jfa-go

User management for self-hosted media servers, honestly reviewed. No marketing fluff, just what happens when you stop being the help desk for your Plex-refugee friends.

TL;DR

• What it is: A user management app for Jellyfin (and Emby, with caveats) that handles invite links, password resets, account expiry, and multi-channel notifications — so you stop being the manual gatekeeper for your shared media server [README].
• Who it’s for: Anyone running a shared Jellyfin instance for family or friends who is tired of manually creating accounts, resetting passwords, and chasing down expired users. Also anyone sharing media commercially who needs tighter access controls.
• Cost: Free, open source. The only cost is a VPS to run it on — same server as Jellyfin itself works fine [README][website].
• Key strength: Turns Jellyfin account management from a manual chore into a self-service system. Invite links, automated expiry, password resets via “Forgot Password” — users handle it themselves [README].
• Key weakness: Solo developer project by a student. The README states plainly: “Studies mean I can’t work on this project a lot outside of breaks.” New features come in short bursts; support is sporadic [README]. If you need guaranteed maintenance continuity, this is the honest flag.

---

What is jfa-go

The “go” in jfa-go is the language — this is a rewrite of an earlier Python project called jellyfin-accounts, rebuilt in Go for performance and portability. The developer is hrfee (Harvey Tindall), a solo contributor who built this tool for the problem every Jellyfin power user eventually hits: you’ve set up a great media server, invited your family and a few friends, and now you’re the permanent IT department for password resets, account requests, and access cleanup [README].

jfa-go sits in front of your Jellyfin instance and adds an invite layer. Instead of logging into the Jellyfin admin panel to create each account, you generate an invite link, send it, and the user signs themselves up. You control what they can access (via Jellyfin profiles), how long their account lasts, whether they need to verify their email or Discord, and whether they can invite one friend of their own. When the account expires, jfa-go handles the notification and cleanup [README].

The project currently works with Jellyfin 10.11.0 (confirmed as of October 2025) and treats Emby as a second-class citizen — the feature overlap is partial and the developer’s focus is clearly on Jellyfin [README]. With 1,122 GitHub stars, it sits in niche-but-respected territory: not a mainstream self-hosted app, but widely known in the Jellyfin community and available as a managed option on hosting platforms like ElfHosted [3].

---

Why people choose it

Independent third-party reviews of jfa-go are sparse. The tool doesn’t have the GitHub star count that attracts tech journalist coverage, and the Jellyfin niche is tight enough that most discussion lives in Discord servers and Reddit threads rather than review sites. What does exist paints a consistent picture.

ElfHosted, a managed self-hosting platform, lists jfa-go as a supported application with its own setup guide and dedicated subdomain [3]. That’s a meaningful signal — hosting platforms don’t productize tools without user demand. The ElfHosted docs reproduce the feature list verbatim and note that the tool is available with a 7-day trial alongside Jellyfin [3].

The README itself contains a telling piece of honesty: under Alternatives, the developer points to Wizarr and says “If you want a bit more guarantee of support… it’s popular and seems very polished” [README]. A maintainer recommending a competitor because of their own support constraints is unusual candor. The community tends to appreciate it.

The practical appeal is straightforward: Jellyfin’s built-in admin panel is not designed for delegated user management. There’s no invite system, no automated expiry, no self-service password reset that non-technical users can navigate without help. jfa-go fills that gap entirely.

---

Features

Based on the README and website:

Invite system:

• Generate time-limited or use-limited invite links [README]
• Apply Jellyfin setting profiles on signup (library access, transcoding limits, etc.) — different profiles per user type [README]
• Optional password strength enforcement, contact method verification, CAPTCHA [README]
• Referrals: let existing users generate one invite for a friend or family member [README]

Password resets:

• Integrates with Jellyfin’s “Forgot Password” flow [README]
• Also accessible from the “My Account” page without going through Jellyfin’s UI [README]
• Works without your intervention — users handle it themselves [README]

User notifications:

• Collect email, Discord, Telegram, or Matrix contact info at signup [README]
• Sends automated notifications on account expiry, disabling, deletion [README]
• Markdown-formatted announcements you can push to all users or subsets [README]

“My Account” page:

• Self-service password and contact info changes [README]
• Shows users their own account status and expiry date [README]

User lifecycle management:

• Account expiry: set per invite, applies to all accounts created from it [README]
• Expiry actions: disable, delete, or disable-then-delete [README]
• Bulk operations: enable/disable/delete users, apply profiles, send announcements [README]

Integrations:

• Ombi and Jellyseerr sync: username, passwords, and contact details stay in sync between services [README]
• REST API available [merged profile]

Notifications channels supported: Email, Discord, Telegram, Matrix (with optional E2EE via libolm) [README]

Build variants:

• Standard server build
• TrayIcon build (for desktop/GUI systems — starts/stops jfa-go from system tray) [README]
• MatrixE2EE build (includes libolm for encrypted Matrix messages) [README]

---

Pricing: SaaS vs self-hosted math

jfa-go has no commercial version. There is no SaaS tier, no paid plan, no license fee. The software is free [README].

The cost comparison isn’t about jfa-go’s pricing — it’s about why you’re running Jellyfin in the first place. If you’re migrating from Plex, you may be paying $5–$9/mo for Plex Pass (required for hardware transcoding, offline sync, and live TV features). Jellyfin gives you those features free. jfa-go adds the user management layer that Jellyfin’s admin panel doesn’t provide.

What you actually pay for jfa-go:

• Software: $0
• Hosting: runs on the same VPS as Jellyfin — no additional server required for small instances
• ElfHosted managed hosting (if you don’t want to self-host): pricing data not available from provided sources, but a 7-day free trial exists [3]

Ko-fi / GitHub Sponsors: The developer accepts donations. Given the tool is maintained by a student in their spare time, this is worth considering if the tool becomes load-bearing for your setup [website].

There’s no meaningful “SaaS vs self-hosted math” to run here because there’s no SaaS equivalent for Jellyfin invite management. The comparison is: keep manually creating accounts and resetting passwords in Jellyfin’s admin panel forever, or spend an hour setting up jfa-go and never touch it again.

---

Deployment reality check

Installation options:

• Docker (recommended, most portable) [README]
• Debian/Ubuntu via apt repository (hrfee maintains his own apt repo) [README][website]
• Arch Linux via AUR [README]
• Pre-built binaries for Windows, Mac, Linux [website]
• ElfHosted managed deployment [3]

Docker setup is the two-command path most people take. The docker create command in the README is copy-pasteable and covers the three volumes you actually need: config data, Jellyfin config path (only needed for password resets), and localtime [README].

What can go wrong:

First, the maintenance reality. The README’s “Project Status: Active-ish” section is not marketing hedging — it’s literal. The developer is a student. Bug fixes come during breaks. If something breaks right after a Jellyfin version bump and it’s mid-semester, you may be waiting [README]. The developer is honest about this, which is better than a project that hides its maintenance situation, but it’s a real consideration if jfa-go becomes the front door to your media server.

Second, the Emby situation. jfa-go officially supports Emby “as 2nd class.” If you’re on Emby, some features won’t work, some will be degraded, and the developer’s priority queue is Jellyfin-first [README].

Third, Matrix E2EE requires the libolm dependency. The standard Docker image includes it; non-standard builds may not. If you need encrypted Matrix messages, verify your build variant [README].

Fourth, the TrayIcon builds have additional Linux dependencies and are only relevant on systems with a desktop environment. Don’t install jfa-go-tray on a headless server [README][website].

Realistic time estimate:

• Technical user with Docker experience: 20–40 minutes to working instance
• Non-technical user following the wiki: 1–2 hours including Jellyfin profile setup
• ElfHosted: 15 minutes per their setup guide, including all integrations [3]

The setup process is not complicated, but it does require you to configure a Jellyfin admin account for jfa-go to use, set up your notification channels, and define at least one user profile. None of that is hard, but it’s not zero-effort either.

---

Pros and Cons

Pros

• Solves a real gap in Jellyfin. Jellyfin’s native admin panel has no invite system, no account expiry, no self-service password reset for non-admin users. jfa-go adds all of that [README].
• Multi-channel notifications. Email, Discord, Telegram, and Matrix — covering the actual communication channels people use, not just email [README].
• Invite profiles. You can create different invite types (family, trial, premium) that apply different Jellyfin library and permission profiles on signup. New users get bucketed correctly without you touching the admin panel [README].
• Referrals system. Trusted users can invite one person each, with their invite inheriting from their own profile. Organic growth without open signups [README].
• Account expiry is automatic. Set it on the invite, forget it. jfa-go handles the notification, the disabling, and the deletion on your schedule [README].
• Self-hosted, no phone-home. No telemetry, no external dependency, no vendor to shut down the service. Your invite data and user contact info stay on your server [README].
• Multiple deployment paths. Docker, apt, AUR, binaries — you’re not locked into one install method [README][website].
• Ombi/Jellyseerr sync. If you run a request system, credentials and contact details stay in sync automatically [README].

Cons

• Solo student developer, sporadic maintenance. The README says this plainly. For a tool that sits at your server’s front door, this is a genuine operational risk [README].
• Emby is second-class. If you’re on Emby, expect partial functionality and lower priority for bug fixes [README].
• No hosted SaaS fallback. If self-hosting is too much, ElfHosted covers you [3], but there’s no official hosted version and the developer doesn’t offer one.
• Independent reviews are sparse. Unlike tools with thousands of GitHub stars and press coverage, jfa-go has limited third-party validation. You’re largely going on the README and community word-of-mouth.
• License unclear. The GitHub scanner returned “NOASSERTION” for the license field. The project is functionally open source and freely distributed, but if your organization has formal license compliance requirements, verify before deploying.
• Setup requires Jellyfin admin credentials. jfa-go needs a dedicated Jellyfin user with admin rights. If those credentials are compromised, your entire Jellyfin instance is exposed. This isn’t unique to jfa-go, but worth noting when you’re setting up service accounts.
• Jellyfin-version sensitivity. Any tool that integrates deeply with Jellyfin’s internals is vulnerable to Jellyfin API changes. The current README confirms compatibility with 10.11.0; compatibility with future versions depends on the developer’s bandwidth [README].

---

Who should use this / who shouldn’t

Use jfa-go if:

• You run Jellyfin for more than 3–4 people and you’re tired of manually creating accounts and resetting passwords.
• You want account expiry to be automated — trial accounts, seasonal access, time-limited shares.
• You communicate with your users on Discord, Telegram, or Matrix and want notifications to go there rather than email.
• You’re comfortable with Docker or Linux package management, or you’ll use ElfHosted [3].
• You run Ombi or Jellyseerr and want user management to stay in sync.

Skip it (stay on manual Jellyfin management) if:

• You have 2–3 users who never change their passwords and never leave. The overhead of deploying jfa-go outweighs the benefit at that scale.
• You need guaranteed long-term maintenance support. A student solo developer is not an enterprise software vendor.

Skip it (try Wizarr instead) if:

• You want a more actively maintained alternative with Discord-based invite flows and multi-server support. The jfa-go README recommends Wizarr explicitly for users who need “more guarantee of support” [README].
• You’re on Emby and need full feature support, not second-class status.

Skip it (use ElfHosted) if:

• You want jfa-go’s functionality without managing the deployment yourself. ElfHosted runs it for you with a 7-day trial [3].

---

Alternatives worth considering

• Wizarr — The alternative the jfa-go README recommends directly. Supports multiple media servers (Jellyfin, Plex, Emby), more active maintenance, Discord-based invites. If the student-developer maintenance risk concerns you, Wizarr is the direct comparison.
• Jellyfin built-in admin panel — The zero-setup baseline. Fine for 2–3 users you trust; breaks down at scale when you become the help desk.
• ElfHosted managed jfa — Same software, hosted for you. Removes the deployment burden [3].
• Overseerr/Jellyseerr — Not a direct replacement (they’re request managers, not invite systems), but often deployed alongside jfa-go. If your users need to request content, Jellyseerr plus jfa-go is the standard pairing [README].

---

Bottom line

jfa-go is a focused tool that solves one specific problem well: Jellyfin’s admin panel was not built for delegated user management, and jfa-go fills that gap completely. Invite links, account expiry, multi-channel notifications, self-service password resets, profile-based permissions — everything a shared Jellyfin instance needs when you have more than a handful of users.

The honest caveat is the maintenance situation. A solo student developer is a real risk for infrastructure that sits at your server’s front door. The developer is transparent about this — recommending a competitor in their own README is unusual candor — but transparency doesn’t eliminate the risk. If Wizarr’s active development pace is more important to you than jfa-go’s feature depth, that’s a reasonable call. For everyone else who wants invite-based Jellyfin management and is comfortable with the support reality, jfa-go is the established choice in its niche.

---

Sources

1. jfa-go GitHub README — https://github.com/hrfee/jfa-go
2. jfa-go Official Website — https://jfa-go.com
3. ElfHosted — “Hosted Jellyfin Accounts - User Account Management” — https://docs.elfhosted.com/app/jellyfin-accounts/