Transmute: a self-hosted converter that trades format breadth for a clean API
Self hosted file converter and compression tool for images, video, audio, json, excel and more. Supports over 3,000 conversions!
At a glance
- What is it?
- Transmute is an MIT-licensed Python and React application that converts and compresses files on hardware you control, ships as a Docker Compose stack, and exposes an OpenAPI-documented REST API. It is worth adopting if you need unattended batch conversions on a trusted network, and the wrong tool if you are looking for a hardened public-facing service.
- Who is it for?
- Adopt Transmute if you want unattended, scripted conversions on a LAN or behind a VPN, and you are willing to install and pin the underlying codecs yourself. Do not adopt it as a public file-drop service: the README explicitly warns against WAN exposure and tells you to add a TLS reverse proxy with rate limiting if you do it anyway.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 3 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem Transmute targets: conversion without a third party in the loop
Anyone who has needed to turn a folder of MOV files into MP4, or a batch of XLSX sheets into JSON, has met the same wall. Desktop tools handle one format family each. Web converters accept the file, process it on someone else's machine, and hand back a download. Transmute takes the third option: the whole pipeline runs on a server you own. The README states the goal plainly, that files are processed on your own server and never sent to third parties, and the feature list repeats it under privacy first. The intended user is not a casual desktop user. It is someone with a machine that stays on, a need to convert files repeatedly, and a reason not to upload them: internal documents, patient or client media, anything under a data handling policy. Transmute also targets automation. The README advertises a REST API documented with OpenAPI, plus built-in user accounts, role-based access, and API keys, which together describe a service meant to be called by scripts and other systems rather than clicked through by hand.
What the stack actually is: FastAPI, React, and codec binaries you supply
The repository topics name the pieces: Python, FastAPI, React, Vite, Docker. That maps to a backend API server and a separate browser front end, packaged so that one compose command brings both up. The README says the app listens on port 3313, and that the API documentation is served at http://TRANSMUTE_IP:3313/api/docs once the app is running, which is the standard FastAPI docs route. Beyond that, the README does not describe the conversion engine, and I will not guess at it. What is visible is the shape of the data flow: a file arrives through the web UI or the API, a job is created, and the result is offered back. The screenshots confirm this vocabulary. There is a Workspace view, an Uploaded Files view, a Previously Converted view, and a Settings view, so jobs and their outputs are tracked rather than converted in a single fire-and-forget request. That job model is what makes the API usable for batches. It also means state lives somewhere on disk, and the README does not say where, which is the first thing to check in the compose file before you deploy, because that volume is what you will need to back up and size.
Getting it running: one wget, one compose command, port 3313
The quickstart is two steps. The README gives this exact command: wget "https://raw.githubusercontent.com/transmute-app/transmute/refs/heads/main/docker-compose.yml" && docker compose up -d. Then you visit localhost:3313. There is also a Run on PikaPods button for people who would rather not run the host themselves, and a Docker image published under the name neonvariant/transmute, which is the image referenced by the size badge in the README. Configuration beyond the defaults is not documented in the README itself. It points to a Getting Started guide at transmute.sh/docs/getting-started/ and, for single sign-on, to transmute.sh/docs/oidc/, which the README says covers providers such as Authentik. So the honest summary of setup is: the deployment is genuinely one command, but the settings that matter for a real installation (storage location, database, OIDC client credentials, API keys) live in the compose file and the docs site, not in the README. Read the compose file before you run it. That file is also where you will learn which codec binaries ship in the image, which determines whether your particular conversion pair works out of the box or needs extra packages.
The trusted-network warning is the most important line in the README
Transmute ships authentication, per-user data isolation, and API keys. It also carries a warning box that says to think carefully before exposing it to the public internet, that it is designed for trusted networks, and that if you expose it beyond your LAN you should put it behind a reverse proxy with TLS and rate limiting. Take that at face value. A self-hosted converter is an unusually attractive target because it accepts arbitrary uploaded files and passes them to media processing libraries, a category with a long history of parsing bugs. The maintainers are telling you they have not hardened it for hostile input at internet scale. The practical reading: run it on a LAN, or reach it over a VPN, or put it behind an authenticating reverse proxy that you also maintain. If your use case requires anonymous public uploads, this is the wrong tool, and no amount of authentication configuration changes that. A second limitation is breadth. The project describes over 3,000 conversions and 100+ formats, but the README defers the authoritative list to transmute.sh/conversions. Format counts on a marketing page and format counts that actually work on your build are different numbers. Check the specific pairs you need before you plan around it.
How it compares with ConvertX and Vert.sh
The README includes a comparison table naming CloudConvert, FreeConvert, Convertio, Vert.sh, and ConvertX, and it is unusually candid, noting that Transmute is not up to par with any of them yet. That candour is useful, because the meaningful comparison is with the two self-hosted entries. Vert.sh and ConvertX are both listed as having no size limits and being private, and both are marked as lacking a free API. Transmute is marked as having all three. So the actual difference in approach is not the conversion itself, which in all three cases depends on the same underlying codec tools, but the interface around it. ConvertX is a web front end for conversions you trigger yourself. Transmute adds accounts, roles, API keys, and an OpenAPI-documented endpoint, which is what you need if a build pipeline or another service is going to submit jobs. If your requirement is a browser page where a person drops a file, ConvertX is the simpler fit and has less surface to secure. If your requirement is a script that converts a directory every night, the API is the reason to pick Transmute, and the authentication model is the reason it needs more care in deployment.
Maintenance, licensing, and what a version bump costs you
Transmute is MIT licensed, which permits commercial use and modification with the usual requirement to keep the licence notice, but this is not legal advice and you should read the LICENSE file in the repository yourself. The release cadence visible in the material is active: v1.3.0 in early June 2026, v1.3.1 about ten days later, v2.0.0 at the end of June, and a push to main in September 2026. A major version bump that soon after a patch release is a signal to read the release notes before upgrading rather than pulling the latest image on a schedule. The maintenance cost that matters here is not the application, it is the codecs. Image, video, and audio conversion depends on external binaries, and those binaries are where security fixes land. Updating the Transmute image without updating the codecs underneath leaves you running old parsers. The project also states that it is human-led and maintainer-reviewed, and that fully AI-generated or agent-submitted contributions are not accepted. That is a deliberate choice with a cost: review capacity is limited by the number of humans involved, so feature requests and format additions may move slower than a project that accepts automated patches. Whether that trade is good depends on how much you value reviewed code in a service that parses untrusted files.
Who should run Transmute, and what to check first
Run it if you have a machine that is always on, a recurring conversion or compression job, and a policy or a preference that keeps the files off third-party servers. The API and the job history make it a reasonable fit for a small internal service, and the OIDC support means you can put it behind the same identity provider you already use for everything else. Do not run it if you need a public upload endpoint, if you want a desktop application, or if you need a guarantee that a specific obscure format pair works without testing it yourself. Three things to verify before you commit. First, open the compose file and find where converted files and job records are stored, then confirm that volume is on storage you are backing up. Second, open transmute.sh/conversions and confirm your actual conversion pairs are listed, not the headline count. Third, if you plan to expose it beyond your LAN, decide now what reverse proxy and rate limiting you will put in front of port 3313, because the README's warning is a deployment instruction, not a formality.
Editorial conclusion
Adopt Transmute if you want unattended, scripted conversions on a LAN or behind a VPN, and you are willing to install and pin the underlying codecs yourself. Do not adopt it as a public file-drop service: the README explicitly warns against WAN exposure and tells you to add a TLS reverse proxy with rate limiting if you do it anyway. Before committing, check the conversion matrix at transmute.sh/conversions for the exact pairs you need, read the OIDC page if you plan to use Authentik, and confirm from the compose file which codec binaries the image actually bundles.
Community notes