How to Use Actual Budget: The Beginner's Guide (Desktop-vs-Server, the One-Password Rule, Encryption, and the Envelope-vs-Tracking Choice)

CodexFuse Team · 2026-10-31T11:11:44.761Z · 18 min read

Learn how to use Actual Budget: deploy the free, self-hosted YNAB alternative on Docker, set the one server password, enable encryption, and pick envelope or tracking budgeting.

How to Use Actual Budget: The Beginner's Guide (Desktop-vs-Server, the One-Password Rule, Encryption, and the Envelope-vs-Tracking Choice)

Learning how to use Actual Budget is how you escape budget-app subscriptions without giving your bank data to a corporation. Actual Budget is a free, open-source, local-first envelope budgeting app (actualbudget/actual on GitHub, MIT licensed, about 29,879 stars, v26.10.0 at the time of writing) and the standard self-hosted answer for people looking for a YNAB alternative they run themselves. Your budget lives as a SQLite file on your own device; the optional server is just a sync endpoint that holds your budget files and a change log so your phone and laptop agree. This actual budget tutorial runs the complete beginner arc in one sitting: the desktop-vs-server decision, the Docker install, the one-password rule that guards the whole server, the end-to-end encryption choice and its no-reset cost, the envelope-vs-tracking decision, your first accounts, your first transaction import, the US bank-sync decision with its real price, and the backup habit. You will need Docker for the server half, so start with our Docker beginner guide if containers are new to you.

How to use Actual Budget for the first time: the 7-step arc

The fastest beginner path is: decide desktop or server, install, set the one server password, make the encryption decision and store its password in a password manager first, choose envelope or tracking budgeting, create your first account with a starting balance from today's bank figures, and import your first transactions. After that the daily habit is ten minutes of categorizing. The whole setup arc takes about thirty minutes if Docker is already installed — the encryption choice and the first password are the two decisions that actually matter, and this guide walks them in order.

1. Pick your deployment. Desktop app for one computer, or the Docker server for sync across every device. If you want your phone and laptop to agree, you want the server.
2. Install it. One container and one data volume with the official actualbudget/actual-server image — the compose file below takes two minutes.
3. Set the server password. The first screen asks for one password and one password only. It guards the entire server, so make it long and random before you touch anything else.
4. Store it, then create your budget file. Save the password in a password manager, then create a budget file and decide on end-to-end encryption — the encryption password is unrecoverable if lost, so store it before you click past that screen.
5. Pick envelope or tracking. Envelope is the default and the one the Actual team recommends; tracking is the traditional forecast style you can switch to later from Settings.
6. Add your first account. Start balances come from your bank's current figures, not from years of history — envelope budgeting works forward from the money you have now.
7. Get transactions in. Type a few manually to learn the register, then pick your import method: CSV/OFX/QFX file import for free, or bank sync through SimpleFIN if you are in the US and want automation.

What is Actual Budget (the self-hosted envelope budgeting app)?

Actual Budget is a full-featured personal ledger built on envelope budgeting: every dollar of income gets a job in a category before you spend it, so you can only budget cash you actually have. That rule is what makes the plan honest by construction — there is no forecasting money you have not received yet. The app is local-first, which is a precise technical claim: the budget itself is a SQLite database that lives inside your browser or app and works fully offline, while the optional server just stores files and syncs changes between devices.

The architecture matters because it explains everything about the install. The server does not run your budget logic; it holds the account list, the budget files, and the change log that lets a phone and a laptop agree on what changed. Because the server mostly stores files and syncs them, everything a normal budget needs runs comfortably on the smallest VPS you can rent — a budget server does not need real CPU. This is also why you own the data in a way cloud budget apps never allow: there is no company account, no subscription, and no analytics pipeline; your money data sits on hardware you control. If you run the server on a VPS, see our what is VPS hosting explainer for how the machine it lives on works.

Do you need the desktop app or the server?

Most beginners should start with the desktop app if they only budget on one computer, and run the server the moment they want a second device involved. An actual budget self host setup needs three things: one container, one data volume, and one HTTPS name. The desktop app gives you the full budgeting experience with zero infrastructure: install, create a budget file, enable encryption, and you are done. The server adds multi-device sync, the web app you install on your phone's home screen, and a browser interface reachable from anywhere — at the cost of one container to maintain.

One hard rule cuts across both: Actual demands HTTPS for remote use, and it is not a formality. The app needs a browser feature called SharedArrayBuffer to run at all, and browsers only hand it to pages in a secure context — https:// or http://localhost. Open http://203.0.113.10:5006 from a browser on another machine and the budget never loads. On your home network this is why a reverse proxy with TLS is part of the real setup, not a nicety. Our Caddy beginner guide covers the HTTPS front end that makes remote access work, including the WebSocket upgrade the sync protocol needs.

How do you install Actual Budget with Docker?

The server ships as one container, actualbudget/actual-server, listening on port 5006 with a single /data volume holding everything it knows. The compose file is short enough to read in full, which is the point — there is nothing to misconfigure once the two volumes and the port are right.

services:
  actual-server:
    image: actualbudget/actual-server:latest
    container_name: actual-server
    ports:
      - "127.0.0.1:5006:5006"
    volumes:
      - ./actual-data:/data
    restart: unless-stopped

Bring it up with docker compose up -d and confirm the container is healthy before opening a browser. This actual budget docker install keeps the port bound to localhost on purpose: the app only works over HTTPS remotely, so exposing 5006 to the internet directly gains nothing — your reverse proxy takes the TLS connection and forwards to localhost. A reverse proxy for Actual must pass WebSocket connections or sync silently breaks, so confirm the proxy config includes the WebSocket upgrade path (Caddy does this by default; nginx and Apache need the upgrade headers set explicitly). The official install docs cover Docker, bare metal, and managed hosting for readers who prefer a different shape.

What is the one-password rule?

The first screen you see on a fresh server asks you to set a single server password — no username, no account creation, no email. That one password guards the entire server: every budget file on it, the account list, all of it. The consequence follows directly: there are no per-person logins out of the box, so sharing a budget with a partner means sharing that password, exactly as if you handed over one key to a locked room.

Generate a long random password and store it in a password manager before you do anything else — this is the password you will reach for rarely, so make it strong enough to forget. Our Bitwarden beginner guide covers the habit. If your household genuinely needs separate logins, Actual supports connecting an OpenID provider for multi-user setups, but that is an advanced branch — most beginners should keep the one password and share it only with the people who share the budget.

Should you enable end-to-end encryption?

Say yes, and the server stores only ciphertext. Actual's end-to-end encryption means the encryption password never reaches the server — it encrypts the budget in your browser before upload, so even whoever rents the metal under your VPS cannot read your finances. The cost is real and non-negotiable: with the password never touching the server, there is no reset, no recovery email, no support desk. Lose it and the budget file is gone forever.

The safe order of operations is: store the server password, store the encryption password, then create the budget file. Teach the password-manager habit before enabling encryption, because the five seconds of discipline at this screen is the only protection the no-reset model gives you.

Envelope or tracking budget — which should a beginner pick?

Start with the envelope budget, the default. The Actual team explicitly recommends it over the tracking budget, and for a beginner the reason is mechanical, not philosophical: the envelope budget forces the single habit that makes budgeting work — accounting for every dollar on hand — while the tracking budget lets you budget money you have not received yet, which beginners consistently mishandle.

In an envelope budget, balances roll forward: money you do not spend this month stays available in its category next month, and overspending comes out of another envelope's balance, which keeps the totals honest. The actual budget tracking budget works like a traditional forecast — you assign the income you expect this month and the expenses you expect, and Actual shows you budgeted versus actual in the monthly summary with a Projected Savings figure. Money does not automatically carry over; if a category overspends you fix it by raising that category's budget, or optionally carry the balance forward with the "Rollover Overspending" action on the category's balance. All the non-budgeting features — accounts, schedules, reports, rules — work identically in both modes, and you can switch from envelope to tracking in Settings at any time.

How do you give every dollar a job? (a first-month envelope example)

The envelope method clicks when you see the arithmetic on real numbers. Take a $4,200 monthly take-home and assign every dollar before the month starts — the plan below leaves $0 unassigned, which is the entire discipline of the actual budget envelope method. Starting balances come from your bank's current figures; a fresh budget works forward from today's money, not from a year of reconstructed history.

Each category then runs a simple balance equation through the month: available = previous balance + budgeted − spent. The Budgeted column accepts typed numbers or quick fills from the month header menu — copy last month's budget, or set budgets from your 3, 6, or 12-month averages — which is how the second month takes five minutes instead of fifty. When the groceries envelope hits zero on the 24th, the decision is explicit and immediate: move money from eating out, or stop spending. That visible trade-off is the whole method.

How do you get transactions into Actual Budget?

Transactions enter Actual three ways, and every long-term user ends up with a mix. Manual entry is the baseline and it always works — for an envelope method it is arguably the point, since typing a purchase is what makes you notice it. File import handles the bulk history and the weekly catch-up: Actual reads CSV, QIF, OFX, QFX, and CAMT formats, and most banks export at least one of them. Built-in YNAB4 and nYNAB importers carry complete budget histories for migrants, categories included. Start balances, again, come from today's figures rather than importing years of history.

Automatic bank sync exists and needs a third-party service, because the server cannot talk to banks on its own. Actual Budget bank sync exists only through providers you sign up for yourself: you generate credentials on the provider and add them on the server. Three limits to accept before you rely on it: the API credentials sit on the server and are not covered by end-to-end encryption because the server has to use them; automatic syncing is off by default; and nothing syncs while Actual is closed — once enabled it runs only while the app is open, so the server never polls your banks in the background.

The honest recommendation: run manual entry plus weekly file imports for your first month, because the habit is what survives — sync is a convenience layer on top of a habit, not a replacement for one. Set the cost expectation before you need it: US bank sync costs real money through SimpleFIN (the actual budget simplefin signup happens on simplefin.org, not inside the app), and European readers should know GoCardless no longer takes new sign-ups before they plan around it.

How do you keep your budget backed up?

Everything the server knows lives in /data, so the actual budget backup rule is one line: snapshot that volume regularly. A nightly tarball of the mounted directory — tar -czf actual-backup-$(date +%F).tar.gz ./actual-data — plus an off-server copy is the whole strategy. The server also supports automated backups from its own interface, but treat those as a second layer, not the plan: the volume tarball is what you restore from when the machine dies.

Two parts of the backup story beginners miss: pin the image tag when things are working (compose image: actualbudget/actual-server:latest moves under you on pull, so a known-good version plus a backup lets you roll back cleanly), and store the encryption password outside the server — ideally in the password manager from the one-password step — because an encrypted budget file with no encryption password is indistinguishable from random bytes. If you want phone access without exposing ports to the internet, our Tailscale beginner guide covers the no-open-ports remote branch.

Actual Budget vs YNAB — how do they compare?

The comparison that fills this search is straightforward: Actual Budget is the envelope method you run yourself; YNAB is the same method as a polished, paid service. The method transfers — envelope categories, give-every-dollar-a-job, roll-forward balances — which is why migrants report the logic feeling nearly identical and why Actual ships dedicated YNAB importers.

Run the official read-only demo at demo.actualbudget.org before you install anything — ten minutes in the real interface settles the comparison faster than any table.

What trips up every beginner?

Sources

Every fact in this guide was verified against these sources on 2026-10-31. The GitHub releases API is the authority for the current version and star count; the official docs are the authority for the envelope-vs-tracking mechanics; the independent beginner guides are the authority for the install arc and daily-use mechanics.

• GitHub API — actualbudget/actual (queried 2026-10-31): latest release v26.10.0 published 2026-10-02; ~29,879 stars; the project description identifies it as a local-first personal finance system.
• actualbudget.org — official docs, "Tracking Budget" (crawled 2026-10-31 11:07 UTC): tracking budget as the traditional alternative to envelope, no automatic month-to-month rollover, "Rollover Overspending" per-category action, the "Copy until year end" per-category option, the team's explicit recommendation to try the envelope budget first, switchable from Settings via "Switch to tracking budgeting".
• ssdnodes.com — "Self-host Actual Budget on your own VPS" (65 days old, crawled 2026-10-31): one-container/one-volume/one-HTTPS-name architecture, SQLite-in-the-browser local-first model with the server as sync endpoint, the HTTPS/SharedArrayBuffer secure-context requirement, the one-password server model with no usernames (sharing = sharing the password, OpenID for multi-user), E2E encryption with the never-reaches-the-server password and no reset, start-balances-from-today habit, SimpleFIN Bridge pricing ($15/year plus tax, up to 25 institutions, October 2026), GoCardless no longer accepting new accounts, Enable Banking/Akahu/Pluggy.ai regions, auto-sync off by default and only while the app is open, API credentials not covered by E2E encryption, official iOS app in beta with no official Android app yet, PWA install path.
• selfhosting.sh — Actual Budget app page (227 days old, crawled 2026-10-31): CSV/OFX/QFX import, /data backup tar habit, envelope categories.
• blog.whiteravens.net — "Actual Budget: Own Your Money Data" (124 days old, crawled 2026-10-31): local-first ledger framing, OFX import, recurring transactions, reports, Docker quickest path with the actualbudget/actual image and the /data volume, the demo at demo.actualbudget.org.
• vhbelvadi.com — "A quick guide to self-hosting Actual Budget" (crawled 2026-10-31): Apache reverse-proxy branch with the WebSocket upgrade requirement, the Docker Compose install path, YNAB migration notes.
• hostperl.com — "Install and Configure Actual Budget on Ubuntu 24.04" (461 days old, crawled 2026-10-31): nginx + certbot reverse proxy arc, the first-run single-password prompt with no username.
• store.elfhosted.com — Actual Budget product page (19 days old, crawled 2026-10-31): MIT license, bank sync via SimpleFIN (US, ~$15/year) and GoCardless (EU, free for personal use, existing accounts), manual import CSV/OFX/QIF/QFX.
• repocloud.io — Actual Budget app details (updated 2026-10-30, crawled 2026-10-31): CRDT-based sync machinery, built-in YNAB4 and nYNAB importers, CAMT.053 import support, automated server backups, ~2,500 European institutions via Enable Banking.

Frequently asked questions

Is Actual Budget really free?

Yes. It is MIT-licensed open source with no subscription and no paid tier. Your only costs are the server you run it on — a small VPS or your own hardware — plus any third-party bank-sync service you choose, like SimpleFIN in the US.

How do I sync my bank with Actual Budget?

Through a third-party provider you sign up for yourself: SimpleFIN Bridge for North American banks, Enable Banking for Europe, Akahu for New Zealand, or Pluggy.ai for Brazil. GoCardless connections still work for existing accounts but no new sign-ups are accepted. If none of these cover you, weekly CSV/OFX imports do the same job for free.

Can I use Actual Budget on my phone?

Yes. The web app installs to your home screen as a Progressive Web App and syncs with your server — that is how most phone users run it, over HTTPS. An official iOS app is in beta testing; there is no official Android app yet, so Android users use the PWA.

What happens if I lose my encryption password?

The budget file is gone. End-to-end encryption means the password never reaches the server, so there is no reset, no recovery email, and no support channel that can restore it. Store the password in your password manager before you enable encryption.

Do I need a domain name to use Actual Budget?

No — on your home network, the server address with port 5006 works fine. A domain becomes worth it when you want HTTPS and access from anywhere, because browsers require a secure context for the app to run remotely. Point the domain at your server, put a reverse proxy with TLS in front of it, and connect your devices to the HTTPS address.