ConvertX

A self-hosted online file converter. Supports over a thousand different formats. Written with TypeScript, Bun and Elysia.

Features

• Convert files to different formats
• Process multiple files at once
• Password protection
• Multiple accounts

Converters supported

Converter	Use case	Converts from	Converts to
Inkscape	Vector images	7	17
libjxl	JPEG XL	11	11
resvg	SVG	1	1
Vips	Images	45	23
libheif	HEIF	2	4
XeLaTeX	LaTeX	1	1
Calibre	E-books	26	19
LibreOffice	Documents	41	22
Dasel	Data Files	5	4
Pandoc	Documents	43	65
msgconvert	Outlook	1	1
VCF to CSV	Contacts	1	1
dvisvgm	Vector images	4	2
ImageMagick	Images	245	183
GraphicsMagick	Images	167	130
Assimp	3D Assets	77	23
FFmpeg	Video	~472	~199
Potrace	Raster to vector	4	11
VTracer	Raster to vector	8	1
Markitdown	Documents	6	1

Any missing converter? Open an issue or pull request!

Deployment

[!WARNING] If you can't login, make sure you are accessing the service over localhost or https otherwise set HTTP_ALLOWED=true

# docker-compose.yml
services:
  convertx:
    image: ghcr.io/c4illin/convertx
    container_name: convertx
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - JWT_SECRET=aLongAndSecretStringUsedToSignTheJSONWebToken1234 # will use randomUUID() if unset
      # - HTTP_ALLOWED=true # uncomment this if accessing it over a non-https connection
    volumes:
      - ./data:/app/data

or

docker run -p 3000:3000 -v ./data:/app/data ghcr.io/c4illin/convertx

Then visit http://localhost:3000 in your browser and create your account. Don't leave it unconfigured and open, as anyone can register the first account.

If you get unable to open database file run chown -R $USER:$USER path on the path you choose.

Environment variables

All are optional, JWT_SECRET is recommended to be set.

Name	Default	Description
JWT_SECRET	when unset it will use the value from randomUUID()	A long and secret string used to sign the JSON Web Token
ACCOUNT_REGISTRATION	false	Allow users to register accounts
HTTP_ALLOWED	false	Allow HTTP connections, only set this to true locally
ALLOW_UNAUTHENTICATED	false	Allow unauthenticated users to use the service, only set this to true locally
HTTP_REMOTE_USER_ENABLED	false	Trust a reverse proxy to authenticate users and sign them in from a header (SSO). Only enable behind a proxy that strips the header — see below.
HTTP_REMOTE_USER_HEADER	Remote-User	Header the trusted proxy passes the authenticated identity in (e.g. X-authentik-email, X-Forwarded-Email). Case-insensitive.
AUTO_DELETE_EVERY_N_HOURS	24	Checks every n hours for files older then n hours and deletes them, set to 0 to disable
WEBROOT		The address to the root path setting this to "/convert" will serve the website on "example.com/convert/"
FFMPEG_ARGS		Arguments to pass to the input file of ffmpeg, e.g. -hwaccel vaapi. See https://github.com/C4illin/ConvertX/issues/190 for more info about hw-acceleration.
FFMPEG_OUTPUT_ARGS		Arguments to pass to the output of ffmpeg, e.g. -preset veryfast
HIDE_HISTORY	false	Hide the history page
LANGUAGE	en	Language to format date strings in, specified as a BCP 47 language tag
UNAUTHENTICATED_USER_SHARING	false	Shares conversion history between all unauthenticated users
MAX_CONVERT_PROCESS	0	Maximum number of concurrent conversion processes allowed. Set to 0 for unlimited.

Reverse proxy / SSO (trusted header)

If you already run a reverse proxy that authenticates users — Authentik (forward-auth outpost), Authelia, oauth2-proxy, Cloudflare Access, etc. — ConvertX can trust it instead of asking users to log in a second time. Set HTTP_REMOTE_USER_ENABLED=true and point HTTP_REMOTE_USER_HEADER at the header your proxy injects the authenticated identity in. On each request ConvertX reads that header, looks up the matching account (creating it on first sight), and signs the user in — so users go straight from your SSO to the app. The normal login/registration form still works for anyone reaching ConvertX without the header.

Logout is handled by your proxy/identity provider: because the header is present on every proxied request, ConvertX's own logout would immediately re-authenticate the user from it. Point your users at the proxy's logout (e.g. Authentik's end-session endpoint) to sign out.

# behind an Authentik forward-auth outpost:
environment:
  - HTTP_REMOTE_USER_ENABLED=true
  - HTTP_REMOTE_USER_HEADER=X-authentik-email # or X-authentik-username

[!WARNING] Only enable this behind a trusted reverse proxy, and make sure that proxy strips any client-supplied copy of HTTP_REMOTE_USER_HEADER before it sets its own. If ConvertX is reachable by clients directly (no proxy in front), anyone can send the header themselves and impersonate any user — so never enable it in that case. This is the same trade-off as other self-hosted apps' remote-user auth (e.g. paperless-ngx).

Docker images

There is a :latest tag that is updated with every release and a :main tag that is updated with every push to the main branch. :latest is recommended for normal use.

The image is available on GitHub Container Registry and Docker Hub.

Image	What it is
image: ghcr.io/c4illin/convertx	The latest release on ghcr
image: ghcr.io/c4illin/convertx:main	The latest commit on ghcr
image: c4illin/convertx	The latest release on docker hub
image: c4illin/convertx:main	The latest commit on docker hub

Tutorial

[!NOTE] These are written by other people, and may be outdated, incorrect or wrong.

Tutorial in french: https://belginux.com/installer-convertx-avec-docker/

Tutorial in chinese: https://xzllll.com/24092901/

Tutorial in polish: https://www.kreatywnyprogramista.pl/convertx-lokalny-konwerter-plikow

Screenshots

Development

0. Install Bun and Git
1. Clone the repository
2. bun install
3. bun run dev

Pull requests are welcome! See open issues for the list of todos. The ones tagged with "converter request" are quite easy. Help with docs and cleaning up in issues are also very welcome!

Use conventional commits for commit messages.

Contributors

Star History