Kimai

Kimai is the #1 open-source time-tracking application, built to handle everything from individual freelancers to enterprise teams with hundreds of users. It replaces manual spreadsheets with automated time logging, punch-in/punch-out modes, multi-timer support, and a clean browser-based UI that works on any device.

At its core, Kimai integrates time tracking directly with invoicing and reporting, so hours tracked flow straight into PDF or DOCX invoices with custom templates, client-specific rates, and configurable numbering. The built-in JSON REST API covers every resource—timesheets, customers, projects, activities, invoices, and users—making it straightforward to connect to ERPs, CRMs, payroll systems, or custom dashboards.

Kimai runs on PHP and Symfony with Doctrine ORM, deployable via Docker, SSH/Composer, or Synology. It supports MariaDB and MySQL, with SAML and LDAP integrations for enterprise identity providers like Azure AD and Google Workspace. Role-based permissions, team management, two-factor authentication, custom fields, and a plugin marketplace round out an enterprise-ready feature set that remains fully open-source under AGPL-3.0.

For teams that prefer not to manage infrastructure, Kimai Cloud offers the same codebase as a managed SaaS at kimai.cloud, while the on-premise option keeps your time data fully under your control.

What You Get

• Full REST JSON API - Read and write timesheets, customers, projects, activities, and invoices programmatically, enabling integration with CRM, ERP, payroll, and custom automation pipelines.
• Integrated Invoicing Engine - Generate PDF and DOCX invoices with configurable templates, entry grouping, custom numbering schemes, tax rates, and per-client or per-project billing rates.
• Multi-user Role & Team Permissions - Define granular roles for individual users and teams, controlling visibility and edit rights across customers, projects, activities, and reports.
• SAML & LDAP Authentication - Connect to enterprise identity providers including Azure AD, Google Workspace, Authentik, and any LDAP-compliant directory for centralized user management and SSO.
• Two-Factor Authentication (TOTP) - Enforce app-based 2FA for all users without requiring third-party services, adding a security layer directly in the Kimai configuration.
• Advanced Reporting & Exports - Generate reports by user, customer, project, activity, tag, or date range, with export to CSV, PDF, XLSX, and ODS via pluggable export templates.
• Multiple Time Tracking Modes - Switch between multi-timer, punch-in/punch-out, and manual entry modes per user, with configurable rounding strategies (ceil, floor, closest) applied per time-of-day rules.
• Money & Time Budgets - Set hard or soft time and money budgets on projects and activities, with real-time tracking against thresholds and configurable alerts.
• Custom Meta Fields - Add user-defined fields to timesheets, customers, projects, activities, and expenses to capture project-specific metadata without modifying the core schema.
• Expense Tracking - Log billable and non-billable expenses linked to time entries for complete client billing and reimbursement workflows.
• Webhooks & Events - Subscribe to Kimai’s rich event system via webhooks to trigger external workflows when timesheets are created, updated, or invoices are generated.
• Plugin Marketplace - Extend functionality with paid and free plugins for integrations, custom reporting, calendar sync, and workflow automation available at kimai.org/store.

Common Use Cases

• Freelance agency billing - A design agency tracks hours per client and project using multi-timer mode, applies client-specific hourly rates, and auto-generates branded PDF invoices each month for direct delivery to accounting.
• Remote development team time management - An engineering manager deploys Kimai on-premise with SAML SSO to track developer hours across 20+ active projects, exports data to payroll via the REST API, and enforces project budget caps to prevent overruns.
• Legal and professional services billing - A law firm uses Kimai to log billable time by case and attorney, applies matter-specific rates, and generates compliance-ready time reports with audit trails for court submissions.
• Consulting project oversight - A consultancy sets time and budget limits on client engagements, monitors spend against them in the weekly hours screen, and exports reconciled actuals to QuickBooks through a custom API integration.
• Non-profit volunteer hour tracking - An organization uses Kimai’s multi-user mode with public registrations disabled, assigns activities by department, and generates monthly CSV exports for grant reporting.
• IT managed services time capture - A managed service provider tracks technician time by client ticket using custom meta fields, applies SLA-based rates, and feeds billing data into their PSA tool via the JSON API.

Under The Hood

Architecture Kimai is a well-structured Symfony monolith organized around clear domain boundaries—Activity, Customer, Project, Timesheet, Invoice, Export, WorkingTime, Webhook, and Plugin each live as distinct namespaces with their own entities, repositories, forms, and event definitions. The application relies heavily on Symfony’s dependency injection container and service tagging to compose behaviors at runtime: invoice calculators, export renderers, time-rounding strategies, and tracking modes are all registered as tagged services and resolved via interfaces, making the core open to extension without modification. An event bus with over 116 domain events (covering pre/post hooks for every significant action) enables loose coupling between the core and plugin ecosystem. Repository classes encapsulate all query logic behind QueryBuilder abstractions, keeping data access concerns away from the domain layer.

Tech Stack The backend runs on PHP 8.2+ with Symfony as the application framework and Doctrine ORM for database persistence against MariaDB or MySQL; schema evolution is handled through Doctrine Migrations. Authentication integrates directly with Symfony Security, extended with custom SAML and LDAP bundles and TOTP-based 2FA via an endroid/qr-code-backed implementation. The frontend is compiled through Webpack Encore with Babel and Sass, layering Bootstrap 5, Tabler Core, FullCalendar, Chart.js, GridStack, and Tom Select for a feature-rich, interactive UI. Deployment targets Docker (FPM and Apache variants) and traditional SSH setups, with a Dockerfile using multi-stage build patterns. Static analysis runs through PHPStan with strict rules and doctrine-aware extensions; code style enforcement uses PHP-CS-Fixer; tests run on PHPUnit with Codecov coverage reporting.

Code Quality The test suite spans 713 PHP test files covering unit, integration, and controller scenarios—including event-dispatch verification, constraint validation, rounding strategies, and tracking mode behavior. The codebase applies strict PHP typing throughout, uses PHPDoc annotations for complex generics, and leans on Symfony’s validation framework with custom constraint validators for domain-specific rules. PSR conventions and Symfony coding standards are enforced mechanically via composer scripts. Error handling follows Symfony patterns—typed exceptions, HTTP exception hierarchy, and validation failure exceptions surfaced through the form and API layers—rather than silently swallowing errors.

What Makes It Unique Kimai’s invoice system is built around a family of pluggable calculators—Default, Date, Activity, Project, User, Weekly, and more—each implementing a common interface and registered as tagged services, so billing rules can be composed and extended by plugins without touching core logic. Time rounding is equally composable: ceil, floor, closest, and default strategies implement a shared interface and are applied per-rule with day-of-week and time-of-day policies, giving administrators fine-grained control over how fractional minutes are billed. The export pipeline decouples data sources (timesheets, expenses) from output renderers (PDF, XLSX, ODS, CSV) through an interface-driven template system, so new formats or data shapes are addable independently. With 116 domain events and a webhook subscription system, Kimai functions as an event source that external systems can react to in real time—an unusual degree of extensibility for a self-hosted time tracker.

Self-Hosting

Kimai is released under the GNU Affero General Public License v3.0 (AGPL-3.0), a strong copyleft license. In practice, this means you can use, modify, and self-host Kimai for any purpose—including commercially—without paying a fee. However, if you distribute a modified version or expose it as a network service, you are required to release your modifications under the same AGPL license. For internal business use where you run Kimai only for your own team and do not redistribute it, the AGPL imposes no practical restriction. The full source code is publicly available with no proprietary modules or closed enterprise tier.

Running Kimai on your own infrastructure requires PHP 8.2 or higher, a MariaDB or MySQL database (with specific minimum LTS versions), a web server (Apache or Nginx in combination with PHP-FPM), and a dedicated subdomain—subdirectory installs are not supported. Docker images (both FPM-only and Apache bundled) are available on Docker Hub, and Caddy-based Docker Compose templates are documented for Hetzner and DigitalOcean. You are responsible for provisioning and maintaining the server, keeping PHP and database versions current, running Kimai’s update process (which involves running migrations and clearing caches), managing SSL certificates, and taking database backups. The update cadence is active—roughly two releases per month—so staying current requires a reliable maintenance routine.

Kimai Cloud (kimai.cloud) offers a managed hosted alternative running the same codebase, handling infrastructure, upgrades, backups, and availability on your behalf. The hosted version adds convenience but reduces customization: you cannot install arbitrary plugins or modify server-side configuration as freely as on a self-managed instance. Support for self-hosted users is community-driven via GitHub Issues and Discussions; paid support tiers and SLAs are not offered for the open-source edition. Teams with strict uptime requirements, data residency needs, or complex enterprise integrations will generally find self-hosting worth the operational investment, while smaller teams may prefer Kimai Cloud to avoid the maintenance burden.