Linthra

byChar0n · Music & Audio

Verified safeOpen sourceExclusive

Download APK

—

No reviews reviews

downloads

7.0

android

AI summary

Open-source music player for local files and self-hosted Jellyfin, Navidrome or Subsonic servers. Streams or downloads for offline play, with playlists, smart mixes, lyrics and Android Auto support. Casting is temporarily disabled in this security maintenance release while a reported vulnerability is being fixed.

Generated by AI. May contain inaccuracies.

About this app

Linthra is an open-source Android music player for people who keep their music on their own devices or self-hosted servers. It plays local files, and it streams from self-hosted music servers such as Jellyfin and Navidrome/Subsonic — you bring your own server and sign in with your own account.

Linthra is an unofficial community client. It is not affiliated with Jellyfin, Navidrome, or Subsonic.

The app is still early alpha. It's usable for testing on a real device, but it isn't production-stable and has a few rough edges. The lists below separate what works today from what's still planned.

On privacy:

* No ads, no tracking, no analytics, and no crash-reporting or telemetry SDK. * No account to create, and nothing phones home — streaming is the default, and downloads only happen when you ask for them (Wi-Fi only unless you opt in to mobile data). * When you sign in to a server, the password is used once to get a session token, then dropped; the token is stored encrypted and never logged. * Open-source under the Mozilla Public License 2.0, so anyone can read, build, and contribute to it.

What works today:

* Local library — pick a folder with the Storage Access Framework (no broad storage permission), scan it, and browse Songs, Albums, and Artists with search. * Streaming from your own Jellyfin or Navidrome / Subsonic server: test the connection, sign in, sync, and play, including over HTTPS. * A smart offline cache — download tracks for offline play, with a size limit and a "Keep offline" pin. * Queue / Up Next, playlists and favourites (synced with Jellyfin where it's supported), and automatic "smart mixes" built from on-device signals. * Background playback with a media notification and lock-screen, Bluetooth, and wired-headset controls, plus shuffle / repeat and synced lyrics. * Android Auto browsing, and casting to a Chromecast, speaker, or TV through a pure-Dart Cast implementation (no Google Play Services).

music player offline open source self-hosted jellyfin subsonic

What's new

v0.2.6Sep 12, 2026

Linthra v0.2.6
Linthra 0.2.6 is a security maintenance release. Casting is temporarily turned off while a security fix is finished, and the release also carries the Linux desktop and Android library work that landed since 0.2.5. Updating is recommended for anyone who has used or might use casting.
What's new
Casting
Casting is temporarily unavailable. Linthra will not hand a track to a Cast receiver in this build. The cast control is still there, but it is muted and the device sheet explains that casting is off for now rather than offering devices. This is a deliberate, temporary safeguard while a reported security issue is resolved, not a removal of the feature. See below.
Android
A large music folder no longer freezes the app while it scans. Picking a folder used to walk the whole tree on Android's main thread, one query per folder plus metadata and artwork extraction per file. On a real library that froze the UI and could end in an ANR. The scan now runs on a background thread and replies once when it is done, so the app stays responsive. Picking a second folder supersedes the first: the older scan stops rather than making you wait out a folder you already moved on from. No change to the permission model: the same folder grant, no MediaStore, no broad storage access.
Linux
Media keys and desktop media controls work. Linthra now exports an MPRIS media session, so it shows up in GNOME's lock screen and top bar, KDE's media applet, and playerctl, and hardware media keys drive it. Play, pause, stop, next, previous, seek and absolute position are all wired, along with shuffle, repeat and the track's title, artist, album and duration. Two things are deliberately not published on the session bus: the track's URL (for a streamed track that is an authenticated URL, for a local one it is your file path) and any cover reference that is not a plain loadable image. The track identifier is a counter, not your library's own id. Local files show their real tags. A local Linux library used to show filenames. Linthra now reads title, artist, album, album artist and duration from the files themselves, parsing tags rather than loading whole files, and without pulling cover images out of every file during a scan. A file with missing, unsupported or broken tags still appears under its filename instead of vanishing. Embedded artwork is still to come. No more stray mpv cache file. The audio backend was letting mpv keep an on-disk packet cache, which is the right default for a video player and the wrong one here, and which logged "Failed to create cache temporary file" on every stream where it could not write. That cache is now off. Memory and network buffering are unchanged, and Linthra's own offline downloads are a separate mechanism this does not touch. Project A security policy and a private reporting route. The repository now has a SECURITY.md and GitHub private vulnerability reporting is enabled, so a security issue has somewhere to go that is not a public issue. Everything else behaves as it did in 0.2.5. Your queue, playback settings, saved servers, downloads and library are untouched by the update.
Why casting is off
A security researcher reported an issue in Linthra's Cast path through private vulnerability reporting. The report is being handled in a private advisory, and the technical details stay there until a fix is ready and disclosure is coordinated with the reporter. There is no evidence that anyone was affected, and this release makes no such claim.
The honest position until receiver identity can be verified properly is to not cast at all, so this release disables the path rather than papering over it. That containment is enforced in three independent places in the code, so a UI change or a single reverted line cannot quietly re-enable it.
Public tracking issues: #572 (this containment), #575 (restoring casting properly) and #576 (reducing what any external playback device is given in the first place).
Casting will come back in a later release, in a separate reviewed change. It is not restored by this one.