This review covers the grocy/grocy repository as it stood in the 9 August 2026 snapshot, using the repository metadata, README, release notes, and issue tracker as evidence. It is a source and documentation review: no local installation, test, or benchmark was performed.

the short answer

Grocy is a reasonable choice if you want a self-hosted household stock, shopping list, meal planning, and chores tool with your own data and a real REST API, and you are comfortable running and updating a PHP application. It is a weak fit if you need business-grade guarantees: as of the snapshot there is no two-factor authentication, no built-in push or email notifications, no import/export workflow, and no roadmap, and the maintainers describe the project as a hobby project. Before relying on it, plan for PHP 8.5 and SQLite 3.40+, change the default admin credentials, and set up backups outside the application.

key facts at a glance

what grocy actually is

Grocy is described in the repository as “ERP beyond your fridge”: a web-based, self-hosted groceries and household management solution. The README and release notes cover stock tracking, shopping lists, meal plans, chores, tasks, recipes, userfields, and price history, a household-focused feature set rather than a general business ERP.

What makes it more than a shopping list app is the integration surface. The README states that the web frontend uses the REST API for almost everything, with an integrated Swagger UI at /api, so actions available in the interface are also available programmatically. Barcode workflows include USB scanner support, camera scanning through ZXing (client-side processing that the maintainers say requires HTTPS), and an external barcode lookup workflow with a built-in Open Food Facts plugin and a commented plugin example for custom lookups. The frontend is a responsive, installable PWA, explicitly without offline capabilities. Localization is English by default, German is maintained by the author, community translations at 70% completion are included in releases, and RTL languages are not supported.

who should consider grocy

Consider Grocy if you want stock, shopping list, meal plan, and chores in one self-hosted place, want the data on your own hardware, and are willing to operate a PHP web application. Technically comfortable users get the most out of it, especially if you plan to drive it through the API or integrate it with other systems. The README also references Grocy Desktop, a Windows packaging that runs without a managed webserver, and the v4.4.2 release notes mention a community Home Assistant add-on.

For a small business the case is weaker. Grocy’s own description and topics target the home, the README identifies it as a hobby project, and features that matter for shared or commercial use, such as 2FA, notifications, and import/export, are open feature requests rather than shipped functionality.

deployment and update concerns

The v4.6.0 release notes state that PHP 8.5 with SQLite 3.40+ is now the only supported runtime. If you are evaluating Grocy on an existing server, that is a hard constraint: older PHP versions are out, and the README lists required extensions (fileinfo, pdo_sqlite, gd, ctype, intl, zlib, mbstring) plus recent Firefox, Chrome, or Edge for the frontend. Installation per the README: unpack the release, copy config-dist.php to data/config.php, make the data directory writable, point the webserver root at public, and configure nginx try_files or disable URL rewriting. The default login is admin/admin, which the maintainers instruct you to change immediately.

Docker is available through the community linuxserver/grocy image on Docker Hub, which the README links instead of an official image. Updates are file replacement: overwrite everything while keeping the data directory, and check config-dist.php for new settings. On Linux, update.sh creates a .tgz backup in data/backups, but the README says backups older than 60 days are deleted during updates, so this is convenience, not a backup strategy. Database migrations run automatically when the version changes; the maintainers state migrations are supported between releases, not between every commit, so running the master branch means handling migration and stability yourself.

Plan HTTPS if you deploy it: the README notes that camera barcode scanning only works over a secure connection because of browser restrictions. Demo and prerelease mode disable authentication, and embedded mode (used by Grocy Desktop) disables it as well, which is acceptable for a local single-user desktop setup, not for shared hosting.

maintenance signals

The main maintenance risk is governance rather than code activity. The README identifies Grocy as a hobby project by Bernd Bestel, says there is no roadmap, and explains that milestones only indicate in which version a request was completed, with vNEXT meaning it is planned for the next release. Support consists of the issue tracker and the r/grocy subreddit, which the maintainer says they check roughly daily, with no other support channel.

Release activity is steady but modest. v4.5.0 was published on 28 March 2025 and v4.6.0 on 6 March 2026, and the repository snapshot shows pushes as recent as 21 July 2026. At the snapshot there were 140 open issues and 791 forks. Several feature requests have been open for years: 2FA since June 2019, import/export since January 2019, and OCR receipt scanning since October 2019, which signals a project focused on core household workflows rather than rapid feature expansion.

limitations to check before you commit

At the snapshot, these items remain open feature requests in the issue tracker: two-factor authentication (#281), mail/Pushbullet/Telegram notifications (#156), CSV-style import/export for data portability (#129), OCR receipt scanning (#404), scraping recipes from websites (#210), right-to-left language support (#984), a formal inventory reconcile workflow (#1988), splitting stock entries (#1854), and cumulative missing amounts from multiple recipes on the shopping list (#840). The PWA is installable but explicitly has no offline capabilities.

Practical consequence: if you need 2FA, proactive notifications, bulk data import, receipt scanning, or RTL, the current release does not provide them. You would need community add-ons or custom development on top of the API, the barcode lookup plugin mechanism, and the custom JS/CSS hooks documented in the README.

alternatives and evaluation questions

Try it before deciding: the README links a public demo of the latest stable release at demo.grocy.info and a separate prerelease demo. The workflow question matters more than the feature list. Stock and shopping list tools only help if everyone actually records purchases and consumption. If you just need a shared shopping list, a spreadsheet or notes app may be cheaper; if you want automation and data ownership, Grocy’s API and self-hosting story are the differentiators.

Questions to answer before adoption: who will run updates in a year? Does your environment meet PHP 8.5 and SQLite 3.40+? Do you need 2FA, notifications, import/export, RTL, or offline mobile use? How will you back up the data directory if the app becomes important to you? Are you comfortable with the risk that a hobby project slows down or stops?

verdict

Grocy is a capable self-hosted household management application with a permissive MIT license, a real API, and a steady release history, but it is not a platform with guarantees. Choose it if you want local data ownership and accept hobby-project governance, roughly annual major releases, and missing enterprise features. Before depending on it, verify runtime requirements, change default credentials, serve it over HTTPS, and build an external backup routine; treat missing features as custom development or integration work, not roadmap items. What remains unverified in this review is behavior on your specific host and with your data; a pilot install with your own data is the right next step before committing.

sources

• grocy/grocy repository on GitHub
• Grocy v4.6.0 release notes
• Grocy website
• linuxserver/grocy on Docker Hub
• Open issue: two-factor authentication
• Open issue: import/export and backup

If you are evaluating a self-hosted tool like Grocy for a household or small operation, or you need help modernizing an older PHP stack, planning deployment and backups, or building the custom pieces the project leaves open, that is the kind of work I do at XP812. I can review your environment, prepare the upgrade or migration, and maintain the result. Get in touch if you want that support.