Beaver Habit Tracker
A self-hosted habit tracking app without goals. Simple, distraction-free, and privacy-focused.
Smart Download
Visit Project Homepage
No installer available yet — head to the source repository
A stress-free habit tracker without goals, self-hosted and privacy-first.
Core Features
- No goals or streaks pressure – just track daily actions
- Self-hosted via Docker, full control over data
- Cloud SaaS option available at beaverhabits.com
- Flexible storage: SQLite or JSON files
- REST API for automation and integrations
What It Can't Do
- •Ensure the container user UID matches the host folder owner to avoid permission issues. By default, no authentication is required; set TRUSTED_LOCAL_EMAIL or other env vars for security.
Use Cases
- Daily habit tracking (drink water, read, exercise)
- Integrate with smart home or macro keys for quick logging
- Ideal for users overwhelmed by rigid goal-based apps
- Share a habit board within a team or family via self-hosted instance
Detailed Introduction
Beaver Habit Tracker is a self-hosted habit tracking application designed to help you build routines without the pressure of goals. It offers a clean, minimal interface for daily check-ins, focusing on the process rather than outcomes. You can self-host via Docker or use the cloud SaaS version. It supports multiple storage backends (SQLite or JSON file), provides a REST API, and integrates with Stream Deck, Apple Shortcuts, Home Assistant, and more. Inspired by Loop Habit Tracker, Beaver improves on simplicity and extensibility.
Troubleshooting & FAQ (2)
TroubleshootingHow to protect against stored XSS via custom CSS in BeaverHabits?
A stored XSS vulnerability (CVE pending) in BeaverHabits v0.9.0 allowed injecting </style><script> payloads into the custom CSS setting, breaking out of the <style> block and exfiltrating API tokens. While it is a self‑XSS requiring authenticated access, it still posed a risk. The fix (PR #207) introduces a sanitize_css() helper that strips all HTML tags before saving CSS. To apply: update to a version containing that PR or implement a tag‑stripping regex (e.g., re.search(r'<[^>]+>', css)) before saving the custom CSS input.
TroubleshootingHow to fix the password reset account takeover vulnerability in Beaverhabits when the token secret is empty?
The password reset token secret defaults to an empty string in Beaverhabits v0.9.0, allowing attackers to forge reset tokens if they know a user’s UUID. To fix, set the environment variable RESET_PASSWORD_TOKEN_SECRET to a strong, random value (never empty) before starting the application. For Docker, add it to your docker-compose.yml: environment: - RESET_PASSWORD_TOKEN_SECRET=your_strong_secret_here. Validate that it is set on startup to prevent misconfiguration. This workaround blocks the exploit; a future release should enforce non‑empty secrets at startup. See GitHub issue #204 for details.
Tags
Getting Started
Download installer
Click the button above to download the installer for your system
Install the software
Double-click the downloaded installer and follow the prompts
Run with Docker: docker run -d --name beaverhabits -p 8080:8080 daya0576/beaverhabits:latest
Open http://localhost:8080 in browser and start tracking
Mount a volume for persistence: -v ./beaver/:/app/.user/
- Run with Docker: docker run -d --name beaverhabits -p 8080:8080 daya0576/beaverhabits:latest
- Open http://localhost:8080 in browser and start tracking
- Mount a volume for persistence: -v ./beaver/:/app/.user/
Checksum not available
This project has not published a SHA-256 checksum on its GitHub Release page
SHA256 Checksum
No checksum available
Download directly from GitHub Releases and verify file integrity yourself
All SHA-256 checksums on this platform are extracted from the project's official GitHub Release page, without any modification. You can independently verify them on the GitHub Releases page.
Open Source Transparency
View GitHub SourceUninstall Info
Stop and remove container: docker stop beaverhabits && docker rm beaverhabits. Delete the mounted directory if you want to remove all data.
No Extra Dependencies
Ready to use after download. No additional runtime required.
Having issues? Check the FAQ below
2 FAQs