HotCRP: A flexible but demanding conference review system

What HotCRP actually solves

HotCRP manages the full lifecycle of a conference review process: paper submission, review assignment, comment management, rebuttals, and PC meetings. The README states that its main strengths are flexibility and ease of use for reviewers, especially through smart paper search and tagging. This targets academic conferences in computer science and internal review processes at large companies. If you are a program chair or a review coordinator who needs to handle hundreds of submissions with custom review forms, bidding, and discussion phases, HotCRP is designed for that exact workload. It is not a generic project management tool; it is a domain-specific system for peer review.

Architecture and data flow

HotCRP is a PHP application that runs behind a web server, typically Nginx or Apache, and uses MariaDB as its database. The README describes a flow where all accesses to the site path are handled by a single entry point, index.php. Static files under images, scripts, and stylesheets can be served directly, but all dynamic content goes through PHP. The database schema is defined in src/schema.sql, and the configuration lives in conf/options.php, which is created from etc/distoptions.php. The application also includes an OpenAPI specification and a command-line interface called Hotcrapi, which allows API access for automation. This architecture is conventional for PHP applications, but the reliance on a single index.php means the web server must be configured carefully to route all requests correctly, especially if the site is installed at the root path.

Getting it running: commands and config keys

Installation starts with lib/createdb.sh, which creates the database. You can pass options like --user and --password, and the script may require sudo because creating tables often needs privileges. After that, you edit conf/options.php, which is annotated. The README gives concrete examples for Nginx and Apache. For Nginx, use fastcgi_pass to 127.0.0.1:9000 and set SCRIPT_FILENAME to the index.php path. For Apache, use a ProxyPass with fcgi://localhost:9000. You also need to set PHP values: upload_max_filesize (15M is a good default), post_max_size (20M), and max_input_vars (4096). The session.gc_maxlifetime must be set globally in /etc/php.ini to 86400, and you can override the actual timeout via $Opt["sessionLifetime"] in conf/options.php. Finally, edit MariaDB's my.cnf to set max_allowed_packet=32M, because the default of 1M is too small for papers. These are concrete, mandatory steps, not suggestions.

Where the setup gets painful

The README is honest about several failure points. The first account created on the site automatically gets system administrator privilege, so the initial sign-in is a security-critical moment. The database credentials are stored in conf/options.php, which is marked world-unreadable by default; if your PHP cannot read that file, the application will not work. The session.gc_maxlifetime cannot be set per-site, so you need access to the global php.ini, which may not be available on shared hosting. Also, the web server configuration for a root-path installation is tricky: the README warns that you may need to turn off default handlers for subdirectories like /doc. These are not deal-breakers for a dedicated server, but they rule out simple shared hosting and require a competent sysadmin.

Limitations and wrong-tool cases

HotCRP is not a lightweight tool. It requires PHP 8.1 or higher, MariaDB, and a mail transport agent like Postfix or Sendmail. If your conference is small, or you need a quick setup without server tuning, HotCRP is overkill. The README also notes that some features may require later PHP versions, so a minimal PHP 8.1 install might not support everything. Another limitation is that format checking requires Poppler's pdftohtml, which is listed as only required for format checking, but if you need that feature, you must install it separately. The system is designed for academic review workflows; if you need a general-purpose document review tool, the tagging and search features are tailored to paper submissions, not generic documents. Also, the README does not mention any built-in migration path from other systems, so switching to HotCRP likely means manual data import.

Maintenance and upgrade considerations

The README does not provide explicit upgrade instructions or a release history, which is a gap. The repository has no recent releases listed, and the last push date is unknown, so you cannot rely on a stable release cadence. That means you will likely run from the master branch, which carries its own risk. The development manual is mentioned for advanced configuration and internals, so there is documentation for those who need to modify the code. The license is listed as NOASSERTION, which is unusual and means you should inspect the license file yourself before deploying. The configuration is centralized in conf/options.php, which is good for maintenance, but any upgrade that changes the schema or the options format could require manual merging. Plan for a review of the changelog and a test migration before upgrading a production instance.

A real alternative: hosted hotcrp.com

The most direct alternative is hotcrp.com, the hosted version of the same software. The README states that if you want to run HotCRP without setting up your own server, use hotcrp.com. The difference is operational: the hosted service handles the database, web server, mail, and upgrades for you. You lose control over the server configuration, but you gain a managed environment that avoids the installation steps described above. For a conference that runs once a year, the hosted option may be simpler. However, if you need to integrate with internal infrastructure, or you require custom PHP extensions or server-level tweaks, self-hosting gives you that flexibility. The choice is not between HotCRP and a different product; it is between running the same code yourself or paying for the service.

Editorial conclusion

Adopt HotCRP if you run an academic conference or an internal review process that needs flexible workflows, tagging, and smart paper search, and you have a Unix server with PHP 8.1+, MariaDB, and a mail transport agent. Do not adopt it if you want a hosted solution, a quick install, or a system that works without manual server tuning. Before you commit, verify that your PHP build includes MySQL support, php-intl, and php-fpm, that MariaDB's max_allowed_packet is at least as large as your largest paper, and that you can run lib/createdb.sh with sufficient privileges. Also confirm you can edit global PHP settings like session.gc_maxlifetime, since that cannot be changed per-site. If those prerequisites are met, HotCRP's flexibility and reviewer-focused features justify the setup effort; otherwise choose a hosted service or a simpler tool.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository