Wealthfolio: a local-first portfolio tracker on SQLite and SQLCipher, with brokerage sync as a paid extra

Your database stays on the device, and brokerage sync costs money

Wealthfolio keeps all data locally on your device: there is no cloud database, no account is required, and the app is free. That design has a direct consequence for how data gets in. Manual tracking and CSV import are free forever, but automatic brokerage syncing is not part of the free app. It comes through Wealthfolio Connect, an optional subscription that syncs 30+ institutions read-only and adds encrypted multi-device sync, with the fee described as covering the real cost of the brokerage data connections. If you hold accounts at several brokers and do not want to pay, plan on exporting CSV files from each of them and importing on a schedule, or recording trades by hand. The required fields for every activity type are listed in docs/activities/activity-types.md, which is the file to read before preparing an import. Keeping an accurate history is therefore your job unless you subscribe, and a missed import shows up as wrong holdings and wrong returns.

SQLCipher is always compiled in, but encryption is opt-in

Under the hood Wealthfolio stores data in SQLite through Diesel and rusqlite, and the Cargo workspace enables SQLCipher on the shared libsqlite3-sys crate, so both query layers can be encrypted. SQLCipher is always compiled in; with no key applied it behaves as plain SQLite and opens plaintext databases unchanged. That gives the project a single build configuration to test, and it means encryption is something you turn on rather than something you get by default. The app offers optional database encryption, an app lock and separate profiles. On the server, the WF_DB_REQUIRE_ENCRYPTION variable makes encryption a startup requirement, and the compose file warns that existing databases must be converted offline before you enable it. Flip that switch on an existing plaintext database without converting first and the server will refuse to start. Credential storage across native backends, server encryption, Android backup and recovery has its own architecture document in docs/architecture/credential-storage.md.

The Docker server refuses to be open without a password hash

Self-hosting runs through Docker Compose. The production compose file uses the wealthfolio/wealthfolio:latest image, publishes port 8088, stores data in a named volume at /data, and is started with:

docker compose --env-file .env.docker up -d

A reverse proxy overlay is applied by adding compose.proxy.yml:

docker compose --env-file .env.docker -f compose.yml -f compose.proxy.yml up -d

WF_SECRET_KEY is required, and the file shows how to generate one:

openssl rand -base64 32

WF_SECRET_KEY_FILE is the alternative when you mount a secret separately. Authentication is required when listening on 0.0.0.0, which is the Docker default, and takes an Argon2id PHC hash of your password. The trap is the dollar sign. Docker Compose interpolates $ in .env files and YAML, and an Argon2id hash is full of them. In a .env file you either wrap the hash in single quotes or double every $; inline in YAML you double every $. Get this wrong and the stored hash is mangled, so your password stops matching. WF_DB_PATH defaults to /data/wealthfolio.db, and the image tag is latest, so pin a version if you want updates to be deliberate.

Connect support is baked into the web bundle at build time

The Dockerfile builds the frontend in a Node 24 Alpine stage and the server in a Rust 1.98.1 Alpine stage, cross-compiling with the tonistiigi/xx tooling. Wealthfolio Connect configuration is passed as the build arguments CONNECT_AUTH_URL and CONNECT_AUTH_PUBLISHABLE_KEY and is baked into the JavaScript bundle at build time. Omit them and the image is built without Connect. The consequence for anyone building their own image from source is that brokerage sync cannot be switched on later through an environment variable; it has to be decided when the image is built. The frontend stage also builds only the main app, not the workspace addons, so addons are not bundled into the image. Building locally requires perl in the build environment because the vendored OpenSSL that SQLCipher links against needs it, a detail that matters if you adapt the Dockerfile to a different base image.

Returns, cost basis and the rest of the ledger

Portfolio tracking spans multiple accounts and asset types, including options and short positions. Performance analytics report true time-weighted and money-weighted returns, benchmark comparison and historical analysis, and you choose the cost basis method from FIFO, weighted average, LIFO and HIFO. The choice changes realized gains, so pick the method that matches how you report before importing years of history. Beyond investments, net worth covers liabilities, loans and mortgages, and alternative assets such as real estate and vehicles. Spending and budgets categorize transactions with rules and track budgets. Goals and planning cover save-up goals and retirement or FIRE simulations, and rebalancing takes allocation targets and produces a plan to reach them. Multiple currencies are supported with exchange rate management, and the interface comes in 11 languages, including right-to-left Arabic, with regional number and currency formats. The Rust workspace treats correctness strictly: unsafe code is denied except for FFI calls that allow it locally with a reason, and unwrap and panic raise warnings in production code.

Addons run in a sandbox and have already had a breaking migration

Wealthfolio has an addon system with a TypeScript SDK, type safety and hot reload. Addons can add pages, navigation items and components, listen to portfolio updates, market sync and user actions, read accounts, holdings, activities and market data, and keep API keys in secrets storage. Access is governed by a permission system that asks for user consent, and addons can package images, fonts, media, configuration and Wasm for an isolated sandbox. Full data access is the point to weigh: an addon you approve can read your holdings and activities, so the consent prompt deserves attention. Addon authors should also note the v3.6 to v3.7 migration guide, which covers packaged assets and compatibility; the addon interface has changed within the 3.x line, and an addon written for one minor version is not guaranteed to work on the next. The AI assistant is separate from addons: it answers questions and imports CSV files with a local model or your own API key, and agents such as Claude, ChatGPT or Cursor can connect through MCP.

Platform floors tied to the system web view

Wealthfolio runs on Windows, macOS and Linux desktops, on iOS and Android, and as a self-hosted Docker web app. It requires macOS 12 or newer, iOS or iPadOS 16 or newer, or Android 7.0 or newer. The desktop app uses the system web view, which creates a quieter requirement: on macOS 12 you need current macOS and Safari updates so the system WKWebView meets the Safari 16 browser floor. An unpatched macOS 12 machine meets the version number but not the web view floor. Windows uses the evergreen WebView2 runtime, and Linux and self-hosted installs should keep WebKitGTK or the browser up to date. Desktop builds come from the download page on wealthfolio.app, mobile apps from the App Store and Google Play, and the Docker route is documented in the self-hosting guide on the same site.

AGPL-3.0, a CLA, and a release every week or two

Wealthfolio is licensed under AGPL-3.0, which extends copyleft to software offered over a network, so running a modified version as a service for others carries source obligations that a desktop-only user never meets. Contributions go through a contributor license agreement in CLA.md, and TRADEMARKS.md sits beside it, so forks should check the name rules before reusing the Wealthfolio branding. The project is under active development: the last push to main was on 2026-11-01, and recent releases arrived as v3.10.0 on 2026-10-14, v3.11.0 on 2026-10-23 and v3.12.0 on 2026-11-01. The repository is a pnpm workspace with apps/frontend and packages, plus a Cargo workspace with apps/tauri, apps/server and crates. Plans are tracked in ROADMAP.md.

Editorial conclusion

Wealthfolio fits an individual investor who wants performance analytics, net worth and budgets in one app without a cloud account, and who is content to enter activities by hand or by CSV, or to pay for Wealthfolio Connect for brokerage sync. It is a poor fit for someone who expects free automatic syncing, or who wants to expose a Docker instance without setting up a secret key, a password hash and encryption. Before committing, check your device against the platform floors, decide whether database encryption should be required from day one, and confirm that your brokers are among those Connect supports if you plan to pay for it.

Frequently asked questions

Official sources

1. License: AGPL-3.0
2. Project website
3. README
4. Releases
5. wealthfolio/wealthfolio on GitHub