Version 2.1.0 · stable

TaskFlowA modern, full-stack task manager built for focus.

An open-source task manager you run yourself. Tasks with priorities, due dates and tags, file attachments kept in your own PostgreSQL database, six export formats, and a control panel that changes the site without a redeploy.

Create a free account Read the source

Open source
MIT licensed
Self-hosted

An illustration of the TaskFlow task list, drawn with the application’s own task-row styles. It shows three example tasks: one in progress at high priority with a due date and two attachments, one overdue at urgent priority, and one completed. The tasks are made up for this illustration.

Tasks

A task that carries its own context

Every task holds a title, an optional description, a status of to do, in progress or done, one of four priorities, an optional due date, free-form tags and a position you set by hand. The list narrows on all of those at once, including a plain “only what is overdue”, and sorts by newest, due date, priority, title or your own order.

Filter state lives in the query string rather than in component state, which is a decision rather than a shortcut. The server renders the first page from exactly the parameters the browser is about to ask for again, so a shared link arrives with its rows already drawn instead of flashing an unfiltered list and then correcting itself. It also means every view you build is a URL you can bookmark, pin or send to someone.

Four priorities and three statuses, each labelled in words as well as colour, so neither depends on you being able to tell orange from red
Overdue, due today, completed this week, completion rate and current streak, all computed from your own history and none of them a guess
Multi-select for bulk changes, and duplicate on any task for the work that repeats

Attachments

Files that stay in your own database

Attachments are stored as bytes in PostgreSQL, in the same database and the same backup as the task they belong to. There is no object store to provision, no bucket policy to get wrong and no signed URL to expire at an inconvenient moment. Deleting a task deletes its files with it, because the foreign key cascades rather than leaving orphans for a cleanup job to find months later.

Every upload is checked twice: against an allowlist of content types (an allowlist, not a blocklist) and then against the file’s actual leading bytes, so renaming a script to photo.png does not get it through the door. The contents are hashed with SHA-256 and that digest is served as the ETag, so a browser re-downloads a file only when it has genuinely changed. SVG uploads are served as downloads rather than rendered, because an SVG can carry script.

1 MB per file by default, and 5 MB for administrators
10 files per task and 25 MB per account to start with, and every one of those numbers is editable from the control panel
Image dimensions are recorded at upload, so the interface can size a placeholder before the file is decoded

Exports

Six formats, driven by the filter you already set

Any view of your tasks leaves as a typeset A4 PDF, CSV, XLSX, JSON, Markdown or ICS. The PDF is a real report rather than a print stylesheet: a letterhead carrying your site name, the summary figures, and a paginated table whose “page 2 of 7” footers are stamped only after the last row is placed, because until then nobody knows what the total is.

The export endpoint extends the task list’s own filter schema instead of restating it. The two therefore cannot drift apart about what a filter means, and anything added to the list becomes exportable without someone remembering to mirror it. Paging parameters are dropped on the way through: an export is always the whole matching set, never the twenty rows you happened to be looking at.

ICS turns your due dates into calendar events, so they land in the calendar you already use
PDF through PDFKit and XLSX through a spreadsheet writer, so there is no headless browser to install, run or keep alive
The whole feature sits behind a flag, so an operator who does not want it can switch it off

Security

Security you can read for yourself

Passwords are hashed with Argon2id at the OWASP baseline (19 MiB of memory, two passes) rather than with bcrypt, because Argon2id is memory-hard and an attacker with a rack of GPUs gains far less from them. Signing in issues a short-lived access token together with an HttpOnly refresh cookie paired to a CSRF token, and the authentication endpoints are rate limited.

Two-factor authentication is TOTP, enrolled from a QR code and backed by ten single-use recovery codes; an operator can require every privileged account to enrol before it can use TaskFlow at all. You can see every session signed in as you, with the address and browser it came from, and end any one of them on its own. Personal API tokens are read-only by design (the only scopes that exist are tasks:read, stats:read and profile:read), and the server keeps a SHA-256 digest plus the first few characters, which is enough to recognise a token in a list and useless to whoever steals the table.

Every privileged action lands in an audit trail: who did it, what to, from which address, and when
Root and admin are genuinely different: the policy settings are root-only, so an administrator cannot lift the MFA requirement that constrains them
None of this has to be taken on trust. It is MIT licensed, and you can read the file that does it

Administration

Change the site without a redeploy

Site name, tagline, logos, colours and corner radius. Page titles, description, keywords, canonical URL and search-console verification. Footer links and social profiles. The full text of the privacy, terms and cookie policies. Feature flags, upload limits and storage quotas. All of it is edited in the browser, and all of it applies on the next request.

Each section is a single schema that supplies both the validation and the defaults, and that one definition is what makes adding a setting safe: a settings row written by an older version picks up the new field’s default instead of surfacing as undefined somewhere in the interface. Legal copy is authored in Markdown and turned into elements by a small parser that never injects raw HTML, so a policy containing something that looks like markup is displayed as text rather than executed.

Users, roles and suspensions, with a filterable audit log beside them
First-party analytics: page views only, Do Not Track honoured, your own traffic excludable, and raw events deleted on a retention window you choose
Maintenance mode answers everyone except root with a 503, which is exactly what you want in the middle of a migration

How it works

Three steps, and then you are working

No onboarding tour to sit through, no integrations to authorise, no sample project to delete before you can start.

Create your account
An email address and a password is the whole of it. There is nothing to connect and no workspace to configure first. Turning on two-factor authentication from your security page takes about a minute, and you should.
Capture the work
Add tasks with a priority, a due date, tags and any files that belong with them. Reorder by hand when the plan changes, because it will, and narrow the list to whatever you actually need to look at right now.
Finish it, then prove it
Your completion rate and current streak are counted as you go. When somebody asks for the record, export exactly the view you are looking at as a PDF, a spreadsheet, JSON, Markdown or a calendar file.

The specifics

Numbers you can go and check

Defaults taken from the source, not figures written for a landing page. Each one is either a constant in the code or a value you can change yourself.

1 MB
Attachment limit
Per file, out of the box. Administrators get 5 MB. Both numbers, and the 25 MB per-account quota, are editable from the control panel.
6
Export formats
PDF, CSV, XLSX, JSON, Markdown and ICS, all produced from whatever filter is on the list at the time.
TOTP
Multi-factor auth
Standard authenticator codes, ten single-use recovery codes, and a session list you can revoke from one entry at a time.
First-party
Analytics
Page views counted by this installation and nothing else. No third-party script, no cross-site identifier, and Do Not Track is honoured.
PostgreSQL
The only datastore
Tasks, files, sessions, settings and audit records all live in one database. No Redis, no object store, no queue to keep running.
MIT
Licence
Read it, run it, fork it, change it. Commercial use included. There is no paid tier above this one, because there is no tier.

Start with a single task

TaskFlow is free, open source and yours to host. There is no trial to start and nothing to cancel. The only thing you are committing to is writing down the first thing you have to do.