Kimai

Open-source time tracking, honestly reviewed. No marketing fluff, just what you get when you self-host it.

TL;DR

• What it is: Open-source (AGPL-3.0) time tracking application — think Toggl or Harvest, but running on your own server with no per-seat pricing [2].
• Who it’s for: Freelancers, agencies, and small-to-medium companies who need billable hours, invoicing, and reporting without paying $8–20 per user per month to SaaS vendors. Also non-technical teams — the UI is deliberately simple [3][4].
• Cost savings: Toggl Track starts at $9/user/month (billed annually); Harvest runs $12/user/month. A 10-person team on Harvest pays $1,440/year. Self-hosted Kimai runs on a $6–10/mo VPS with unlimited users [2].
• Key strength: Genuinely mature software — started in 2006, actively maintained ever since. Users report running the same installation for 5, 10, even 16 years without problems [3]. Clean UI, solid invoicing, LDAP/SAML auth out of the box.
• Key weakness: AGPL-3.0 license (not MIT) restricts commercial embedding. Single-developer project — Kevin Papst from Vienna runs the whole thing. Support for free self-hosted installs goes through GitHub, not email [1][2].

---

What is Kimai

Kimai is a web-based time tracker. You open a browser, start a timer against a project and activity, stop it when you’re done. At the end of the month you run a report, generate an invoice, export a CSV. That’s the core loop — and it’s been doing this since 2006.

The original version was built by Torsten Höltge. Kevin Papst took over maintenance in 2009 when the original author wanted to stop, rewrote it from scratch starting in 2018, and has been developing it as his full-time job since 2023 [2]. That history matters: this isn’t a VC-backed startup that discovered time tracking last year. The project has survived two decades of software churn because the underlying use case is durable and the maintainer is committed [2].

As of this review, Kimai sits at 4,566 GitHub stars — modest by modern standards, but consistent with a project whose user base is businesses, not developers building side projects for street cred. The GitHub description calls it “the #1 open-source time-tracking application,” which is a strong claim with no independent ranking to back it up, but the review page does show consistent, multi-year testimonials from real companies [3][4].

The software is licensed under AGPL-3.0. Self-hosting is free. A managed cloud version (kimai.cloud) exists with paid plans for teams that don’t want to run their own server [2].

---

Why People Choose It

The recurring themes across user reviews break down into three clusters: data sovereignty, cost, and longevity.

Data sovereignty. A TYPO3 agency that switched from Toggl cited “open source, data sovereignty, and full control over the software” as the deciding factors [3]. A German NGO appreciated that a small social services organization could use professional-grade time tracking software at no cost [3]. A freelance system engineer specifically mentioned the API: he uses it to automatically start and stop timers when arriving at and leaving client premises [3]. The “built in Austria, hosted in Germany, GDPR-compliant” angle is real positioning — several users in the reviews explicitly called out the European origins [website].

Cost. One user at Armin Bittner’s company has run Kimai for 16 years — first as a local installation, then in the cloud version — and describes it as running without problems or interruptions [3]. The CodeWeavers case is the most concrete comparison: they “spent a great deal of energy comparing timesheet solutions, from proprietary to open source,” found none matched Kimai’s combination of functionality and simplicity, and then hired Kevin directly to customize it for their specific needs — still paying less than they’d budgeted for a proprietary solution [4].

Longevity. This is the least obvious but probably most important factor for businesses. A user in IT consulting calls out that Kimai “has always been there” and that free software costing real money to create is worth supporting [3]. The fact that Kevin turned this from a hobby into his full-time job in 2023 is a positive signal for future maintenance, but it also means the entire project depends on one person.

---

Features

Based on the README, website, and user descriptions:

Core time tracking:

• Timer-based and punch-in/punch-out entry [README]
• Multi-timer support (run multiple timers simultaneously) [README]
• Tagging, activity categorization, project/customer hierarchy [README]
• User/customer/project-specific billing rates [README]
• Time and money budgets per project [README]
• Advanced search and filtering across timesheets [README]

Reporting and invoicing:

• Reports sliced by user, customer, project, activity, tag, and time period [website]
• Invoice generation directly from timesheets in browser [2]
• Configurable invoice templates, entry grouping, custom invoice numbers [website]
• Export in PDF, DOCX, CSV, and other formats [website]
• Yearly, monthly, daily summaries on demand [website]

Authentication and security:

• LDAP and SAML login across multiple providers (Google Workspace, Azure AD, Authentik) [website]
• Two-factor authentication via TOTP tokens [website][README]
• Customizable role and team permissions [README]
• Team-based data access control — assign customers and projects to teams [website]

Developer and integration:

• Extensive JSON API for reading and writing data [website]
• Plugin architecture with documented extension points [README][4]
• Paid and free plugin marketplace at kimai.org/store/ [README]
• Multi-language support — 30+ languages via Weblate [README]
• Responsive design — works on mobile browsers [2]

What’s not in the community self-hosted version: The website lists several features under the Cloud SaaS pitch that aren’t clearly available in the self-hosted free tier: custom fields, task planning, expense management, audit trail logs, and working hours/vacation/sickness tracking. The lines between self-hosted community features and paid cloud features aren’t cleanly documented on the main website — you’d need to check the actual documentation to confirm what ships in the open-source build vs. what’s cloud-only.

---

Pricing: SaaS vs Self-Hosted Math

Kimai Cloud (their managed SaaS): The About page notes Kimai Cloud launched in 2020 as subscription-based SaaS with “one free and two paid plans” [2]. Specific tier pricing is not published on the pages scraped for this review — check kimai.cloud directly before making decisions.

Self-hosted (AGPL-3.0, free):

• Software: $0
• VPS to run it: $6–15/month (Hetzner, Contabo, DigitalOcean)
• Your time to set up and maintain it

Toggl Track for comparison:

• Free: up to 5 users, basic tracking only
• Starter: $9/user/month (billed annually)
• Premium: $18/user/month

Harvest:

• Free: 1 user, 2 projects
• Pro: $12/user/month (unlimited everything)

Concrete math for a 10-person agency:

At 10 users on Harvest Pro: $120/month → $1,440/year. At 10 users on Toggl Starter: $90/month → $1,080/year. Self-hosted Kimai on a $10 Hetzner VPS: $120/year for unlimited users.

The savings compound as you add users: Kimai’s self-hosted cost is flat (the VPS), while every SaaS competitor charges per seat. At 20 users, Harvest runs $2,880/year vs. Kimai’s same $120. One user in the reviews runs Kimai for ~40 employees [4] — at Harvest rates that would be $5,760/year in tool cost alone.

The catch: these numbers assume you already know how to set up a PHP/MySQL server. If you don’t, factor in a one-time setup cost or ongoing technical maintenance.

---

Deployment Reality Check

Kimai runs on PHP + MariaDB/MySQL + a webserver. That stack is older than Docker-native tools but it’s also extremely well-understood and cheap to run. The documented hosting paths include:

• Docker Compose with Caddy on Hetzner or DigitalOcean (official guides)
• SSH/Git/Composer install on a VPS
• Docker images (FPM-only or with Apache bundled)
• Synology NAS with Docker
• kimai.cloud managed hosting if you don’t want to self-host

What you actually need:

• A VPS with PHP 8.1.3+ and relevant extensions (gd, intl, json, mbstring, pdo, etc.)
• MariaDB 10.6+ or MySQL 8.4+
• A domain with a subdomain (subdirectory installs are not supported)
• A webserver (Caddy, nginx, or Apache)

What can go sideways: The PHP extension requirements are non-trivial if you’re on a shared host or a stripped-down VPS image. The “subdomain required, subdirectory not supported” constraint eliminates some cheap hosting configurations. The Docker path is cleaner but still requires understanding how to wire together containers, manage persistent volumes for the database, and handle SSL.

Support for free self-hosted installs is community-only — GitHub issues and discussions [1]. Email support and video calls are available only to paying Cloud customers or clients who hire Kevin directly for installation and update work. Installation runs 1–2 hours of Kevin’s time; updates are 30–60 minutes [1]. If you’re non-technical and hit a wall, the options are: search GitHub issues, pay for a support plan, or hire Kevin at published rates.

Realistic time estimate for a technical user comfortable with Docker: 1–2 hours to a working instance. For someone following a guide with no prior server experience: 4–8 hours including DNS setup and debugging PHP extension issues.

---

Pros and Cons

Pros

• Genuinely mature software. 20-year track record. Users report decades of uninterrupted operation [3]. Not a startup experiment.
• Unlimited users on self-hosted. No per-seat pricing ever. One VPS serves one user or 400 [4].
• Strong authentication options. LDAP and SAML (Google Workspace, Azure AD, Authentik) plus 2FA ship in the community build — this is enterprise-grade auth that competitors often put behind paid tiers [website][README].
• Invoicing built in. Not an afterthought — configurable templates, PDF/DOCX export, customizable invoice numbers. One user explicitly said it replaced a separate invoicing workflow [3].
• JSON API. Real API coverage for reading and writing data, enabling automation and integrations [website]. One freelancer automated timer starts/stops based on location via the API [3].
• Plugin ecosystem. Extension points are documented; paid and free plugins available at the official marketplace [README].
• European project, GDPR-focused. Built and hosted in the EU with explicit data protection commitments — meaningful for European businesses [website].
• Single committed maintainer. Kevin has built this for 15+ years and is now doing it full-time. Responses to support tickets described as fast and competent repeatedly [3].

Cons

• AGPL-3.0, not MIT. If you want to embed Kimai in your own commercial product or SaaS, AGPL requires you to open-source your application. This is a real constraint for agencies building client-facing tools [license].
• Single-developer project. Kevin is the project. Bus factor of one. If he stops, the project stops. This is the main long-term risk for anyone betting their business operations on it [2].
• PHP stack. Not a Docker-native application at heart — it’s a PHP/Symfony app that can run in Docker. This means more setup complexity than tools built around a single container. PHP extension requirements can cause unexpected friction [README].
• Community-only support for free installs. No email support unless you pay. For non-technical users, this is a meaningful barrier [1].
• Cloud pricing not publicly listed. Hard to compare without digging into kimai.cloud directly.
• Feature boundary between free self-hosted and paid cloud is unclear. The website mixes features without clearly labeling which tier they apply to.
• “#1 open-source time tracker” claim. 4,566 GitHub stars is respectable but not dominant. Clockify (also free, SaaS) has millions of users; TimeCamp and others have larger user bases by some metrics. The claim is unverified [README].

---

Who Should Use This / Who Shouldn’t

Use Kimai if:

• You’re an agency or freelancer with 5+ users paying $10–15/seat/month on Toggl or Harvest, and you want that bill to go away permanently.
• You need LDAP or SAML login for your team — Kimai includes this where most competitors charge extra.
• You’re a European business for whom GDPR compliance and EU-hosted data aren’t optional.
• You want invoicing and time tracking in one tool, not two separate subscriptions.
• You have someone (an internal dev, a contractor, an IT person) who can set up a Docker/PHP environment once.

Skip it (stay on Toggl/Harvest/Clockify) if:

• You have no one to handle server setup and maintenance. The free self-hosted path requires technical competence, and paid support isn’t available on the free tier [1].
• You need vendor SLAs, enterprise support contracts, or SOC 2 compliance documentation — Kimai doesn’t publish these for the self-hosted version.
• You need native mobile apps. Kimai runs in a mobile browser but doesn’t have dedicated iOS/Android apps.

Skip it (pick something else) if:

• You want to embed time tracking into your own commercial SaaS — AGPL-3.0 will require open-sourcing your application unless you negotiate a commercial license with Kevin.
• Your team lives in Slack/Notion and needs native integrations — Kimai’s API can connect to things, but it doesn’t have a pre-built Slack or Zapier integration out of the box.

---

Alternatives Worth Considering

• Clockify — free tier is genuinely generous (unlimited users, unlimited time tracking), hosted SaaS, no self-hosting required. Trade-off: closed source, you’re trusting them with your data.
• Toggl Track — the clean-UI benchmark in this space. Better mobile apps than Kimai. $9/user/month. Closed source, proprietary.
• Harvest — stronger project budgeting and QuickBooks integration than Kimai. $12/user/month. Closed source.
• TimeCamp — feature set overlaps with Kimai; has automatic time tracking via desktop app. Closed source.
• Traggo — simpler open-source time tracker (tag-based, not project-based). Lighter weight than Kimai but much fewer features.
• ActivityWatch — open-source automatic time tracking (tracks what apps you use), not manual timesheet logging. Different use case but sometimes compared.

For a freelancer or agency looking specifically for a self-hosted Toggl replacement with invoicing, Kimai has no direct open-source competitor. The realistic choice is: Kimai (self-hosted, free, complex setup) vs. Clockify (SaaS, free tier, zero setup, closed source).

---

Bottom Line

Kimai is exactly what it says it is: 20 years of time tracking software, maintained by one very committed developer, free to self-host with no per-seat pricing ever. The value proposition is clear for any team currently paying $10–15/user/month on Toggl or Harvest — the math flips decisively at 5+ users. The authentication story (LDAP, SAML, 2FA) is better than most commercial competitors at equivalent pricing. The invoicing is real and production-grade, not a demo feature.

The risks are also clear: single developer, community-only support for free installs, AGPL license, and a PHP stack that requires more setup than a simple Docker pull. None of these are dealbreakers if you have technical resources available. All of them are dealbreakers if you don’t.

For a non-technical founder who wants to escape recurring SaaS seat pricing and has someone to handle the one-time setup, Kimai is one of the most pragmatic self-hosted tools in the productivity stack. If the setup is the blocker, that’s the kind of deployment upready.dev handles for clients — one-time, done, you own the infrastructure.

---

Sources

1. Support — Kimai (kimai.org support page). https://www.kimai.org/en/support.html
2. About Kimai — project history, maintainer background, Cloud launch. https://www.kimai.org/en/about.html
3. Reviews — Kimai — user testimonials collected on the Kimai site. https://www.kimai.org/en/reviews
4. Open Source — Kimai — community commitments and user quotes. https://www.kimai.org/en/open-source-community

Primary sources:

• GitHub repository: https://github.com/kevinpapst/kimai2 (4,566 stars, AGPL-3.0)
• Official website: https://www.kimai.org
• Plugin marketplace: https://www.kimai.org/store/
• Documentation: https://www.kimai.org/documentation/