Mastodon

mastodon.social
Awesome Privacy ➔ Social ➔ Social Networks ➔ Mastodon
Mastodon

An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.

Avoid

  • facebook
  • twitter
  • instagram
  • linkedin
  • snapchat

Also Consider

Open Source

Mastodon Privacy Policy

Privacy Policy Summary

  • The user is informed about security practices
  • The service can delete your account without prior notice
  • This service is only available to users of a certain age
  • The service provides two factor authentification for your account
  • User logs are deleted after a finite period of time
  • You have the right to leave this service at any time
  • There is a date of the last update of the agreements
  • Your personal data is not sold
  • The service allows you to use pseudonyms
  • Private messages can be read
  • This service collects your IP address, which can be used to view your approximate location
  • The posting of untagged pornographic content is prohibited
  • This service offers a symbolic but nonbinding statement about a matter of opinion, ethics, society, or politics
  • You shall not interfere with another person's enjoyment of the service
  • You agree not to submit libelous, harassing or threatening content
  • Terms may be changed any time at their discretion, without notice to you
  • Details are provided about what kind of information they collect
  • This service gives your personal data to third parties involved in its operation
  • The publishing of personally identifiable information without the owner’s consent is not allowed
  • The service is open-source
  • You are prohibited from sending chain letters, junk mail, spam or any unsolicited messages
  • This service reserves the right to disclose your personal information without notifying you

Score

C

Documents

Domains Covered by Policy

  • mastodon.social
  • joinmastodon.org
  • mastodon.online
  • mastodon.cloud

About the Data

This data is kindly provided by tosdr.org. Read full report at: #639

Mastodon Source Code

Author

mastodon

Description

Your self-hosted, globally interconnected microblogging community

#activity-stream#activitypub#docker#fediverse#mastodon#microblog#social-network#social-web#webfinger

Homepage

https://joinmastodon.org

License

AGPL-3.0

Created

22 Feb 16

Last Updated

12 Jul 26

Latest version

v4.6.3

Primary Language

Ruby

Size

395,868 KB

Stars

50,104

Forks

7,481

Watchers

50,104

Language Usage

Language Usage

Star History

Star History

Top Contributors

Recent Commits

  • Claire (10 Jul 26)

    Refactor `ActivityPub::ProcessAccountService` and `ActivityPub::FetchRemoteActorService` (#39783)

  • Sharlayan (10 Jul 26)

    Fix timeline unable to load more when the last item is a `inline-follow-suggestions` (#39773)

  • renovate[bot] (10 Jul 26)

    Update dependency lograge to v0.15.0 (#39759) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot] (10 Jul 26)

    Update opentelemetry-ruby (non-major) (#39758) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot] (10 Jul 26)

    Update dependency rubocop to v1.88.2 (#39752) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • Claire (10 Jul 26)

    Add support for ML-DSA-44 keys (#39747)

  • github-actions[bot] (10 Jul 26)

    New Crowdin Translations (automated) (#39779) Co-authored-by: GitHub Actions <[email protected]>

  • Claire (09 Jul 26)

    Change error message for missing Multibase value (#39760)

  • Claire (09 Jul 26)

    Add notifications for out-of-support versions of Mastodon (#39734)

  • Claire (09 Jul 26)

    Refactor outgoing HTTP Signature code as HTTP.rb feature/middleware (#39766)

  • github-actions[bot] (09 Jul 26)

    New Crowdin Translations (automated) (#39765) Co-authored-by: GitHub Actions <[email protected]>

  • renovate[bot] (09 Jul 26)

    Update dependency capybara-playwright-driver to v0.5.10 (#39723) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • Claire (08 Jul 26)

    Refactor Multibase error handling and clean up ObjectIntegrityProof (#39754)

  • Shlee (08 Jul 26)

    Update useOnClickOutside.ts to remove unrequired effect dependencies (#39751)

  • renovate[bot] (08 Jul 26)

    Update dependency haml_lint to v0.75.0 (#39739) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • github-actions[bot] (08 Jul 26)

    New Crowdin Translations (automated) (#39749) Co-authored-by: GitHub Actions <[email protected]>

  • diondiondion (07 Jul 26)

    Fix embedded videos restarting when interacting with post (or other posts in the same feed) (#39746)

  • Claire (07 Jul 26)

    Add end-of-support date to available updates (#39732)

  • Claire (07 Jul 26)

    Update ruby/setup-ruby to v1.316.0 (#39743)

  • Echo (07 Jul 26)

    Insert newly created post into account timelines (#39733)

  • Claire (07 Jul 26)

    Fix relative times (#39742)

  • Sam Ruby (07 Jul 26)

    Fix N+1 queries when rendering accounts on the admin collection page (#39738) Co-authored-by: Claude Fable 5 <[email protected]>

  • Sharlayan (07 Jul 26)

    fix inert state on active carousel slide (#39741)

  • renovate[bot] (07 Jul 26)

    Update dependency vite_rails to v3.11.1 (#39716) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Claire <[email protected]>

  • Claire (07 Jul 26)

    Refactor Multikey decoding and avoid OpenSSL calls (#39728)

  • github-actions[bot] (07 Jul 26)

    New Crowdin Translations (automated) (#39740) Co-authored-by: GitHub Actions <[email protected]>

  • renovate[bot] (07 Jul 26)

    Update github/codeql-action digest to 54f647b (#39722) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • renovate[bot] (07 Jul 26)

    Update dependency libvips to v8.18.4 (#39721) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

  • Echo (06 Jul 26)

    Refactor Status component (#39731)

  • Echo (06 Jul 26)

    Fix Status stories (#39730)

Mastodon Security

Security Advisories (50)

  • high Patched CVSS 7.5

    CVE-2026-50129 DoS via unhandled NoMethodError in MATH_TRANSFORMER

  • medium Patched CVSS 5.3

    CVE-2026-50128 Spoofing of attribution domains

  • high Patched CVSS 7.5

    CVE-2026-47777 Consent-check bypass in remote Collections

  • high Patched CVSS 8.6

    CVE-2026-47389 SSRF protection bypass on older Ruby versions (incomplete remediation for GHSA-xfrj-c749-jxxq)

  • high Patched

    CVE-2026-46348 SSRF Bypass via IPv6 Unspecified Address (::)

  • medium Patched CVSS 5.3

    CVE-2026-46349 LD-Signature Bypass via JSON-LD Named-Graph Restructuring

  • high Patched

    CVE-2026-41259 Insufficient verification of email addresses

  • medium Patched CVSS 4.8

    CVE-2026-33869 Denial of service for quote authorization

  • medium Patched CVSS 4.3

    CVE-2026-33868 GET-Based Open Redirect via '/web/%2F<domain>'

  • high Patched

    CVE-2026-27468 Allowing unconfirmed FASP to make subscriptions

  • low Patched

    GHSA-46w6-g98f-wxqm SSRF via unvalidated FASP Provider base_url

  • medium Patched CVSS 6.5

    CVE-2026-25540 Signature-dependent ActivityPub collection responses cached under signature-independent keys

  • medium Patched CVSS 5.3

    CVE-2026-23961 Remote suspension bypass

  • medium Patched CVSS 6.5

    CVE-2026-23964 Insufficient access control to push notification settings

  • high Patched CVSS 7.5

    CVE-2026-23962 Denial of Service from a single post (client/server)

  • high Patched

    CVE-2026-22245 SSRF Protection bypass

  • medium Patched CVSS 6.5

    CVE-2026-22246 Local users can enumerate and access severed relationships of every other local user

  • low Patched CVSS 3.7

    CVE-2025-67500 Inconsistent error handling allows anonymously checking existence of known private posts

  • medium Patched CVSS 4.3

    CVE-2025-62605 Quotes control bypass

  • medium Patched CVSS 4.3

    CVE-2025-62176 Streaming server allows OAuth clients without the `read` scope to subscribe to public channels

  • low Patched CVSS 3.5

    CVE-2025-62174 Changing a user's password via CLI does not revoke sessions & access tokens

  • medium Patched CVSS 4.3

    CVE-2025-62175 Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards

  • medium Patched CVSS 5.3

    CVE-2025-54879 Mastodon confirmation e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

  • low Patched

    GHSA-x2rc-v5wx-g3m5 Lack of sanitization of user-facing URLs for remote objects can lead to XSS in misconfigured servers

  • medium Patched CVSS 5.3

    CVE-2025-27157 Missing rate-limit on sign-up email verification

  • medium Patched CVSS 5.3

    CVE-2025-27399 Domain blocks & rationales ignore user approval when visibility set as "users"

  • low Patched

    GHSA-mq2m-hr29-8gqf OEmbed embeds allow <embed> tag (blocked by CSP)

  • medium Patched CVSS 4.3

    CVE-2026-23963 Missing length limits on list names, filter names, and filter keywords

  • medium Patched CVSS 5.3

    GHSA-5wxh-3p65-r4g6 Partial Denial of Service due to insufficient validation of remote actors

  • medium Patched CVSS 5.3

    GHSA-3m9q-ww7w-qc5j Subdomains allow spoofing of accounts in search results

  • high Patched CVSS 7.5

    GHSA-jpxp-r43f-rhvx Potential Polynomial regular expression used on uncontrolled data

  • medium Patched CVSS 5.3

    GHSA-58x8-3qxw-6hm7 Insufficient permission checking on multiple API endpoints

  • high Patched CVSS 8.2

    CVE-2024-37903 Improper authorship check on audience extension for existing posts

  • low Patched CVSS 2.6

    GHSA-vp5r-5pgw-jwqx Streaming continues to send events for a user after access token is revoked

  • low Patched

    GHSA-5fq7-3p3j-9vrf Private mention filtering can be bypassed

  • medium Patched CVSS 5.9

    GHSA-q3rg-xx5v-4mxh Missing rate-limit to password change endpoint

  • medium Patched CVSS 6.5

    CVE-2026-48028 Removal of integrity-protected JSON entries from signed activities

  • medium Patched CVSS 4.8

    CVE-2023-49952 Bypassing rate limiting with X-Forwarded-For header

  • high Patched CVSS 8.5

    CVE-2024-25623 Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

  • critical Patched CVSS 9.4

    CVE-2024-23832 Remote user impersonation and takeover

  • low Patched CVSS 3.1

    CVE-2024-25619 Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed

  • medium Patched

    CVE-2024-25618 External OpenID Connect Account Takeover by E-Mail Change

  • high Patched CVSS 8.3

    CVE-2023-42452 Stored XSS through the translation feature

  • medium Patched CVSS 5.4

    CVE-2023-42450 Server-side request forgery

  • high Patched CVSS 7.7

    CVE-2023-42451 Invalid domain name normalization

  • medium Patched CVSS 5.4

    CVE-2023-36462 Verified profile links can be formatted in a misleading way

  • high Patched CVSS 7.5

    CVE-2023-36461 Denial of Service through slow HTTP responses

  • critical Patched CVSS 9.9

    CVE-2023-36460 Arbitrary file creation through media attachments

  • critical Patched CVSS 9.3

    CVE-2023-36459 XSS through oEmbed preview cards

  • high Patched CVSS 7.7

    CVE-2023-28853 Blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

Mastodon Website

Website

Mastodon

The original server of Mastodon, operated by Mastodon GmbH for the common good.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address 151.101.1.55
  • Location San Francisco, California, United States of America, NA
  • ISP Fastly Inc.
  • ASN AS54113

Associated Countries

  • US US

Safety Score

Website marked as safe

100%

Blacklist Check

mastodon.social was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report at web-check.xyz

Mastodon Docker

Container Info

mastodon

Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..

#Social

Run Command

docker run -d \

Compose File

version: 3.8

Mastodon Reviews

More Social Networks

View More...

About the Data: Mastodon

API

You can access Mastodon's data programmatically via our API. Simply make a GET request to: 

https://api.awesome-privacy.xyz/v1/services/mastodon

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Mastodon

Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Mastodon and Awesome Privacy with your network!

← Previous

Discourse
View Social Networks (4)
Next →

nostr