shouldiuse.io

Categories

VERDICT

Chocolatey Software Review

Depends

Should I use Chocolatey Software?

Chocolatey is software management automation for Windows that wraps installers, executables, zips, and scripts into compiled packages. Chocolatey integrates w/SCCM, Puppet, Chef, etc. Chocolatey is trusted by businesses to manage software deployments. - community.chocolatey.org

· 1 month ago

The free community edition is a solid yes for Windows admins and developers who script software installs. Businesses running fleets should compare Chocolatey for Business against PDQ Deploy or Microsoft's built-in winget before paying.

Confidence

Medium. Based on ~40 public sources: Reddit threads, G2/Capterra listings, a CERT advisory, vendor docs, pricing pages, and case studies. Several source snippets were truncated, so user quotes could not be extracted verbatim.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support-quality evidence in sources
  • Security posture

Pricing

Free

Open Source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Chocolatey for Business$17.60/license/year

Best for

  • Windows devs automating machine setup
  • Sysadmins scripting software deployment
  • Orgs already running Puppet, Chef, or SCCM
  • Power users batch-installing apps

Not for

  • Casual users — winget already ships with Windows
  • Mac/Linux-only shops — Windows-only tool
  • GUI-first admins — try PDQ Deploy instead
  • Teams wanting fleet reporting on the free tier

Gotchas - check before you buy

high

Serpent malware campaign distributed packages via Chocolatey; vet anything before org-wide deployment

medium

CVE-2020-15264: privilege escalation in companion Boxstarter tool; keep everything patched

medium

Guess: Business licenses renew annually per machine — costs compound across large fleets

medium

Guess: free tier has no official support; you rely on docs and community forums

Pros and cons

Pros

  • Free, open-source CLI automates Windows installs from installers, zips, scripts
  • Integrates with SCCM, Puppet, and Chef pipelines
  • Proven at scale at Yelp and Facebook
  • Business tier is $17.60 per license, per year
  • Large community repository of prebuilt packages

Cons

  • Community-maintained packages; safety and upkeep vary
  • Has been abused by malware and phishing campaigns
  • Windows-only — useless outside Microsoft shops
  • Fleet management and reporting require paid Business tier

Sources & method

- 12 sources - Signed binaries and security docs, but the ecosystem has been abused in malware and phishing campaigns.

official x4review x5security x3
  • CVE-2020-15264 — Boxstarter privilege escalation (VU#208577), CERT tracked a privilege vulnerability in Chocolatey's Boxstarter companion tool.
  • Serpent malware campaign abused Chocolatey, Attackers used the Windows package manager to distribute malware, per BleepingComputer.
  • French phishing campaign used Chocolatey branding, Vendor published a response; this was impersonation, not a product breach.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free core; $17.60/license/year business tier
  • Ease of use: 4/5. Guess: one-command installs, CLI-first learning curve
  • Feature depth: 4/5. SCCM/Puppet/Chef integrations; fleet features paywalled
  • Support quality. No support-quality evidence in sources
  • Security posture: 3/5. Signed binaries and docs; abuse campaigns, one CVE
  • 4.8/5 Capterra rating 6 reviews
  • $17.60 Chocolatey for Business per license per year
  • Yes Free tier Open-source CLI + community repo

Pricing

Open Source

Free

  • Full CLI for local installs
  • Access to community package repository
  • Guess: community support only

Chocolatey for Business

$17.60/license/year

  • Central Management reporting
  • Self-Service Anywhere
  • SCCM/Puppet/Chef integrations

Security

Signed binaries and security docs, but the ecosystem has been abused in malware and phishing campaigns.

  • CVE-2020-15264 — Boxstarter privilege escalation (VU#208577)CERT tracked a privilege vulnerability in Chocolatey's Boxstarter companion tool.⁸
  • Serpent malware campaign abused ChocolateyAttackers used the Windows package manager to distribute malware, per BleepingComputer.⁹
  • French phishing campaign used Chocolatey brandingVendor published a response; this was impersonation, not a product breach.

What users say

Reddit and G2 users generally trust it for automated Windows installs while debating community package safety; Capterra shows 4.8/5.

Alternatives

Compare Chocolatey Software with each alternative.

  • Winget

    Free, first-party package manager built into Windows 10/11

  • PDQ Deploy & Inventory

    GUI-first Windows deployment and patching for IT teams

  • Scoop

    Guess: lightweight command-line installer aimed at developers

    Chocolatey Software vs Scoop

  • Ninite

    Guess: dead-simple bulk app installer for non-technical users

Companies that use it

  • Yelp
  • Facebook11
  • Puppet
  • Zero
Full analysis

Based on ~40 public sources: Reddit threads, G2/Capterra listings, a CERT advisory, vendor docs, pricing pages, and case studies. Several source snippets were truncated, so user quotes could not be extracted verbatim.

Free Windows package manager: easy win for devs and admins; casual users already have winget, fleets should compare.

Methodology

Based on ~40 public sources: Reddit threads, G2/Capterra listings, a CERT advisory, vendor docs, pricing pages, and case studies. Several source snippets were truncated, so user quotes could not be extracted verbatim.

Read how a report is made.

Sources

  1. Chocolatey Community Repositorycommunity.chocolatey.org
    official
  2. Chocolatey Pricingchocolatey.org
    official
  3. Chocolatey for Businesschocolatey.org
    official
  4. Chocolatey Capterra Reviewscapterra.com
    review
  5. Chocolatey G2 Reviewsg2.com
    review
  6. Reddit: How safe and secure is Chocolateyreddit.com
    review
  7. TrustRadius: Chocolatey vs PDQ Deploy & Inventorytrustradius.com
    review
  8. CERT VU#208577 — Boxstarter privilege escalationkb.cert.org
    security
  9. BleepingComputer: Serpent malware campaign abuses Chocolateybleepingcomputer.com
    security
  10. Chocolatey docs: Securitydocs.chocolatey.org
    security
  11. Case study: Managing Windows at Facebookchocolatey.org
    official
  12. FlowDevs: Chocolatey vs Wingetflowdevs.io
    review

Add this review to your site

This check for Chocolatey Software says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Chocolatey Software Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.