to you
Details are provided about what kind of information they collect
This service gives your personal data to third parties involved in its operation
The publishing of personally identifiable information without the owner’s consent is not allowed
The service is open-source
You are prohibited from sending chain letters, junk mail, spam or any unsolicited messages
This service reserves the right to disclose your personal information without notifying you

Score

Documents

Code of Conduct
Created 07 Aug 18, Last modified 5 years ago
Privacy Policy
Created 07 Aug 18, Last modified 6 months ago
Terms of Service
Created 09 Nov 19, Last modified 1 year ago

Domains Covered by Policy

mastodon.social
joinmastodon.org
mastodon.online
mastodon.cloud

About the Data

This data is kindly provided by tosdr.org. Read full report at: #639

Mastodon Source Code

Author

mastodon

Description

Your self-hosted, globally interconnected microblogging community

#activity-stream#activitypub#docker#fediverse#mastodon#microblog#social-network#social-web#webfinger

Homepage

https://joinmastodon.org

Repository

LicenseAGPL-3.0
Created22 Feb 16
Primary languageRuby
Size420,871 KB
Stars50,451
Forks7,523
Watchers50,451

Language Usage

Project Health

Last commit5 days ago
Open issues4,657
Latest releasev4.7.3

Top Contributors

Recent Commits

Pia B.(23 Oct 26)
add specs around handles, links and text formatting (#41239) Co-authored-by: Matt Jankowski <[email protected]>
Juan Hernández(23 Oct 26)
Add new Server Health admin page (#41282)
Juan Hernández(23 Oct 26)
New Admin::ServerCheck system to replace Admin::SystemCheck (#41101)
renovate[bot](23 Oct 26)
Update dependency aws-sdk-s3 to v1.234.0 (#41277) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Echo(23 Oct 26)
Improve Redux devtools experience (#41259)
github-actions[bot](23 Oct 26)
New Crowdin Translations (automated) (#41273) Co-authored-by: GitHub Actions <[email protected]>
Matt Jankowski(23 Oct 26)
Update `eps1lon/actions-label-merge-conflict` to v3.1.0 (#41265)
Matt Jankowski(23 Oct 26)
Use ruby version 4.0.8 (#41262)
renovate[bot](23 Oct 26)
Update dependency aws-sdk-core to v3.258.0 (#41268) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate[bot](23 Oct 26)
Update dependency kaminari to v1.3.0 (#41278) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Arnt Gulbrandsen(23 Oct 26)
Use UTS58 instead of Twitter-text. (#39150)
Pia B.(22 Oct 26)
add migration (#41264)
Echo(22 Oct 26)
Remove discovery area in settings (#41258)
Pia B.(22 Oct 26)
Add canned response filtered dropdown (#41092) Co-authored-by: David Roetzel <[email protected]>
Matt Jankowski(22 Oct 26)
Extractor spec prep for twitter text removal (#41240)
Echo(22 Oct 26)
Make header show pinned post badge without inserting components (#41256)
Pia B.(22 Oct 26)
add information about who handled an appeal (#41186)
Echo(22 Oct 26)
Fix partial attachment meta (#41255)
diondiondion(22 Oct 26)
Redesign: Fix auto-focused search field messing with scroll position (#41254)
diondiondion(22 Oct 26)
Redesign: Fix various text wrapping, i18n, and theming issues (#41253)
github-actions[bot](22 Oct 26)
New Crowdin Translations (automated) (#41248) Co-authored-by: GitHub Actions <[email protected]>
zunda(22 Oct 26)
Update excon to v1.8.0 (#41245)
diondiondion(21 Oct 26)
Fix superfluous scrollbars in media modal and search results page (#41237)
diondiondion(21 Oct 26)
Redesign: Move "Mark all as read" button out of notifications column menu (#41232)
Echo(21 Oct 26)
Composer: fix flex-basis making multi-line toolbars (#41231)
diondiondion(21 Oct 26)
Redesign: Move admin & moderator links into the main navigation (#41179)
diondiondion(21 Oct 26)
Make navigation scroll with the page in advanced UI (#41233)
Matt Jankowski(21 Oct 26)
Move `devDependencies` renovate config to bottom of rule list (#41236)
diondiondion(21 Oct 26)
Redesign: Display discovery/search column in advanced UI (#41185)
diondiondion(21 Oct 26)
Fix "Media only" toggle missing in Fediverse Feeds column header (#41222)

Mastodon Security

Security Advisories (57)

mediumPatchedCVSS 5.3
GHSA-vgm8-frgh-rh2vDenial of service in JSON-LD processing of pathologic activities
10 Sept 26
highPatchedCVSS 7.2
GHSA-62j4-hvj7-px3fDisabling a staff account does not remove its access to the admin API
02 Sept 26
highPatchedCVSS 7.4
GHSA-vx32-x96w-qq65Accounts provisioned by LDAP or SSO with two-factor enabled can be signed in to with any password
02 Sept 26
mediumPatched
CVE-2026-72916SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
27 Jul 26
highPatchedCVSS 7.5
CVE-2026-72915Personally-identifying information disclosure due to incorrect access control validation
27 Jul 26
highPatchedCVSS 7.5
CVE-2026-72914Denial of Service through insufficient authentification of statistics endpoints
27 Jul 26
highPatchedCVSS 7.4
CVE-2026-59825Unwanted deactivation of SSL/TLS certificate verification
16 Jul 26
highPatchedCVSS 7.5
CVE-2026-50129DoS via unhandled NoMethodError in MATH_TRANSFORMER
03 Jun 26
mediumPatchedCVSS 5.3
CVE-2026-50128Spoofing of attribution domains
03 Jun 26
highPatchedCVSS 7.5
CVE-2026-47777Consent-check bypass in remote Collections
20 May 26
highPatchedCVSS 8.6
CVE-2026-47389SSRF protection bypass on older Ruby versions (incomplete remediation for GHSA-xfrj-c749-jxxq)
20 May 26
highPatched
CVE-2026-46348SSRF Bypass via IPv6 Unspecified Address (::)
20 May 26
mediumPatchedCVSS 5.3
CVE-2026-46349LD-Signature Bypass via JSON-LD Named-Graph Restructuring
20 May 26
highPatched
CVE-2026-41259Insufficient verification of email addresses
15 Apr 26
mediumPatchedCVSS 4.8
CVE-2026-33869Denial of service for quote authorization
25 Mar 26
mediumPatchedCVSS 4.3
CVE-2026-33868GET-Based Open Redirect via '/web/%2F<domain>'
25 Mar 26
highPatched
CVE-2026-27468Allowing unconfirmed FASP to make subscriptions
24 Feb 26
lowPatched
GHSA-46w6-g98f-wxqmSSRF via unvalidated FASP Provider base_url
24 Feb 26
mediumPatchedCVSS 6.5
CVE-2026-25540Signature-dependent ActivityPub collection responses cached under signature-independent keys
03 Feb 26
mediumPatchedCVSS 5.3
CVE-2026-23961Remote suspension bypass
20 Jan 26
mediumPatchedCVSS 6.5
CVE-2026-23964Insufficient access control to push notification settings
20 Jan 26
highPatchedCVSS 7.5
CVE-2026-23962Denial of Service from a single post (client/server)
20 Jan 26
highPatched
CVE-2026-22245SSRF Protection bypass
07 Jan 26
mediumPatchedCVSS 6.5
CVE-2026-22246Local users can enumerate and access severed relationships of every other local user
07 Jan 26
lowPatchedCVSS 3.7
CVE-2025-67500Inconsistent error handling allows anonymously checking existence of known private posts
08 Dec 25
mediumPatchedCVSS 4.3
CVE-2025-62605Quotes control bypass
21 Oct 25
mediumPatchedCVSS 4.3
CVE-2025-62176Streaming server allows OAuth clients without the `read` scope to subscribe to public channels
13 Oct 25
lowPatchedCVSS 3.5
CVE-2025-62174Changing a user's password via CLI does not revoke sessions & access tokens
13 Oct 25
mediumPatchedCVSS 4.3
CVE-2025-62175Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards
13 Oct 25
mediumPatchedCVSS 5.3
CVE-2025-54879Mastodon confirmation e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
05 Aug 25
lowPatched
GHSA-x2rc-v5wx-g3m5Lack of sanitization of user-facing URLs for remote objects can lead to XSS in misconfigured servers
06 May 25
mediumPatchedCVSS 5.3
CVE-2025-27157Missing rate-limit on sign-up email verification
27 Feb 25
mediumPatchedCVSS 5.3
CVE-2025-27399Domain blocks & rationales ignore user approval when visibility set as "users"
27 Feb 25
lowPatched
GHSA-mq2m-hr29-8gqfOEmbed embeds allow <embed> tag (blocked by CSP)
27 Feb 25
mediumPatchedCVSS 4.3
CVE-2026-23963Missing length limits on list names, filter names, and filter keywords
20 Jan 26
mediumPatchedCVSS 5.3
GHSA-5wxh-3p65-r4g6Partial Denial of Service due to insufficient validation of remote actors
16 Jan 25
mediumPatchedCVSS 5.3
GHSA-3m9q-ww7w-qc5jSubdomains allow spoofing of accounts in search results
17 Sept 24
highPatchedCVSS 7.5
GHSA-jpxp-r43f-rhvxPotential Polynomial regular expression used on uncontrolled data
30 Sept 24
mediumPatchedCVSS 5.3
GHSA-58x8-3qxw-6hm7Insufficient permission checking on multiple API endpoints
04 Jul 24
highPatchedCVSS 8.2
CVE-2024-37903Improper authorship check on audience extension for existing posts
04 Jul 24
lowPatchedCVSS 2.6
GHSA-vp5r-5pgw-jwqxStreaming continues to send events for a user after access token is revoked
04 Jul 24
lowPatched
GHSA-5fq7-3p3j-9vrfPrivate mention filtering can be bypassed
30 May 24
mediumPatchedCVSS 5.9
GHSA-q3rg-xx5v-4mxhMissing rate-limit to password change endpoint
30 May 24
mediumPatchedCVSS 6.5
CVE-2026-48028Removal of integrity-protected JSON entries from signed activities
20 May 26
mediumPatchedCVSS 4.8
CVE-2023-49952Bypassing rate limiting with X-Forwarded-For header
30 May 24
highPatchedCVSS 8.5
CVE-2024-25623Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
17 Feb 24
criticalPatchedCVSS 9.4
CVE-2024-23832Remote user impersonation and takeover
01 Feb 24
lowPatchedCVSS 3.1
CVE-2024-25619Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed
14 Feb 24
mediumPatched
CVE-2024-25618External OpenID Connect Account Takeover by E-Mail Change
14 Feb 24
highPatchedCVSS 8.3
CVE-2023-42452Stored XSS through the translation feature
19 Sept 23
mediumPatchedCVSS 5.4
CVE-2023-42450Server-side request forgery
19 Sept 23
highPatchedCVSS 7.7
CVE-2023-42451Invalid domain name normalization
19 Sept 23
mediumPatchedCVSS 5.4
CVE-2023-36462Verified profile links can be formatted in a misleading way
06 Jul 23
highPatchedCVSS 7.5
CVE-2023-36461Denial of Service through slow HTTP responses
06 Jul 23
criticalPatchedCVSS 9.9
CVE-2023-36460Arbitrary file creation through media attachments
06 Jul 23
criticalPatchedCVSS 9.3
CVE-2023-36459XSS through oEmbed preview cards
06 Jul 23
highPatchedCVSS 7.7
CVE-2023-28853Blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
04 Apr 23

Mastodon Website

Website

Mastodon

The original server of Mastodon, operated by Mastodon GmbH for the common good.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

IP Address151.101.65.55
LocationSan Francisco,California,United States of America,NA
ISPFastly Inc.
ASNAS54113

Associated Countries

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

mastodon.social was found on 0 blacklists

AntiSocial Blacklist
Artists Against 419
Badbitcoin
Bambenek Consulting
CERT Polska
CoinBlockerLists
CRDF
CryptoScamDB
EtherAddressLookup
EtherScamDB
Fake Website Buster
MetaMask EthPhishing
NABP Not Recommended Sites
OpenPhish
PetScams
PhishFeed
PhishFort
Phishing.Database
PhishStats
PhishTank
Phishunt
RPiList Not Serious
Scam.Directory
SecureReload Phishing List
Spam404
StopGunScams
Suspicious Hosting IP
ThreatFox
ThreatLog
TweetFeed
URLhaus
ViriBack C2 Tracker

Website Preview

View full report atweb-check.xyz

Mastodon Docker

Container Info

Mastodon

[Mastodon](https://github.com/mastodon/mastodon/) is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..

#Social

View on DockerHub

linuxserver/mastodon:latest

Run Command

docker run -d \
  -p 80:80/tcp \
  -p 443:443/tcp \
  -p 9394:9394/tcp \
  -e PUID=${PUID} \
  -e PGID=${PGID} \
  -e TZ=${TZ} \
  -e LOCAL_DOMAIN=${LOCAL_DOMAIN} \
  -e REDIS_HOST=${REDIS_HOST} \
  -e REDIS_PORT=${REDIS_PORT} \
  -e DB_HOST=${DB_HOST} \
  -e DB_USER=${DB_USER} \
  -e DB_NAME=${DB_NAME} \
  -e DB_PASS=${DB_PASS} \
  -e DB_PORT=${DB_PORT} \
  -e ES_ENABLED=${ES_ENABLED} \
  -e ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY} \
  -e ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY} \
  -e ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT} \
  -e SECRET_KEY_BASE=${SECRET_KEY_BASE} \
  -e OTP_SECRET=${OTP_SECRET} \
  -e VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY} \
  -e VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY} \
  -e SMTP_SERVER=${SMTP_SERVER} \
  -e SMTP_PORT=${SMTP_PORT} \
  -e SMTP_LOGIN=${SMTP_LOGIN} \
  -e SMTP_PASSWORD=${SMTP_PASSWORD} \
  -e SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS} \
  -e S3_ENABLED=${S3_ENABLED} \
  -e WEB_DOMAIN=${WEB_DOMAIN} \
  -e ES_HOST=${ES_HOST} \
  -e ES_PORT=${ES_PORT} \
  -e ES_USER=${ES_USER} \
  -e ES_PASS=${ES_PASS} \
  -e S3_BUCKET=${S3_BUCKET} \
  -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
  -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
  -e S3_ALIAS_HOST=${S3_ALIAS_HOST} \
  -e SIDEKIQ_ONLY=${SIDEKIQ_ONLY} \
  -e SIDEKIQ_QUEUE=${SIDEKIQ_QUEUE} \
  -e SIDEKIQ_DEFAULT=${SIDEKIQ_DEFAULT} \
  -e SIDEKIQ_THREADS=${SIDEKIQ_THREADS} \
  -e DB_POOL=${DB_POOL} \
  -e NO_CHOWN=${NO_CHOWN} \
  -e MASTODON_PROMETHEUS_EXPORTER_ENABLED=${MASTODON_PROMETHEUS_EXPORTER_ENABLED} \
  -v /srv/lsio/mastodon/config:/config \
  --restart=unless-stopped \
  linuxserver/mastodon:latest

Compose File

version: 3.8
services:
  mastodon-container:
    image: "linuxserver/mastodon:latest"
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
      - "9394:9394/tcp"
    environment:
      PUID: 1000
      PGID: 1000
      TZ: Etc/UTC
      LOCAL_DOMAIN: example.com
      REDIS_HOST: redis
      REDIS_PORT: 6379
      DB_HOST: db
      DB_USER: mastodon
      DB_NAME: mastodon
      DB_PASS: mastodon
      DB_PORT: 5432
      ES_ENABLED: false
      ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: 
      ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: 
      ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: 
      SECRET_KEY_BASE: 
      OTP_SECRET: 
      VAPID_PRIVATE_KEY: 
      VAPID_PUBLIC_KEY: 
      SMTP_SERVER: mail.example.com
      SMTP_PORT: 25
      SMTP_LOGIN: 
      SMTP_PASSWORD: 
      SMTP_FROM_ADDRESS: [email protected]
      S3_ENABLED: false
      WEB_DOMAIN: mastodon.example.com
      ES_HOST: es
      ES_PORT: 9200
      ES_USER: elastic
      ES_PASS: elastic
      S3_BUCKET: 
      AWS_ACCESS_KEY_ID: 
      AWS_SECRET_ACCESS_KEY: 
      S3_ALIAS_HOST: 
      SIDEKIQ_ONLY: false
      SIDEKIQ_QUEUE: 
      SIDEKIQ_DEFAULT: false
      SIDEKIQ_THREADS: 5
      DB_POOL: 5
      NO_CHOWN: 
      MASTODON_PROMETHEUS_EXPORTER_ENABLED: 
    volumes:
      - "/srv/lsio/mastodon/config:/config"
    restart: unless-stopped

Environment Variables

Var NameDefault
PUID1000
PGID1000
TZEtc/UTC
LOCAL_DOMAINexample.com
REDIS_HOSTredis
REDIS_PORT6379
DB_HOSTdb
DB_USERmastodon
DB_NAMEmastodon
DB_PASSmastodon
DB_PORT5432
ES_ENABLEDfalse
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEYnull
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEYnull
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALTnull
SECRET_KEY_BASEnull
OTP_SECRETnull
VAPID_PRIVATE_KEYnull
VAPID_PUBLIC_KEYnull
SMTP_SERVERmail.example.com
SMTP_PORT25
SMTP_LOGINnull
SMTP_PASSWORDnull
SMTP_FROM_ADDRESS[email protected]
S3_ENABLEDfalse
WEB_DOMAINmastodon.example.com
ES_HOSTes
ES_PORT9200
ES_USERelastic
ES_PASSelastic
S3_BUCKETnull
AWS_ACCESS_KEY_IDnull
AWS_SECRET_ACCESS_KEYnull
S3_ALIAS_HOSTnull
SIDEKIQ_ONLYfalse
SIDEKIQ_QUEUEnull
SIDEKIQ_DEFAULTfalse
SIDEKIQ_THREADS5
DB_POOL5
NO_CHOWNnull
MASTODON_PROMETHEUS_EXPORTER_ENABLEDnull

Port List

80:80/tcp
443:443/tcp
9394:9394/tcp

Volume Mounting

Container PathHost Bind
/config/srv/lsio/mastodon/config

Mastodon Reviews

More Social Networks

Discourse
discourse.org
A fully open-source, self-hostable discussion platform usable as a mailing list, discussion forum, or long-form chat room.

Open Source discourse/discourse
View Discourse Report
Lemmy
join-lemmy.org
A federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.

Open Source LemmyNet/lemmy
View Lemmy Report
nostr
github.com/nostr-protocol/nostr
nostr stands for Notes and other stuff transmitted by relays. It is an open protocol, not merely a platform. This distinction enables truly censorship-resistant and global value-for-value publishing on the web. With the power to replace data-greedy applications like Twitter and Instagram, nostr offers a promising alternative for users seeking a more private and secure online experience without algorithmic manipulations. ".... I feel like I’m looking at the future." that is what Snowden wrote about nostr.

Open Source https://github.com/nostr-protocol
View nostr Report

About the Data: Mastodon

Edit Mastodon Data

You can edit Mastodon's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Mastodon Submit Edit to Mastodon Add alternative

API

You can access Mastodon's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/mastodon

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Mastodon

Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Mastodon and Awesome Privacy with your network!

← Previous

Discourse

View Social Networks (4)

nostr

Mastodon

Avoid

Also Consider

Mastodon Privacy Policy

Privacy Policy Summary

Score

Documents

Domains Covered by Policy

About the Data

Mastodon Source Code

Author

Description

Homepage

Repository

Language Usage

Project Health

Top Contributors

Recent Commits

Mastodon Security

Security Advisories (57)

Mastodon Website

Website

Redirects

Security Checks

Server Details

Associated Countries

Safety Score

Trackers

Blacklist Check

Website Preview

Mastodon Docker

Container Info

View on DockerHub

Run Command

Compose File

Environment Variables

Port List

Volume Mounting

Mastodon Reviews

More Social Networks

Discourse

Lemmy

nostr

About the Data: Mastodon

Edit Mastodon Data

Origin Data

Modify Data

API

Share Mastodon