4.8/5
Capterra rating
6 reviews
Report
Should I Use Chocolatey Software?
Chocolatey is software management automation for Windows that wraps installers, executables, zips, and scripts into compiled packages. Chocolatey integrates w/SCCM, Puppet, Chef, etc. Chocolatey is trusted by businesses to manage software deployments.
Depends
DependsThe free community edition is a solid yes for Windows admins and developers who script software installs.
Free Windows package manager: easy win for devs and admins; casual users already have winget, fleets should compare.
Confidence: Medium
$17.60
Chocolatey for Business
per license per year
Yes
Free tier
Open-source CLI + community repo
Value for money
5
Free core; $17.60/license/year business tier
Ease of use
4
Guess: one-command installs, CLI-first learning curve
Feature depth
4
SCCM/Puppet/Chef integrations; fleet features paywalled
Security posture
3
Signed binaries and docs; abuse campaigns, one CVE
Pros
Cons
Gotchas
- highSerpent malware campaign distributed packages via Chocolatey; vet anything before org-wide deployment⁹
- mediumCVE-2020-15264: privilege escalation in companion Boxstarter tool; keep everything patched⁸
- mediumGuess: Business licenses renew annually per machine — costs compound across large fleets³
- mediumGuess: free tier has no official support; you rely on docs and community forums
Best for
- Windows devs automating machine setup
- Sysadmins scripting software deployment
- Orgs already running Puppet, Chef, or SCCM
- Power users batch-installing apps
Not for
- Casual users — winget already ships with Windows
- Mac/Linux-only shops — Windows-only tool
- GUI-first admins — try PDQ Deploy instead
- Teams wanting fleet reporting on the free tier
Companies that use it
- Yelp
- Facebook11
- Puppet
- Zero
Pricing
Open Source
Free
- Full CLI for local installs
- Access to community package repository
- Guess: community support only
Chocolatey for Business
$17.60/license/year
- Central Management reporting
- Self-Service Anywhere
- SCCM/Puppet/Chef integrations
Security
Signed binaries and security docs, but the ecosystem has been abused in malware and phishing campaigns.
- CVE-2020-15264 — Boxstarter privilege escalation (VU#208577)CERT tracked a privilege vulnerability in Chocolatey's Boxstarter companion tool.⁸
- Serpent malware campaign abused ChocolateyAttackers used the Windows package manager to distribute malware, per BleepingComputer.⁹
- French phishing campaign used Chocolatey brandingVendor published a response; this was impersonation, not a product breach.
What users say
Reddit and G2 users generally trust it for automated Windows installs while debating community package safety; Capterra shows 4.8/5.
Alternatives
Compare Chocolatey Software with each alternative.
Winget
Free, first-party package manager built into Windows 10/11
Chocolatey Software vs WingetPDQ Deploy & Inventory
GUI-first Windows deployment and patching for IT teams
Scoop
Guess: lightweight command-line installer aimed at developers
Chocolatey Software vs ScoopNinite
Guess: dead-simple bulk app installer for non-technical users
Chocolatey Software vs NiniteFull analysis
Based on ~40 public sources: Reddit threads, G2/Capterra listings, a CERT advisory, vendor docs, pricing pages, and case studies. Several source snippets were truncated, so user quotes could not be extracted verbatim.
Sources
- Chocolatey Community Repositorycommunity.chocolatey.orgofficial
- Chocolatey Pricingchocolatey.orgofficial
- Chocolatey for Businesschocolatey.orgofficial
- Chocolatey Capterra Reviewscapterra.comreview
- Chocolatey G2 Reviewsg2.comreview
review
- TrustRadius: Chocolatey vs PDQ Deploy & Inventorytrustradius.comreview
security
- BleepingComputer: Serpent malware campaign abuses Chocolateybleepingcomputer.comsecurity
- Chocolatey docs: Securitydocs.chocolatey.orgsecurity
- Case study: Managing Windows at Facebookchocolatey.orgofficial
- FlowDevs: Chocolatey vs Wingetflowdevs.ioreview
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.