FeedZero
A privacy-first RSS reader that runs entirely in your browser. No accounts, no tracking, no analytics — your reading habits stay yours.
- Subscribes to RSS, Atom, and JSON Feed sources
- Stores all data encrypted in your browser (AES-GCM-256)
- Optionally syncs across devices with end-to-end encryption
- Extracts full article text when feeds provide only summaries
- Works offline after first load
Use it
Hosted — open my.feedzero.app. Nothing to install.
Run your own — one Docker command:
docker run -p 3000:3000 -v feedzero:/data ghcr.io/forcingfx/feedzero:latest
Open http://localhost:3000. Data persists in the feedzero volume; the image is on GitHub Packages.
Run it on a server with your own domain and automatic HTTPS — see Self-hosting (a Compose stack with Caddy, three commands).
Either self-host path unlocks every Personal feature for free.
Privacy Model
FeedZero minimizes server-side data exposure:
| Component | What the server sees |
|---|
| Feed fetching | Feed URLs (required for CORS proxy) |
| Cloud sync | Encrypted blob + vault ID (cannot decrypt without your passphrase) |
| Everything else | Nothing — parsing, storage, and rendering happen in-browser |
No telemetry. No analytics. No crash reporting. No third-party tracking.
For the full threat model, cryptographic details, and honest limitations, see docs/architecture.md.
Trust Considerations
The CORS proxy is a trust point. It must see feed URLs to fetch them. If you don't trust the hosted version, run your own — the entire stack is one binary.
Usage
Adding Feeds
Paste any URL into the "Add feed" input:
- Direct feed URL:
https://example.com/feed.xml
- Website URL: FeedZero will discover the feed automatically
Keyboard Navigation
| Key | Action |
|---|
j / k | Next / previous item |
Enter | Open selected item |
Escape | Go back |
Cloud Sync (Optional)
- Open Settings → Data & Storage
- Enable cloud sync
- Save your 4-word passphrase — it's the only way to access your data
Your passphrase never leaves your browser. The server stores only encrypted blobs.
OPML Import/Export
- Import: Settings → Import OPML → select file
- Export: Settings → Export OPML → downloads your feed list
Development
npm install # install dependencies
npm run dev # dev server at http://localhost:3000
npm test # Unit/integration tests (Vitest)
npm run test:watch # Watch mode
npm run test:coverage # Coverage report (90% threshold)
npm run test:e2e # E2E tests (Playwright)
npx tsc --noEmit # Type check
Project Structure
src/
├── core/ # Framework-agnostic business logic
│ ├── feeds/ # Feed fetching, parsing, refresh
│ ├── parser/ # RSS/Atom/JSON Feed parsing
│ ├── storage/ # IndexedDB + encryption
│ ├── sync/ # E2E encrypted cloud sync
│ └── extractor/ # Full-text extraction
├── stores/ # Zustand state management
├── components/ # React UI components
└── pages/ # Route components
See docs/architecture.md for detailed architecture documentation.
Tech Stack
- UI: React 19, TypeScript, Tailwind CSS v4
- State: Zustand
- Storage: Dexie.js (IndexedDB), Web Crypto API
- Parsing: Custom RSS/Atom/JSON Feed parser
- Sanitization: DOMPurify
- Extraction: Defuddle
- Testing: Vitest, Playwright, React Testing Library
Sustainability commitment
FeedZero is built as a sustainable business, not a venture-funded runway. The category around us has gotten brutal — Pocket shut down November 2025, Omnivore November 2024, Tiny Tiny RSS's original maintainer retired the project the same month, Artifact closed January 2024. Each of those services took user data with them.
The structural commitments that keep FeedZero around:
- No external runway to outrun. No VC, no board demanding hockey-stick growth. We grow at the pace the work supports.
- No data we cannot lose. The server holds opaque encrypted blobs. There is nothing here to sell, sublicense, or accidentally leak — see docs/vault-format.md for the format.
- Lossless exit at all times. OPML import/export round-trips, the vault format is publicly documented, and the entire server runs as a single Hono binary you can self-host. If FeedZero ever shuts down, your data leaves with you.
- Open source. The privacy claims and the code that delivers them are auditable today.
- Focused. We are great at one thing: fetching feeds reliably and presenting them in a reader that's a pleasure to use. We decline features that would distract from that, even when the market is asking for them — see docs/strategy/003-playing-to-win.md.
If you're migrating from a product that just shut down, you're welcome here. We'll still be here when the next one does.
Security
Found a vulnerability? See SECURITY.md for reporting guidelines.
Contributing
See CONTRIBUTING.md for development workflow and guidelines.
License
AGPL-3.0-or-later. See LICENSE for the full text.
If you run a modified version of FeedZero as a public-facing service,
section 13 of the AGPL requires you to offer your users access to the
source of that modified version. The default deployment satisfies this
out of the box because the source is already public — for any fork, host
the diff somewhere your users can reach.
