Rooms, boxes and belongings in one tree
Homebox keeps a record of what a household owns. Each item carries photos, a location, a purchase price, warranty details, receipts and a maintenance log. Since version 0.26, items and locations are both "entities" in the same data model, so a room or a storage box gets its own photos and custom fields and can hold other entities. The server is written in Go and the interface in Nuxt; everything runs in one container on SQLite by default, and the README puts that container's idle memory under 50 MB.
Printable QR labels and maintenance alerts
- QR labels: every item and location has a QR code, and a label generator lays out printable sheets. The scanner's "AR" mode, which the maintainers describe as an experiment, overlays the contents of whatever box the camera is pointed at.
- Forgiving search: on SQLite,
cafematches "café" with no setup, quotes match an exact phrase, and#000-001opens an item by its asset ID. Meilisearch can be plugged in for typo tolerance. - Maintenance reminders: due dates go out through Shoutrrr to ntfy, Gotify, Matrix, Telegram, SMTP email or a generic webhook.
- Several collections per instance: separate inventories on one install, which can be shared with family or roommates. OIDC login (Authentik, Keycloak, Authelia and others) can limit access to specific groups.
Finding a box in the basement or pricing an insurance claim
- Putting a figure on an insurance claim: items can be flagged as insured, with the purchase price and receipt attached, and each room's page shows the total value of what it holds.
- Labeling every moving or basement box, then scanning the label to see what is inside.
- Moving off a spreadsheet with the CSV import, then feeding other tools through the REST API with an
hb_key that carries its creator's permissions.
A 0.x continuation that refuses to boot without a secret
The repository picks up an archived project. sysadminsmedia/homebox describes itself as the continuation of hay-kot's HomeBox; the original repository has had no push since June 2024.
The target is a household. The docs rule out Snipe-IT, describing it as enterprise asset management for hundreds of IT devices that takes too long to configure for home use. SQLite covers small installs; for larger ones the docs recommend PostgreSQL, which lets Homebox scale horizontally.
A 32-byte secret is required before first boot. Since 0.26, Homebox refuses to start when HBOX_AUTH_API_KEY_PEPPER is shorter than 32 bytes, and changing it invalidates every API key already issued. The placeholder on the install page, some_random_string, is only 18 bytes; the README generates its value with openssl rand -base64 48.
Docker is the recommended path. Binaries ship for Linux, macOS, FreeBSD and Windows, yet the team only validates Linux: it has no Mac to test on and lists known issues on Windows, which is why the docs recommend Docker for production. Since 0.27.0, notifications to localhost are blocked by default, so an ntfy server on the same machine has to be addressed by its LAN IP unless HBOX_NOTIFIER_BLOCK_LOCALHOST is set to false.
The latest release is 0.27.1, from October 23, 2026. Versions 0.25, 0.26 and 0.27 came out in April, June and October 2026, each after a release candidate. Version 0.26 replaced the /v1/items and /v1/locations API routes with /v1/entities, and 0.27.0 fixed fifteen security advisories. Exporting a whole collection as a ZIP is still labeled experimental. The code is licensed under AGPL-3.0.