Memos: A Self-Hosted, Local-First Notebook That Replaces Notion Without the Cloud

1. What Memos Actually Is

Memos is an open-source, self-hosted note-taking server that presents your thoughts as a reverse-chronological, Twitter-like timeline rather than a nested folder tree. You open it, type, and save. The note lands in a stream. You tag it later, search for it later, and never have to decide where it belongs before you write the first word. That single design decision is what separates it from Notion, Obsidian, and every other "knowledge management" tool that asks you to build a structure before you have anything to put in it. Under the hood, Memos is a Go backend paired with a React frontend that is compiled directly into the binary. The whole thing ships as one ~20MB Docker image, runs on a single container, and uses SQLite by default. There is no telemetry, no phone-home, no subscription, and no account tied to a vendor. The project carries an MIT license and, as of late 2026, sits at roughly 62,000 GitHub stars with hundreds of contributors. For someone building a self-hosted, data-sovereign toolkit, that combination — popular, permissively licensed, and trivially deployable — is exactly what you want under the hood. This article is a deep, honest look at running Memos on your own hardware. We will cover the architecture, the install, the cost, the limitations you must accept, and the precise answer to the question that matters most for a notes app: where does my data go?

2. Why Self-Host a Notes App at All

Notes are among the most sensitive personal data you can produce. They contain passwords you jotted down, health appointments, business ideas, private journaling, drafts of things you have not published, and the raw material of your thinking. Handing that stream to a venture-backed SaaS means a copy of your mind lives on servers you do not control, under a terms-of-service that can change, behind a subscription that can rise, and inside a company that can be acquired. Self-hosting flips the model. Your notes live on a machine you administer. The encryption, the backups, the access policy, and the retention period are all your decision. When the vendor pivots, you are unaffected. When the price goes up, you pay nothing extra. When a regulator or a subpoena comes knocking, the data is yours to protect or disclose according to your own judgment. Memos is a particularly good vehicle for this because it was built local-first from day one. It does not assume a cloud backend. It does not require an account with usememos.com. The hosted option exists only as a convenience; the canonical deployment is "run it yourself." For a privacy-conscious self-hoster, that intent matters more than any feature checklist.

3. The Philosophy: Inbox-First Thinking

Most note apps borrow from file systems. You create a notebook, then a section, then a page, then you write. Memos borrows from social feeds. Every memo is a timestamped entry. There is no required hierarchy. You write a thought, it is saved with the current time, and it appears at the top of your timeline. Tags are added inline with #tag syntax and indexed automatically. Later, you filter by tag, by date, or by full-text search. This "inbox-first" model solves a real problem: friction at capture time. The cost of deciding where a note goes is often higher than the value of the note itself, so thoughts die before they are recorded. Memos removes the decision. You can always organize later; you cannot recover a thought you never wrote. For daily journaling, meeting scratchpads, reading highlights, and quick captures, the timeline model is genuinely faster than folders. The trade-off is that Memos is not a substitute for a heavily structured knowledge base. If you need a wiki with transclusions, backlinks graphs, and deeply nested documentation, a different tool fits better. But for the 80% of notes that are really just "things I want to remember," the timeline is a relief.

4. Architecture Deep Dive

Memos is written in Go and targets Go 1.26 in its module file. The HTTP layer uses Echo, a mature Go web framework. The more interesting choice is the RPC layer: rather than plain REST or pure gRPC, Memos uses ConnectRPC backed by Protobuf definitions in a proto/ directory. This means a single endpoint can serve browser clients over HTTP and native gRPC clients without a translation layer, which is a strong long-term bet for API stability. For persistence, Memos supports three backends. SQLite uses modernc.org/sqlite, a pure-Go transpilation of the canonical SQLite C source with zero CGo dependency. That detail is the reason the binary is genuinely static and why the Docker image is tiny. MySQL and PostgreSQL are also supported via standard drivers for larger, multi-user deployments. The frontend is a React application built with pnpm and bundled into the Go binary at compile time. There is no separate frontend server and no CDN dependency at runtime. When you deploy the container, you deploy the entire app in one process. That simplicity is a feature: fewer moving parts, fewer things to misconfigure, fewer supply-chain surfaces.

5. The One-Command Install

The fastest way to try Memos is a single Docker command: `` docker run -d --name memos \ -p 5230:5230 \ -v ~/.memos:/var/opt/memos \ neosmemo/memos:stable ` Point your browser at http://localhost:5230, complete the setup wizard, and start writing. Your SQLite database lives inside the mounted volume at ~/.memos, so backing up is literally copying that directory. For many solo users, this is the entire production setup. It runs on a Raspberry Pi, a leftover mini-PC, or the smallest VPS tier alongside a dozen other containers. The default port is 5230. There is no required external database, no message broker, and no cache server. Resource usage at idle is around 50MB of RAM. That is the whole footprint. Compared to a Java or Node monolith that wants a gigabyte just to boot, Memos feels almost invisible on the host.

6. A Production Docker Compose

For anything you actually rely on, wrap it in Docker Compose so the configuration is reproducible and the container restarts after a reboot: ` services: memos: image: neosmemo/memos:stable restart: unless-stopped ports: - "5230:5230" volumes: - ./memos-data:/var/opt/memos ` Mount a named or bind volume for /var/opt/memos, and put a reverse proxy such as Traefik or Nginx Proxy Manager in front for HTTPS. If you expect more than a handful of users or want horizontal-ish scaling, switch the storage driver to PostgreSQL or MySQL with the --driver and --dsn flags. The SQLite default is perfect for individuals and families; the external databases are for teams who outgrow a single-writer file. Compose also makes backups boring, which is the highest praise you can give an ops setup. Copy the volume, snapshot the database, push to object storage on a cron — the data is a folder, not a proprietary blob.

7. Database Backends Compared

SQLite is the default and the right choice for solo and family use. It is a single file, it is fast at personal-note volumes, and it is trivially portable. The downside is write concurrency: SQLite handles many readers and one writer well, but a busy multi-user instance can hit lock contention. That is precisely why Memos offers MySQL and PostgreSQL. PostgreSQL is the most common upgrade path for self-hosters who already run it for other services. You point Memos at an existing database with a connection string and let the app create its schema. MySQL works similarly. Neither changes the user experience; they only change the ceiling on concurrent writers. For a household or a small team where writes are sporadic, SQLite is fine. For a company rolling Memos out to dozens of simultaneous editors, move to Postgres early. The key sovereignty point: regardless of backend, the data is a standard, well-understood database you control. There is no custom binary format, no encrypted-at-the-app-level vault you cannot read, and no cloud sync that holds your notes hostage.

8. The Timeline Model in Practice

Once you start using the timeline, certain habits emerge. Quick captures become frequent because they are cheap. Tags become a loose taxonomy that evolves instead of a rigid tree you must design upfront. Search becomes your primary navigation because the timeline is chronological, not spatial. Memos supports pinning important memos to the top, relations that link memos to each other, reactions, and attachments. The CodeMirror 6 editor renders Markdown inline — your raw syntax stays visible while headings, tags, and mentions are styled in place. There is no WYSIWYG mode switch to confuse the saved text. Full Markdown is supported: headings, fenced code blocks with syntax highlighting, tables, task lists, and blockquotes. For developers, the code-block support alone justifies the switch from a plain text file. For writers, the focus mode and formatting toolbar make longer notes comfortable. The point is that "quick capture" does not mean "trivial tool" — Memos scales up to real writing when you need it.

9. Tags, Search, and the Inbox Approach

Tags in Memos are written inline as #tagname anywhere in the memo body. There is no separate tagging UI to learn. The sidebar lists every tag with its memo count, and clicking a tag filters the timeline. Full-text search across all memos is fast because Go and SQLite handle personal-scale volumes without breaking a sweat. A useful pattern is the "inbox plus later review" workflow. Capture everything with minimal tagging. Once a week, review untagged memos (Memos even ships a filter recipe for finding them) and add structure only where it helps. This keeps capture frictionless while still letting the corpus become searchable and browsable over time. It is the same philosophy that makes a good to-do inbox work: lower the cost of intake, raise the quality of review.

10. Visibility: Private, Protected, Public

Every memo has an independent visibility setting: Private, Protected, or Public. Private means only you see it. Protected means other logged-in users on your instance see it. Public means anyone with the link sees it, served at a clean URL on your own domain. This per-memo model lets a single instance serve two purposes at once: a private journal and a public microblog, with no second tool. Many self-hosters run Memos as a personal public blog. A travel note set to Public shows up at memos.example.com/u/you; a private health note stays hidden. Because the visibility is per memo, you never have to split your life across accounts. The obvious caveat is human error: a memo you meant to keep private set to Public is live the moment you save. There is no "publish confirmation" dialog, so discipline matters when exposing Memos to the internet.

11. The Markdown Editor

Version 0.30.0 shipped a rebuilt editor on CodeMirror 6 in a "decorated source" mode. Your Markdown remains the source of truth and is never silently rewritten; formatting is applied as visual styling as you type. That matters because some editors convert your input into an internal AST and surprise you on export. Memos keeps your text clean and portable. The editor adds tag autocompletion, smarter list indentation, a focus mode, improved keyboard shortcuts, and a toggleable formatting toolbar. Longer notes get a scroll-aware outline in the memo detail view, with a property rail showing visibility, metadata, attachments, and relations. The detail page also remembers your scroll position when you navigate back to a feed, a small quality-of-life fix that adds up across hundreds of notes.

12. The Web Clipper

The headline feature of v0.30.0 is the Memos Web Clipper, a browser extension for Chromium and Firefox. It saves full pages, selected text, or images directly into Memos, converting links, lists, code blocks, and tables into Markdown automatically and uploading images as attachments. A review-and-edit step appears before anything is saved, so clips never land half-formatted. Crucially for self-hosters, the clipper can connect directly to your own instance URL using a personal access token. Your clipped content never has to touch usememos.com or any third-party relay. For anyone who previously kept a separate read-it-later or bookmarking service just to get web content into notes, this closes the gap entirely and keeps the data on your hardware.

13. REST API and Personal Access Tokens

Memos exposes a full REST API at /api/v1, authenticated with personal access tokens you generate in the UI. Every operation the web app performs — create, read, update, delete, search, tag — is available to scripts. This is what makes Memos scriptable rather than merely usable. You can write a cron job that appends a daily journal stub, a shell alias that pipes command output into a memo, or a small service that archives things on a schedule. Personal access tokens are scoped to the account that created them and can be revoked at any time. There is no OAuth dance required for personal use. For automation, you generate one token, store it in your environment, and call the API over HTTPS once your instance is behind a proxy. The API surface is stable because of the Protobuf-first design, so scripts you write today are unlikely to break on the next release.

14. MCP Integration and AI Agents

Memos now ships an MCP (Model Context Protocol) server, meaning AI assistants such as Claude or Gemini can be pointed at your instance and given tools to read, write, and search your notes through a standardized protocol. Instead of bolting AI on as a chat widget, Memos exposes its storage as a tool an agent can call. "Save this to my notes" or "search my memos for kubernetes" become first-class operations. Here is the data-sovereignty nuance worth stating plainly: when you connect an AI agent to your Memos, the agent reads your notes. If that agent is a cloud service, your notes leave your network at query time. The MCP server itself runs locally and exposes only what you configure, but the model on the other end may not be local. The sovereignty win is that Memos does not force this — you can run a local model, keep the agent on your LAN, and have AI over your notes with zero external exposure. The risk is that the convenience of a cloud model quietly erases the privacy you self-hosted for.

15. Webhooks and n8n Automation

Memos fires signed webhooks (HMAC-SHA256 via the Standard Webhooks spec) on memo events. That is a clean integration point for workflow tools. A common pattern: a new memo tagged #task creates a ticket in your issue tracker; a new Public memo pushes a summary to a newsletter; a new #receipt memo files the text into your accounting spreadsheet. Because the webhooks are signed, you can verify they actually came from your Memos instance before acting on them. Combined with a self-hosted automation tool, this turns Memos from a notebook into the capture layer of a larger personal infrastructure. The notes you take become triggers for the rest of your stack, all without a SaaS middleman.

16. Multi-User, Families, and Small Teams

A single Memos instance supports multiple accounts, each with its own private timeline and public profile. An admin controls whether registration is open or invite-only. This makes Memos viable as a shared family or small-team note space with individual private areas and optional public sharing. Per-user tag settings (colors, content-blur rules) are tied to accounts rather than the whole instance, which matters once more than one person is involved. The migration path copies instance-level settings to existing users so nobody loses their setup. For a household that wants a shared recipe box plus private journals, or a small team that wants a lightweight internal log, Memos hits a sweet spot that heavier tools overshoot.

17. Hardware and Resource Footprint

Memos runs comfortably on the smallest VPS tier and on a Raspberry Pi. ARM is supported, so a Pi 4 or Pi 5 makes a perfectly good always-on Memos host that draws a few watts. Idle RAM is around 50MB. A mini-PC repurposed from an old laptop, a NAS with container support, or a single LXC container on a Proxmox box all work. This low footprint is a sovereignty advantage in itself. You do not need to rent a large server to own your notes. The cheapest VPS, a $35 single-board computer, or hardware you already own will do. The barrier to leaving the cloud is, in this case, genuinely low.

18. Honest Limitations

No tool this light is free of trade-offs, and Memos has several you should accept with eyes open. First, and most important: Memos is not an encrypted notebook. Data sits in SQLite (or Postgres/MySQL) in plaintext. There is no application-level encryption at rest and no end-to-end encryption. If your server is compromised, your notes are readable. Privacy here comes from controlling the server, not from the app scrambling the data. That is fine for many self-hosters and unacceptable for others. Second, the "bus factor" risk. Memos is a community-driven project with no incorporated legal entity, no commercial SLA, and no funded maintainer guaranteeing patched security issues on a deadline. For personal use this is usually fine; for high-compliance enterprise deployment it is a real consideration. Third, scaling. SQLite is a single-writer database. A busy multi-user instance can hit lock contention. You can move to Postgres, but the architecture is still primarily designed for individuals and small teams, not thousands of concurrent editors. Fourth, structure. The timeline model is a feature and a limitation. If you need deeply nested, heavily linked documentation with graph views, Memos will feel underpowered compared to dedicated knowledge-base tools. Fifth, the public-visibility footgun. Because visibility is per memo with no publish confirmation, a misclick can expose a private note. Discipline and, ideally, not exposing Memos directly to the public internet without authentication mitigate this.

19. Real Self-Hosting Cost Numbers

Let us put actual numbers on running Memos.

• Raspberry Pi 4 (already owned) + SSD: electricity roughly $2–5 per year. Capex already sunk. Effectively free to operate.
• Repurpose an old mini-PC: $0 capex if you have one; electricity $10–20 per year.
• Small VPS (1 vCPU, 1GB RAM, 10GB disk): about $4–7 per month from budget providers, occasionally less on annual deals. Memos uses a fraction of that, so it is really the cost of the host that runs your other containers too.
• Managed database upgrade (Postgres): adds $10–15 per month if you do not self-host the database. Most people do not need this.
• Backups to object storage: $1–5 per month for personal note volumes.
• Domain name (only if you expose it publicly): $10–15 per year.

Against Notion's roughly $10 per user per month for the tier most power users want, a self-hosted Memos is either free (hardware you own) or a few dollars a month shared across all your other self-hosted services. The subscription fee is zero because the MIT license puts no per-seat cost on you. The real cost is the operational maturity: you must patch, back up, and secure the host yourself.

20. Where Your Data Goes / Data Sovereignty

This is the section a notes app demands. When you self-host Memos:

• Your notes are stored in a database file or server you control. There is no mandatory cloud sync.
• There is zero telemetry and no required cloud callback. The usememos.com site is optional; the app does not phone home.
• Geopolitical data-transfer risk is structurally eliminated because no vendor moves your data across borders on your behalf.
• You can read, export, and migrate your data with standard tools. SQLite files, SQL dumps, and the REST API all give you clean exits.

The honest counterweight: sovereignty is not the same as security. Because the data is unencrypted at rest and the app has no E2E model, your protection depends entirely on how you harden the host. Put Memos behind a reverse proxy with HTTPS, restrict it to a VPN or authenticated reverse proxy, encrypt the underlying disk, and back up encrypted copies off-site. Do those things and you have both sovereignty and reasonable security. Skip them and you have sovereignty with an unlocked front door. Concretely, there are three ways to add the at-rest encryption Memos lacks natively. The cleanest is full-disk or volume encryption on the host — LUKS on Linux, BitLocker on Windows, or an encrypted ZFS dataset — so a stolen drive yields nothing. The second is to mount an encrypted container (for example a LUKS volume or an encrypted image) at the data path, giving Memos an ordinary directory while the bytes on disk stay scrambled. The third, for the paranoid, is to run the database on an encrypted external store and keep keys in a separate secret manager. None of these require changing Memos; they operate underneath it. The point is simply that "self-hosted" and "encrypted" are separate choices, and with Memos you must make the encryption choice yourself rather than assume the app did it for you.

21. Backups and Migration

Backing up Memos is straightforward because the data is a folder or a standard database. For SQLite, stop the container (or accept a brief lock) and copy the data volume; for Postgres or MySQL, run a scheduled dump. Send the backup to object storage or another machine, and encrypt it if it leaves your network. Migration is equally clean. Moving from one host to another is a volume copy plus a container start. Moving from SQLite to Postgres is a flag change plus a data export/import. There is no vendor lock-in because there is no proprietary format and no account to migrate. That portability is the quiet dividend of the MIT license and the standard backends.

22. Security Hardening

If you expose Memos to the internet, treat it like any authenticated web app. Put it behind a reverse proxy with automatic TLS. Prefer limiting access to a VPN or an authenticated proxy rather than opening port 5230 directly. Keep the container updated; the community ships frequent releases, and the v0.30.0 authentication and sharing fixes are a good reason to stay current if you run publicly. Add fail2ban or CrowdSec in front of the proxy to blunt brute-force attempts on the login page. Use a strong admin password and, if the instance is personal, keep registration disabled. Encrypt the host disk so a physical theft does not hand over your notes in plaintext. None of this is unique to Memos, but the unencrypted-at-rest nature of the data makes it non-optional if the server is reachable.

23. Memos vs the Alternatives

• Logseq: local-first, Markdown/Org-mode files, strong for networked thought. More structured; less of a "feed."
• Joplin: E2E-encrypted sync, mature clients. Sync requires a server or a paid relay; less of a web-first timeline.
• Obsidian: fantastic local Markdown, but sync and collaboration are paid and cloud-assisted.
• Standard Notes: zero-knowledge, E2E encrypted, but the rich experience leans on a subscription.
• Notion: powerful, but cloud-locked, per-seat pricing, and no self-hosting.

Memos sits in a specific gap: web-first, self-hosted, lightweight, unencrypted-by-design, timeline-oriented. If you want E2E encryption, pick Joplin or Standard Notes. If you want a structured local graph, pick Logseq. If you want a free, owned, fast capture inbox on your own domain, Memos is hard to beat.

24. Who Should and Shouldn't Self-Host Memos

Self-host Memos if you already run a server or a Pi, you value owning your notes, you are comfortable with basic Linux and Docker, and you do not require end-to-end encryption as a hard guarantee. It is an excellent fit for solo users, families, and small teams that want a private capture layer. Do not self-host Memos if you need E2E encryption for legally or personally sensitive material, if you cannot commit to patching and backing up a server, or if you need enterprise support and compliance certifications. In those cases, a zero-knowledge commercial notes app or a managed offering is the more honest choice. Self-hosting trades vendor responsibility for personal responsibility; make sure you actually want that trade.

25. Running Memos Behind a Reverse Proxy

In almost every real deployment you will not expose port 5230 directly to the internet. Instead you place Memos behind a reverse proxy that terminates TLS and gives it a clean hostname such as memos.example.com. This is where a tool like Traefik or Nginx Proxy Manager earns its keep: you point the proxy at the container's internal address, obtain a Let's Encrypt certificate automatically, and force HTTPS only. Memos itself never has to touch certificate management. The proxy also lets you apply access policy in one place for your whole stack. You can require that Memos be reached only over a VPN, or put an authentication wall in front so the login page is not openly brute-forceable. Because Memos stores notes in plaintext, this network-layer protection is part of your security baseline, not an optional extra. A common, safe pattern is: proxy handles HTTPS and HSTS, the host firewall blocks all ports except 80/443 and your VPN, and Memos listens only on the internal Docker network. If you run several self-hosted services, the proxy is already there for the others, so adding Memos costs nothing extra. The only operational note is to set the correct external URL in Memos' settings so links, the web clipper, and OAuth callbacks resolve to the proxied hostname rather than the raw container port.

26. Updating Memos Safely

Memos releases frequently, and staying current matters because several recent updates hardened authentication and sharing boundaries. Updating a single-container deployment is simple: pull the new image tag and recreate the container. With Docker Compose, that is docker compose pull && docker compose up -d. Because your data lives in a mounted volume, the container is disposable and the notes survive the swap. The discipline that matters is backing up immediately before the update. Snapshot the data volume or dump the database, then update. If a release ever introduces a schema migration you regret, you can restore the prior volume and pin the previous image tag until you investigate. Avoid blindly tracking :latest` on a production instance if you depend on it daily; pinning to a specific version and bumping deliberately on a schedule gives you a known-good rollback path. For teams, stage the update on a copy first, since SQLite schema changes are generally fast but worth verifying against your data size.

27. Exporting and Data Portability in Detail

The MIT license and standard backends mean you are never trapped, but it is worth spelling out the exit routes. First, the database itself is portable: a SQLite file moves between hosts and architectures without conversion, and Postgres or MySQL dumps import anywhere those engines run. Second, the REST API lets you enumerate and retrieve every memo programmatically, so you can build your own exporter tailored to a target format. Third, individual memos and the whole timeline can be read in the UI and copied out manually if needed. This contrasts sharply with cloud note apps that lock exports behind rate limits, proprietary formats, or paid tiers. With Memos, the worst case is writing a short script against a documented API. There is no account to close, no vendor to negotiate with, and no risk that a pricing change strands your data. Portability is not a feature Memos advertises loudly, but it is the structural guarantee behind every other sovereignty claim in this article: you can leave, completely and cleanly, whenever you choose.

28. Mobile and Cross-Device Access

A notes app is only useful if it is with you, and Memos handles this through the web app plus personal access tokens rather than a separate proprietary mobile client. Because the interface is a responsive web application, opening memos.example.com on a phone gives you the full timeline, editor, and search without an app-store install. You can save a shortcut to your home screen and it behaves like a native app. For automated capture from mobile, the REST API with a personal access token lets you post memos from a shortcut, a script, or a third-party automation app. The web clipper covers desktop browsers, and on mobile you can share a page or text into the Memos web form. The trade-off versus a dedicated E2E-encrypted mobile client is that there is no offline-first local cache with sync conflict resolution; you are interacting with your server live. For most self-hosters on reliable connections that is fine, and it keeps the deployment simple. If you need offline editing with reconciliation, that is the gap to weigh against Joplin or Obsidian, whose sync models are built for it.

29. Related

If you are assembling a self-hosted, data-sovereign toolkit around Memos, these already-published deep dives are worth reading next:

• Nextcloud — a broader self-hosted data hub that can sit alongside Memos for files and sync.
• Authentik — add single sign-on in front of Memos so one login governs your stack.
• Traefik — the reverse proxy that puts Memos on HTTPS behind a clean hostname.
• Appwrite — a self-hosted backend if you want to build automations that read your notes.
• Vaultwarden — another lightweight, privacy-first self-hosted tool for the rest of your secrets.

30. Bottom Line

Memos is a genuinely refreshing notes app: a single Go binary, an MIT license, ~62k stars, and a timeline model that removes the friction that kills most note-taking habits. Self-hosting it is cheap — free on hardware you own, a few dollars a month on a shared VPS — and the data lives entirely in a database you control with zero telemetry and no cloud leash. The REST API, webhooks, and MCP server make it scriptable and AI-ready without abandoning that sovereignty. The limitations are real but narrow: no end-to-end encryption, a community maintenance model with no SLA, single-writer scaling ceilings, and a public-visibility footgun. None of these are disqualifying for the typical self-hoster, and all of them are manageable with basic hardening. If you want a fast, owned, private inbox for your thoughts on your own domain, Memos earns its place in the stack.