# BookStack — Knowledge Base & Wiki

BookStack by HTTP Functions Ltd holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: HTTP Functions Ltd (https://www.bookstackapp.com)
- Category: [Knowledge Base & Wiki](https://whats-best.ai/software/knowledge-base.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/knowledge-base/bookstack
- Alternatives: https://whats-best.ai/software/knowledge-base/bookstack/alternatives ([markdown](https://whats-best.ai/software/knowledge-base/bookstack/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: HTTP Functions Ltd
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S18]

## The panel's verdict

BookStack is free, MIT-licensed documentation software that is self-hosted only, with no per-user pricing; the support plans of HTTP Functions Ltd of Hampshire, UK, at £450 /year and £4,500 /year with VAT stated as not included, are the only priced items. The scoring is clear at both ends: pricing transparency is the strongest criterion at 9, sovereignty follows at 8, and knowledge governance is the weakest at 3-4, where a recurring finding is no public information on review dates, approval workflows, read confirmations or content analytics. Authoring and search scored 6 for a word-processor-style editor with a Markdown alternative, built-in diagrams.net and deep search documentation; access control scored 7 for permission overrides from shelf down to page with SAML 2.0, OIDC, LDAP and per-role MFA at no extra charge. Spread never exceeds a point — knowledge governance 3-4, publishing and integrations 4-5, portability and hosting 7-8 — reflecting how much weight judges gave named page owners, a REST API covering import and export, and the pages' statement that there is no automated Confluence migration.

**Speaks for it:**
- Software is free with no per-user pricing, and SAML2, LDAP and multi-factor authentication are stated as included at no extra charge.
- Only priced items anywhere are the published support plans at £450 /year and £4,500 /year, with VAT stated as not included.
- Permissions can be overridden at shelf, book, chapter and page level, with SAML 2.0, OIDC and LDAP group sync and MFA enforced per role.
- MIT-licensed source on Codeberg, with installation and update documentation and exports to HTML, PDF, text, Markdown and a re-importable Portable ZIP.
- Self-hosted model places pages, attachments and the MySQL database on infrastructure the customer chooses, with the project stating no usage-tracking or marketing-tracking systems.

**Held against it:**
- We found no public information on review dates with reminders, approval workflows, read confirmations or stale-content analytics.
- The captured pages state there is no automated Confluence migration, only REST API assistance.
- We found no public information on SCIM provisioning, an audit log of views and permission changes, or IP restrictions.
- We found no public information on a branded help centre, Slack or Teams apps, an in-product widget, or a connector for AI assistants.
- Exports are stated not to be intended for backup, and export of page revision history is not described.

**Best for:**
- You need software cost fully computable from public pages for any team size, with a free licence and published support prices.
- You must run documentation on your own servers behind your own firewall, with MySQL and local-filesystem or S3 storage you control.
- You administer sign-on through SAML 2.0, OIDC or LDAP and need group sync into roles with MFA enforced per role.
- Your writers have mixed skills and need a word-processor-style default editor, a Markdown alternative and deep search filters.

**Avoid if:**
- You are migrating a large Confluence library — the captured pages state there is no automated migration, only REST API assistance.
- You want a vendor-hosted service — self-hosting is the only model and the project offers no hosted edition.
- Your compliance regime requires approval workflows or review reminders — the documented governance controls are page revisions and ownership and update-date tracking.
- You need a branded public help centre or chat-app integrations — the only public exposure described is a whole-instance visibility toggle with configurable name and logo.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Operations Lead | The IT Administrator | The Support Knowledge Manager | The Engineering Lead | The Quality Manager | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Editor, structure & search | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Verification, ownership & freshness | 2/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Permissions, SSO & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Help-center publishing & integrations | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Import, export & self-hosting | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 4/5 | 4/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3/5** | **3/5** | **3/5** | **3.5/5** |

### The judges

- **The Operations Lead** (v1.0): Head of operations at a 180-person machine builder in Baden-Württemberg, where onboarding, travel rules and the service hotline's answers live in a shared drive, three OneNote books and two colleagues' heads. Wants one place the whole company actually uses: an editor office staff manage without training, a search that finds the answer rather than the file, pages that name who keeps them current, and a price that does not double when the workshop gets read access.
- **The IT Administrator** (v1.0): Runs IT for a public utility with 900 staff whose Confluence Server held twelve years of pages until Atlassian ended its support. Was offered the cloud, read the subprocessor list and went looking instead. Needs a migration that keeps page trees, permissions and attachments, single sign-on against Entra ID with groups synced, an audit log the auditor accepts, and an edition they can run in the utility's own data centre if the works council or the regulator asks.
- **The Support Knowledge Manager** (v1.0): Owns the knowledge base of a Dutch SaaS company with customers in six languages and a support team of twenty-five. Writes once for agents and customers, publishes the public part as a help center on the company's own domain, and watches which searches find nothing. Wants review dates that nag the right expert, translations kept in step with the source, a widget inside the product, and articles that show up in the help desk next to the ticket.
- **The Engineering Lead** (v1.0): Leads a forty-person engineering team at a Berlin fintech that writes runbooks, architecture decisions and on-call guides. Writes in Markdown, links pages to Jira tickets and Slack threads, and has moved the team's docs twice. Wants fast search, code blocks and diagrams that render, an API and webhooks to generate pages from the pipeline, AI answers that cite their pages, and a full export the next tool can read.
- **The Quality Manager** (v1.0): Quality manager at a medical device supplier certified to ISO 9001 and ISO 13485, where every work instruction must be approved, versioned and read by the people it applies to. Today that means Word files, a sign-off sheet and an audit every spring. Wants approval workflows with named reviewers, read confirmations, review dates that expire pages, an audit trail they can export for the certifier, and permissions that keep drafts out of sight.
- **The Skeptic** (v1.0): Has migrated a wiki whose "export" turned out to be one PDF per page, watched a self-hosted edition announced as retired with two years' notice, and read "your data is never used for training" above a subprocessor list naming two AI providers. Asks what a full export contains, which model reads the pages and where, whether readers are billed like editors — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Vulnerability reporting: security vulnerability reporting via Codeberg readme [S7]

**Hosting**
- Analytics plausible selfhosted: Plausible · analytics · yes [S2]

**Integrations**
- Diagramsnet: diagrams.net · yes [S3]
- Export rest API: Export options accessible via REST API [S17]
- Import rest API: REST API can also be used for import [S17]
- Rest API: REST · yes · yes [S3]
- Rest API: yes [S4]
- Search webidx: webidx (customized) · search [S2]
- Site source codeberg: Codeberg · site source [S2]
- Source code hosting: Codeberg [S18]
- Webhook async option: synchronous · queue worker process · QUEUE_CONNECTION=database [S16]
- Webhook example provided: yes [S16]
- Webhook slack compatible: Slack-compatible POST with human-readable text property [S16]
- Webhooks available: outgoing · yes [S16]
- Webhooks config location: Settings > Webhooks [S16]

**Legal**
- Company number: UK · 13955964 [S11]
- Copyright: 2015-2026 · Dan Brown [S2]
- Creator: Dan Brown · yes [S3]
- Creator: Dan Brown · community [S5]
- Leadership: creator and primary maintainer of BookStack · Dan Brown [S11]
- License: MIT [S4]
- Location: HTTP Functions Ltd · Hampshire, UK [S11]
- Trademark: Daniel Brown · yes [S2]
- Trademark: Daniel Brown · yes [S3]
- Trademark: Daniel Brown [S5]
- Trademark: Daniel Brown · yes [S4]
- Trademark: Daniel Brown [S18]

**Pricing**
- Community: 0 · community discussions · Codeberg · Reddit · yes [S5]
- Enterprise: 4500 · year [S5]
- Enterprise support hours: video/call support & advice · 10 [S4]
- Free: yes · no per-user pricing [S18]
- Funding model: donations/sponsorships ~half, support ~half · donations · sponsorships · support offerings [S4]
- Investment accepted: no [S4]
- Paid features: no [S4]
- Professional: 450 · year [S5]
- VAT: no [S5]

**Product**
- Admin role permissions: Admin role retains all permissions [S14]
- Analytics self hosted: Plausible (self-hosted) [S1]
- API docs path: /api/docs [S10]
- API permission required: Access system API [S10]
- App key importance: APP_KEY from old .env must be retained; used for encryption of MFA credentials [S9]
- App key purpose: 32 bytes · APP_KEY · mfa_values · cookie_session_data · cached_auth_data [S7]
- Attachment s3 storage: yes [S7]
- Attachments auth protected by default: yes [S7]
- Auth: email/password · OIDC · SAML2 · LDAP · social [S1]
- Auth features included: yes · yes · no · yes [S18]
- Authentication: LDAP · SAML2 · OAuth clients · yes [S3]
- Author: Dan Brown [S18]
- Authorship: Dan Brown · the community [S2]
- Backup builtin: no · command line [S9]
- Backup database method: mysqldump used to back up the database [S9]
- Backup docker support: docker-container setups supported; restore database before starting container [S9]
- Backup file locations: .env · public/uploads · storage/uploads · themes [S9]
- Batteries included: yes · no [S4]
- Book chapter search: Scoped search bar in book/chapter sidebar searching child items [S13]
- Bookstack support: yes · official support services for BookStack Open Source project [S11]
- Browser print export: Pages display well via browser printing; print-to-PDF is another export form [S17]
- Child item tag inheritance: yes [S10]
- Code hosting: Codeberg [S4]
- Community: Codeberg · community forum · subreddit [S3]
- Community guides unsupported: no [S6]
- Composer requirement: 2.2.0 [S6]
- Configurable: Configurable name, logo, registration, public visibility [S1]
- Confluence migration: yes · no [S3]
- Content filter deprecation: APP_CONTENT_FILTERING · ALLOW_CONTENT_SCRIPTS [S7]
- Content filtering: APP_CONTENT_FILTERING · javascript/binary · dangerous_html · form_elements · allowlist · yes [S7]
- Content level permissions: Shelf · Book · Chapter · Page · yes [S14]
- Content permissions cascade: no · yes [S14]
- Content permissions everyone else: yes [S14]
- Content search filters: Content filters in_name and in_body restricting search to name or body [S13]
- Csp configurable style image sources: ALLOWED_STYLE_SOURCES · ALLOWED_IMAGE_SOURCES [S7]
- Csp header: yes [S7]
- Csp script nonce: yes [S7]
- Custom html head option: yes [S10]
- Database requirement: 8.0 · 10.6 [S6]
- Date search filters: Date filters to constrain search results by created/updated dates [S13]
- Default admin account: admin@admin.com [S7]
- Default admin credentials: admin@admin.com · password · yes [S6]
- Default editor: WYSIWYG is the default editor, similar to word-processing applications such as Word or Google Docs [S12]
- Default role after registration: yes [S14]
- Default roles provided: yes [S14]
- Demo: https://demo.bookstackapp.com · every half hour [S1]
- Diagrams net: Built-in diagrams.net drawing in page editor [S1]
- Docker community setups: yes · LinuxServer.io · solidnerd [S6]
- Editor: WYSIWYG [S3]
- Editor formats: formatting shortcuts for Header Large/Medium/Small/Tiny (Ctrl+1-4) and Normal Paragraph (Ctrl+D) [S12]
- Editor wysiwyg: WYSIWYG · Books · Chapters · Pages [S1]
- Enterprise features: highest priority handling · assistance for API integrations & platform extension · road-map discussion with core maintainer [S5]
- Enterprise includes professional: yes [S5]
- Enterprise video support: Zoom · Teams · Meet · Discord · 10 [S5]
- Exact phrase search: Exact phrase searches using quoted strings [S13]
- Export classes: export · export-format-pdf · export-format-html · export-engine-dompdf · export-engine-wkhtml · export-engine-command · yes [S10]
- Export formats: .html (Contained Web File) · .pdf · .txt (Plain Text) · .md (Markdown) · .zip (Portable ZIP) [S17]
- Export pdf quality: PDF output can be inaccurate or lack features vs in-app representation [S17]
- Export permission required: role permission · Export content [S17]
- External content warning: user content accessed via database or API not guaranteed safe [S7]
- Failed login logging: LOG_FAILED_LOGIN_MESSAGE · yes [S7]
- Failed login scope: email_password · ldap · social · saml2 [S7]
- Features: cross-book sorting · page revisions · image management · roles and permissions [S1]
- Forkable: yes [S18]
- Free open source: yes · yes [S4]
- Git requirement: application of updates · yes [S6]
- Gitlab self hosted support: yes · yes [S8]
- Global search: Global header search across all books, chapters and pages, available from any page [S13]
- Hacks not supported: no [S10]
- High availability support: no [S6]
- Iframe embed samesite note: None [S7]
- Iframe embedding restricted by default: ALLOWED_IFRAME_HOSTS · yes [S7]
- Iframe sources default: ALLOWED_IFRAME_SOURCES · https://*.draw.io · https://*.youtube.com · https://*.youtube-nocookie.com · https://*.vimeo.com [S7]
- Images public by default: yes [S7]
- Import flow: Upload new ZIP or continue pending import; preview shown before running; original ZIP deleted after import [S17]
- Import permission required: role permission · Import content [S17]
- Import zip only: Import supports Portable ZIP files via Books view or /import URL path [S17]
- Javascript public events: yes [S10]
- Ldap group sync roles: yes [S14]
- License: yes · MIT · yes [S3]
- License: MIT [S18]
- Logical theme stable API only: no [S10]
- Logical theme system: PHP · yes [S10]
- Markdown editor: yes · yes [S1]
- Markdown editor: switching where permissions allow · yes · yes [S12]
- Markdown export behavior: Original markdown preserved if written in Markdown editor; otherwise conversion attempted; may include HTML [S17]
- MFA: yes · TOTP · static backup codes · yes [S1]
- MFA backup codes: 16 · yes · 5 [S7]
- MFA forced by role: yes [S7]
- MFA mechanisms: TOTP · backup_codes [S7]
- MFA storage encrypted: yes [S7]
- MFA user enabled: yes [S7]
- Multilingual: EN · FR · DE · ES · IT · JA · NL · PL · RU [S1]
- Multiple roles stacking: yes [S14]
- Mysql ssl: MYSQL_ATTR_SSL_CA · yes · yes [S7]
- Negated terms: Negation of exact, tag and filter terms via leading dash [S13]
- No tracking systems: no · no [S18]
- Not backup tool: Export/import options not intended for backup or restore [S17]
- Oidc SAML group sync note: OIDC and SAML 2.0 offer auto-login and group sync; with Google, group sync only available via SAML2 [S8]
- Open source alternative confluence: BookStack is positioned as an open source alternative to Confluence [S2]
- Open source alternative teams wiki: BookStack is positioned as an open source Microsoft Teams wiki alternative [S2]
- Open source focus: focus on Open Source software, both building and supporting [S11]
- Open source mit: yes · MIT · yes · Codeberg [S1]
- Owner: Dan Brown · Daniel Brown [S1]
- Password hashing: bcrypt [S7]
- Pdf export engines: DomPDF · DomPDF · wkhtml · command-based [S10]
- Permission grant deny rule: grant wins at equal specificity [S14]
- Permission specificity levels: Role permissions · Content Everyone Else permissions · Role-specific content permissions [S14]
- Permission specificity priority: Most specific permissions take priority and can deny less specific [S14]
- Php extensions optional: ldap (LDAP Auth), exif (image rotation) [S6]
- Php extensions required: curl, dom, gd, iconv, mbstring, mysqlnd, openssl, pdo, pdo_mysql, tokenizer, xml, zip [S6]
- Php requirement: 8.2 [S6]
- Professional channels: email · help-desk [S5]
- Professional scope: installation issues · updating issues · bug and issue reports with high priority triage [S5]
- Release branch stable channel: release branch [S6]
- Release cadence: 2 [S4]
- Requirements: PHP · Laravel · MySQL [S1]
- Rest API: REST · yes [S10]
- Restore database method: restore database by executing the mysqldump SQL file [S9]
- Restore migrate requirement: php artisan migrate required after restore to newer version [S9]

**Support**
- Community no assurance: no [S5]
- Debugging docs: Email send failures logged to application error log; debugging documentation page available [S16]
- Demo available: yes [S2]
- Presales: no [S4]
- Provider: HTTP Functions Ltd [S5]
- Security mailing list: yes [S4]
- Security reports: email [S4]
- Services offered: yes [S2]
- Terms: yes [S5]

64 more facts on the canonical page: https://whats-best.ai/software/knowledge-base/bookstack

## Questions

### Is BookStack European?

Yes, though not from the EU. whats-best.ai classifies BookStack as UK / wider Europe.

### Where does BookStack store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does BookStack have a free plan?

Yes. BookStack has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13429).

### What are the best alternatives to BookStack?

As of 1 Nov 2026, the panel rates [Document360 (3.5/5)](https://whats-best.ai/software/knowledge-base/document360), [XWiki (3/5)](https://whats-best.ai/software/knowledge-base/xwiki) and [Docmost (3/5)](https://whats-best.ai/software/knowledge-base/docmost) highest among the other 13 Knowledge Base & Wiki products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Document360](https://whats-best.ai/software/knowledge-base/document360) (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [BookStack alternatives](https://whats-best.ai/software/knowledge-base/bookstack/alternatives).

## What this page leaves out

- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.bookstackapp.com/ (checked 2026-11-01)
- [S2] Features page: https://www.bookstackapp.com/about/ (checked 2026-11-01)
- [S3] Features page (Confluence alternative): https://www.bookstackapp.com/about/confluence-alternative/ (checked 2026-11-01)
- [S4] Project FAQ (funding, services, editions): https://www.bookstackapp.com/about/project-faq/ (checked 2026-11-01)
- [S5] Pricing page (support plans): https://www.bookstackapp.com/support/ (checked 2026-11-01)
- [S6] Documentation (installation): https://www.bookstackapp.com/docs/admin/installation/ (checked 2026-11-01)
- [S7] Security page: https://www.bookstackapp.com/docs/admin/security/ (checked 2026-11-01)
- [S8] Documentation (single sign-on): https://www.bookstackapp.com/docs/admin/third-party-auth/ (checked 2026-11-01)
- [S9] Documentation (backup and export): https://www.bookstackapp.com/docs/admin/backup-restore/ (checked 2026-11-01)
- [S10] Documentation (API and customisation): https://www.bookstackapp.com/docs/admin/hacking-bookstack/ (checked 2026-11-01)
- [S11] Support vendor homepage: https://www.httpfunctions.com/ (checked 2026-11-01)
- [S12] Editor, structure & search — found from sitemap: https://www.bookstackapp.com/docs/user/wysiwyg-editor/ (checked 2026-11-01)
- [S13] Editor, structure & search — found from sitemap: https://www.bookstackapp.com/docs/user/searching/ (checked 2026-11-01)
- [S14] Permissions, SSO & administration — found from sitemap: https://www.bookstackapp.com/docs/user/roles-and-permissions/ (checked 2026-11-01)
- [S15] Permissions, SSO & administration — found from sitemap: https://www.bookstackapp.com/docs/admin/saml2-auth/ (checked 2026-11-01)
- [S16] Help-center publishing & integrations — found from sitemap: https://www.bookstackapp.com/docs/admin/email-webhooks/ (checked 2026-11-01)
- [S17] Import, export & self-hosting — found from sitemap: https://www.bookstackapp.com/docs/user/export-import/ (checked 2026-11-01)
- [S18] Import, export & self-hosting — found from sitemap: https://www.bookstackapp.com/about/open-source-documentation-software/ (checked 2026-11-01)
- [S19] Code repository (open-source licence) — found from the homepage: https://codeberg.org/bookstack/bookstack (checked 2026-11-01)

---

Cite as: whats-best.ai, "BookStack — Knowledge Base & Wiki", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/knowledge-base/bookstack

Corrections: https://whats-best.ai/correct/1230?target=page