When a small office goes paperless, the first scanner on the shortlist usually wants a vendor account before it sends a page. You do not need that. The best scanner for Paperless-ngx is one that pushes a PDF straight into a folder on your own server over SMB or SFTP, because Paperless-ngx watches that folder, runs OCR and files the document without any app on a desktop in between.
This guide ranks five document scanners on that one ability, then sets up the receiving side: a Samba share, a chrooted SFTP drop and a Nextcloud WebDAV folder. We did not have the scanners on a bench, so the picks rest on Brother, Epson and Ricoh user guides, the SANE device lists, the Paperless-ngx scanner wiki and live Amazon listings. The receiving side is different: we tested every push in October 2026 against Paperless-ngx 3.3.4 on an Ubuntu 26.04 VM, sending PDFs with the same protocols the scanners use, and the output below comes from that box.
Picking a document scanner for Paperless-ngx
Start from where the scanner will send its files, not from pages per minute. Every pick below scans a stack of receipts faster than Paperless-ngx can OCR it, so the real differences are the network protocols, the feeder size and whether Linux can drive it over USB:
- Best overall: Brother ADS-1800W, a compact Wi-Fi scanner that sends to SMB, FTP and SFTP from its own web UI (around $310, check the live price).
- Best for a busy office: Brother ADS-4300N, wired Ethernet and an 80-sheet feeder (around $375 from a third-party seller, check the live price).
- Best for Nextcloud: Epson WorkForce ES-590W, the only pick with a native WebDAV destination and a 100-sheet feeder (around $410 from a third-party seller, check the live price).
- Best budget: Epson ES-C220, a USB-only scanner for a Linux box that runs
scanimage(around $240, check the live price). - Best ScanSnap: Ricoh ScanSnap iX2500, a polished 100-sheet scanner whose network folder feature speaks SMB up to 3.1.1 (around $380, check the live price).
If you only remember one thing, make it this: a scanner that can’t push to a share or SFTP server turns your paperless setup into a desktop chore. Brother’s own spec sheet shows the cheaper ADS-1350W and ADS-1300 can’t send to a network folder at all, which is why neither made the list even though they look like the ADS-1800W.
Testing the scan-to-folder path
A network scanner is a client. It logs in to a share or server you name, writes a PDF and disconnects, so everything that can go wrong on the server side can be tested without the scanner. We built one VM called scan01 and pushed real scanned PDFs at it with the standard Linux clients for SMB, SFTP and WebDAV, the same protocols the scanners speak. The diagram shows the path each file takes.
The lab covered the receiving side only:
- Tested: Samba share, SMB1 refusal, SFTP chroot, subfolders as tags, Nextcloud WebDAV upload
- Tested: Paperless-ngx 3.3.4 with PostgreSQL 18, Samba 4.23, Nextcloud 35 in Docker
- Not tested: the scanners themselves, their firmware and their SMB dialects
That split matters when you read the picks. Brother and Epson do not publish which SMB versions their scanners speak, so the honest advice is to point the scanner at a default Samba share first and keep SFTP or FTP as the fallback if the test page fails.
Comparing the five scanners
The columns are the specs that change the decision for a Paperless-ngx or Nextcloud setup. Speeds are the makers’ rated pages per minute, and the Linux column only covers scanning over USB from a Linux machine, which you do not need when the scanner pushes to a share on its own:
| Scanner | Feeder | Rated speed | Connection | Pushes to (no cloud) | Linux over USB |
|---|---|---|---|---|---|
| Brother ADS-1800W | 20 sheets | 30 ppm | Wi-Fi 2.4 GHz, USB-C | SMB, FTP, SFTP, email | Brother deb/rpm driver |
| Brother ADS-4300N | 80 sheets | 40 ppm | Ethernet, USB | SMB, FTP, SFTP, email | Brother deb/rpm driver |
| Epson ES-590W | 100 sheets | 45 ppm | Wi-Fi, USB | SMB, FTP/FTPS, WebDAV, email | SANE git only, not in sane-backends 1.4.0 |
| Epson ES-C220 | 20 sheets | 30 ppm | USB only | None | SANE epsonds, complete |
| Ricoh ScanSnap iX2500 | 100 sheets | 45 ppm | Wi-Fi, USB | SMB only | Not in SANE list |
Read the table from the right. If you want Nextcloud without a sync client in the middle, only the Epson has a native WebDAV destination. If the scanner sits next to a wired switch in a back office, the ADS-4300N is the only one with an Ethernet port. Everything else is a question of feeder size and budget.
Scanning to SMB and SFTP: Brother ADS-1800W
The ADS-1800W is the scanner we’d buy for a home office or a two-person team, because every destination Paperless-ngx can use is set up from the scanner’s own web page. Brother calls the targets Scan to FTP/SFTP and Scan to Network, and the Paperless-ngx scanner wiki lists FTP, SFTP, SMB and email as working on it.
It’s built for desks, not mailrooms. The feeder holds 20 sheets, the rated speed is 30 ppm, and the 2.8-inch touchscreen holds the shortcuts you set up for each destination. SFTP is the most locked-down option: it lets the scanner write into a chrooted account that can’t do anything else on the server, which we set up further down. Brother doesn’t publish which SSH key exchange methods the scanner offers, so read the SFTP section’s note on that before you rely on it.
Look elsewhere if your network is 5 GHz only or the scanner has to sit on a wired port. Brother lists Wi-Fi as 2.4 GHz 802.11b/g/n and there is no Ethernet socket, only USB-C. Brother’s guide also warns that the characters ? / \ " : < > | * may cause a sending error, caps profile names at 14 characters and uses NTLMv2 for the SMB login, so keep names short and plain. Amazon sells it directly at around $310 (check the live price).
Scanning a whole office: Brother ADS-4300N
The ADS-4300N is the same Brother scan-to stack in a bigger body with an Ethernet port, which is what you want when the scanner serves a team and nobody should be debugging Wi-Fi on a Monday morning. Brother’s online guide documents Scan to FTP/SFTP and Scan to Network for it, and the Paperless-ngx wiki lists the same four destinations as the ADS-1800W.
The 80-sheet feeder and 40 ppm rating are what you pay for. Brother also publishes a Linux scanner driver for it as deb and rpm packages (version 1.8.0-0 on the US download page), so a Linux workstation can drive it over USB when someone needs a one-off scan to their desktop.
There are three catches. It has no Wi-Fi and no touchscreen, so destinations are picked from three shortcut keys you program in the web UI. Brother’s US guide lists the Ethernet port as 10/100, not Gigabit, which is plenty for PDFs but worth knowing. And on the day we checked, Amazon only had it from a third-party seller at around $375 with limited stock, so compare sellers before you buy.
Sending scans to Nextcloud: Epson WorkForce ES-590W
The ES-590W is the pick if Nextcloud is where your files live. Epson’s user guide lists four destination types you register in Web Config: email, network folder over SMB, FTP or FTPS, and SharePoint (WebDAV) over HTTP or HTTPS. That last one can point at a Nextcloud WebDAV URL, so a scan lands in a user’s Files without a sync client or a share in between.
Its 100-sheet feeder and 45 ppm rating are the biggest here. Don’t buy it to scan over USB from Linux yet, though. Support for the ES-590W landed in SANE’s epsonds backend in its git tree in May 2026, after the sane-backends 1.4.0 release that Ubuntu 26.04 ships, so scanimage -L won’t find it on a current distro. Pushing to a share or WebDAV doesn’t involve SANE at all, so that limit only matters for desktop scanning.
WebDAV over HTTPS has one trap: the scanner checks the server’s certificate, so its clock must be right and it has to trust your CA. A setup guide for the older ES-580W had to import the Let’s Encrypt root certificates into the scanner before uploads worked. Epson does not list Ethernet in the ES-590W’s interfaces, and Amazon only had it from a third-party seller at around $410 when we checked, so check the seller and the live price. The cheaper ES-C380W has the same WebDAV option but was not in stock.
Scanning from a Linux box: Epson ES-C220
The ES-C220 can’t push anywhere on its own because it’s USB only. It earns its place for a different setup: plug it into the Linux machine that already runs Paperless-ngx, or a Raspberry Pi next to it, and let scanimage write straight into the consume folder. SANE’s epsonds backend marks it complete, so no Epson driver is needed.
You give up the touchscreen and any button that sends a scan somewhere useful. Someone has to start the scan from the Linux side, either with a script bound to a key or a tool like scanbd, so this suits one person scanning their own mail, not a shared office. At around $240 from Amazon directly (check the live price) it’s the cheapest way to feed Paperless-ngx with a sheet feeder.
Buying a ScanSnap: Ricoh ScanSnap iX2500
ScanSnaps are the scanners people already own, and the iX2500 is the current model. Its network folder feature writes to an SMB share and Ricoh documents support for SMB 1.0 through 3.1.1, NTLMv2 logins and Samba 3.6 or newer, so it should work with the share below. Because that share is hidden, connect to \\scan01\scans in Windows or smb://scan01/scans in Finder before you browse for it in ScanSnap Home. The 5-inch touchscreen and 100-sheet feeder make it the nicest scanner here to stand in front of.
The catch is that the profiles live in ScanSnap Home, Ricoh’s desktop app for Windows and macOS. A Linux-only household has no way to create them, and SANE doesn’t list the iX2500 at all. Ricoh’s help page also says the scanner needs a reachable NTP server and Privacy mode turned off before scanning to a network folder works. SMB is the only push it has, so there’s no SFTP or FTP fallback if your share refuses it. It’s around $380 from Amazon directly (check the live price).
Choosing between SMB, SFTP, FTP and WebDAV
Pick the protocol before the scanner, because it decides how much of your server the scanner can touch. Each one maps to a different setup:
- SMB: documented by all four network picks, but only Ricoh publishes its SMB versions
- SFTP: encrypted and chrooted, Brother only in this list
- FTP or FTPS: a fallback when the SMB login fails, plaintext unless FTPS
- WebDAV: straight into Nextcloud, Epson only, needs a trusted certificate over HTTPS
- Email: works, but Paperless-ngx has to poll a mailbox and the scan leaves your network
SMB version is the question that sinks most first attempts. Samba on Ubuntu 26.04 ships with server min protocol = SMB2_02, so a scanner that only speaks SMB1 gets refused before it ever sends a password. We forced a client down to SMB1 against the lab share to see what that refusal looks like:
smbclient //localhost/scans -U scanner%ExampleScan-Pass-1 --option="client min protocol=NT1" --option="client max protocol=NT1" -c lsThe server picks no protocol and the connection dies, which on a scanner shows up as a vague “connection failed” on the panel:
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Protocol negotiation to server localhost (for a protocol between NT1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSEDo not fix that by turning SMB1 back on for the whole server. Update the scanner firmware, and if it still only speaks SMB1, use its SFTP or FTP option instead. The ScanSnap has an SMB 1.0 switch in its settings, and Ricoh’s own help says to enable it only for a NAS that can’t do anything newer.
A few other buying checks matter more than the spec sheet suggests:
- Destinations set from a web UI, not a Windows app
- Single-pass duplex, so double-sided bills stay in one PDF
- A feeder that holds your normal batch, 20 sheets for mail, 80 or more for an office
- Ethernet if the scanner sits away from good Wi-Fi
On-device OCR matters less than the box suggests. Paperless-ngx OCRs any image-only PDF it consumes, but its default PAPERLESS_OCR_MODE=auto keeps a text layer the scanner already added. If a scanner’s own OCR is poor, either send plain image PDFs or set PAPERLESS_OCR_MODE=redo so Paperless-ngx redoes it.
Creating the scanner account and drop folder
Every protocol below writes as one dedicated Linux account called scanner, and Paperless-ngx reads the same folder as that account. That keeps file ownership simple: no world-writable directories and no scanner logging in as you. Create a system user with no login shell, whose home directory becomes the drop area:
sudo useradd --system --home-dir /srv/scans --create-home --shell /usr/sbin/nologin scanner
sudo mkdir -p /srv/scans/paperless
sudo chown scanner:scanner /srv/scans/paperless
sudo chown root:root /srv/scans
sudo chmod 755 /srv/scansThe last two lines look odd but they’re for SFTP later: sshd refuses to chroot into a directory the user owns. Check the IDs, because Paperless-ngx needs them in its config:
id scanner
ls -ld /srv/scans /srv/scans/paperlessOn our test server the account got UID 997 and GID 986. Yours may differ, so use the numbers you see here in the next step:
uid=997(scanner) gid=986(scanner) groups=986(scanner)
drwxr-xr-x 3 root root 4096 Oct 27 07:12 /srv/scans
drwxr-xr-x 2 scanner scanner 4096 Oct 27 07:12 /srv/scans/paperlessThe drop area is ready, but nothing reads it yet. Paperless-ngx comes next.
Running Paperless-ngx on the drop folder
Paperless-ngx watches a consume folder and imports whatever lands in it. The official Docker Compose file mounts ./consume next to the compose file, so the only change is pointing that mount at /srv/scans/paperless. If Docker is not on the box yet, the Ubuntu packages are enough (our Docker Compose on Ubuntu 26.04 guide covers the upstream repo instead):
sudo apt install -y docker.io docker-compose-v2Pull the PostgreSQL variant of the compose file and its env file from the Paperless-ngx repository, then swap the consume mount:
sudo mkdir -p /opt/paperless
cd /opt/paperless
sudo curl -fsSLo docker-compose.yml https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/docker-compose.postgres.yml
sudo curl -fsSLo docker-compose.env https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/docker-compose.env
sudo sed -i 's|- ./consume:/usr/src/paperless/consume|- /srv/scans/paperless:/usr/src/paperless/consume|' docker-compose.yml
grep -n consume docker-compose.ymlThe main branch tracks the current release, so these files can change after this guide was written. The grep should show the host path on the left of the colon; if it still shows ./consume, the upstream file changed and you’ll need to edit that volume line by hand:
54: - /srv/scans/paperless:/usr/src/paperless/consumeNow replace the env file. Open it:
sudo vim /opt/paperless/docker-compose.envReplace its contents with the settings below. USERMAP_UID and USERMAP_GID make Paperless-ngx run as the scanner account, so it can read and delete what the scanner writes. The last two lines turn subfolders into tags. Set your own secret key, password, URL and time zone:
PAPERLESS_SECRET_KEY=change-me-example-secret-key-0123456789
PAPERLESS_URL=http://scan01.example.lan:8000
PAPERLESS_TIME_ZONE=Europe/Berlin
PAPERLESS_OCR_LANGUAGE=eng
USERMAP_UID=997
USERMAP_GID=986
PAPERLESS_ADMIN_USER=admin
PAPERLESS_ADMIN_PASSWORD=ChangeMe-Example-1
PAPERLESS_CONSUMER_RECURSIVE=true
PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=trueStart the stack. The first start pulls three images and runs the database migrations, which took a little over a minute on our 2-core VM:
sudo docker compose up -d
sudo docker compose ps --format 'table {{.Name}}\t{{.Status}}'Wait for the webserver to report healthy before you send anything, otherwise the first scan sits in the folder until the consumer starts:
NAME STATUS
paperless-broker-1 Up 3 minutes
paperless-db-1 Up 3 minutes
paperless-webserver-1 Up 3 minutes (healthy)The web UI now answers on port 8000 with the admin login from the env file, but it has no documents until something lands in the folder.
Sharing the folder over Samba
Most scanners will use SMB, so the share is the main path. If you’ve never run Samba, the Samba file server guide for Ubuntu 26.04 explains the global settings; here you only need one hidden share. Install Samba and open its config:
sudo apt install -y samba smbclient jq
sudo vim /etc/samba/smb.confAppend the [scans] share at the end of the file and leave [global] alone. Ubuntu’s default server min protocol = SMB2_02 already refuses SMB1 while still accepting a scanner that tops out at SMB 2.0.2, so raising it only adds a way to fail. force user means every file lands owned by scanner no matter how the scanner authenticates:
[scans]
path = /srv/scans/paperless
valid users = scanner
force user = scanner
force group = scanner
read only = no
browseable = no
create mask = 0664
directory mask = 0775Give the scanner account a Samba password, which is what you type into the scanner’s destination form, then restart Samba:
sudo smbpasswd -a scanner
sudo systemctl restart smbd
sudo testparm -s 2>/dev/null | sed -n '/\[scans\]/,$p'Samba prints the share back with defaults hidden. If valid users or path is missing, the edit went into the wrong section:
[scans]
browseable = No
create mask = 0664
directory mask = 0775
force group = scanner
force user = scanner
path = /srv/scans/paperless
read only = No
valid users = scannerBefore you touch the scanner, push a file yourself. Any PDF in your current directory works as the test file. We used a one-page invoice scanned to an image-only PDF, so Paperless-ngx had to OCR it, and sent it with smbclient over SMB3 exactly as a scanner would:
smbclient //localhost/scans -U scanner%ExampleScan-Pass-1 -m SMB3 -c 'put invoice.pdf invoice-2026-1042.pdf'Then read the consumer log from /opt/paperless and ask the API what it stored. The screenshot shows the push, Paperless-ngx picking the file up and the OCR text it read:
OCR took about 7 seconds by the Paperless-ngx log, and the whole trip from put to a document in the API took 14 to 36 seconds across our two runs. The created date is October 1 because Paperless-ngx read “October 2026” from the invoice body, so check dates on scans with a billing month printed on them.
Turning scanner folders into tags
Brother and Epson let each destination write into its own subfolder of the share. With the two CONSUMER settings above, Paperless-ngx turns every folder name in the path into a tag. We pushed a tax return into taxes/2026/ to check:
smbclient //localhost/scans -U scanner%ExampleScan-Pass-1 -m SMB3 -c 'mkdir taxes; mkdir taxes/2026; put tax-return-2026.pdf taxes/2026/tax-return-2026.pdf'
curl -s -u admin:ChangeMe-Example-1 http://localhost:8000/api/tags/ | jq -c '.results[] | {id, name}'Both folder names came back as tags, and the document carried both of them:
{"id":2,"name":"2026"}
{"id":1,"name":"taxes"}So a “Taxes” shortcut on the scanner’s touchscreen can file straight into the right tag. Paperless-ngx deletes each file after it imports it, but leaves the empty folders behind, which is what you want for the next batch. The documents view shows all three test scans, with the tax return carrying its folder tags:
The third document came in over SFTP, which is the next setup.
Adding an SFTP drop for Brother scanners
SFTP gives a Brother scanner an encrypted login that can only write files inside /srv/scans. It needs an sshd drop-in that locks the scanner account into a chroot with no shell. Create it:
sudo vim /etc/ssh/sshd_config.d/60-scanner.confAdd the match block. PasswordAuthentication yes applies only to this account, so you can leave passwords off for everyone else:
Match User scanner
ChrootDirectory /srv/scans
ForceCommand internal-sftp
PasswordAuthentication yes
AllowTcpForwarding no
X11Forwarding noSet a login password for scanner (this one is separate from the Samba password), check the sshd config and restart it:
sudo passwd scanner
sudo sshd -t && sudo systemctl restart sshTest the login from the server before you type it into the scanner. At the sftp> prompt, run put invoice.pdf paperless/sftp-invoice-2026-1042.pdf and then bye:
sftp scanner@localhostOur first attempt failed here. With /srv/scans still owned by scanner, the client only saw Connection reset by peer, and the real reason was in the journal: fatal: bad ownership or modes for chroot directory "/srv/scans". That’s why the first section makes the chroot root-owned and mode 755. A Brother scanner shows the same failure as a generic send error, so check journalctl -u ssh on the server, not the panel. With the ownership fixed, an upload into paperless/ went through:
Inside the chroot the scanner sees / with one folder, paperless, so set the scanner’s SFTP path to /paperless. The warning in the log is real too: we sent the same invoice twice, and Paperless-ngx 3 imports duplicates by default and only logs them. Set PAPERLESS_CONSUMER_DELETE_DUPLICATES=true if someone in your office scans the same bill twice.
One thing the lab can’t prove is the key exchange. Our test used the OpenSSH client, which negotiates a modern method, but Ubuntu 26.04 ships OpenSSH 10, whose sshd no longer offers the finite-field Diffie-Hellman methods by default, and an ADS-1700W owner reported needing one of them for SFTP. If journalctl -u ssh shows no matching key exchange method found, update the scanner firmware first. Adding KexAlgorithms +diffie-hellman-group14-sha256 to sshd works too, but it applies to the whole server because KexAlgorithms isn’t allowed inside a Match block.
Sending scans straight to Nextcloud
If the team wants scans in Nextcloud rather than Paperless-ngx, the Epson’s WebDAV destination can write into a user’s Files over Nextcloud’s WebDAV endpoint. We ran Nextcloud 35 from the official nextcloud image in a container named nextcloud on port 8080, which is what the commands below assume. On a server built with our Nextcloud install guide for Ubuntu 26.04, run the same occ commands as sudo -u www-data php /var/www/nextcloud/occ and use your own URL instead of localhost:8080. Give the scanner its own Nextcloud account and an app password, so the scanner never holds a human’s login:
sudo docker exec -u www-data -e OC_PASS='ExampleScan-Pass-3' nextcloud php occ user:add --password-from-env --display-name=Scanner scanner
sudo docker exec -it -u www-data nextcloud php occ user:auth-tokens:add scannerThe second command asks for the account password. Pressing Enter without one still prints an app password, but with limited capabilities, which is fine for uploads. Copy the token it prints and test the upload path the scanner will use, creating a Scans folder first:
curl -s -o /dev/null -w 'MKCOL Scans: %{http_code}\n' -u 'scanner:APP-PASSWORD' -X MKCOL http://localhost:8080/remote.php/dav/files/scanner/Scans
curl -s -o /dev/null -w 'PUT scan.pdf: %{http_code}\n' -u 'scanner:APP-PASSWORD' -T scan.pdf http://localhost:8080/remote.php/dav/files/scanner/Scans/scan.pdfTwo 201 codes mean the folder and the file were created:
MKCOL Scans: 201
PUT scan.pdf: 201A PROPFIND against the server’s LAN address first returned HTTP 400 with Nextcloud’s untrusted domain page, which on a scanner looks like a failed send. Add the address or hostname the scanner uses to trusted_domains before you test from the panel. Check the existing entries with occ config:system:get trusted_domains first and use the next free index, because setting an index that’s taken overwrites it:
sudo docker exec -u www-data nextcloud php occ config:system:set trusted_domains 2 --value=10.0.1.50After that the same PROPFIND returned 207, and a wrong password returned 401. On the Epson, choose WebDAV (HTTPS) as the protocol and enter cloud.example.com/remote.php/dav/files/scanner/Scans in the Save to field without the https:// prefix, with the app password. That hostname must match the Nextcloud certificate and sit in trusted_domains, and the scanner needs your CA imported as covered in the ES-590W section. WebDAV (HTTP) also works, but it sends the app password in clear. If you’d rather have Paperless-ngx and Nextcloud share files, sending the scan to the Samba share and adding that folder to Nextcloud as external storage is the simpler route.
Keeping the scan inbox running
Once the first scans land, the setup mostly runs itself. A few habits keep it that way:
- Watch one log:
sudo docker compose logs -f webserverin/opt/paperless - Check the consume folder is empty; a file that stays there was never imported
- Set the scanner’s clock from NTP; Brother SMB sends, HTTPS uploads and ScanSnap sends depend on it
- Back up with
document_exporter, or thedata,mediaandpgdatavolumes with the stack stopped
The empty folder check caught a real problem in our lab. Our first test PDF was a 0-byte file after a failed conversion; it sat in /srv/scans/paperless and Paperless-ngx never created a document or logged an error for it. A scanner that drops the connection mid-send can leave the same kind of file, so ls -la /srv/scans/paperless is worth a look when a scan never shows up.
If you move the drop folder onto a NAS and mount it on the Paperless-ngx host over NFS or SMB, file system events stop arriving. The Paperless-ngx configuration docs say to switch to polling then: set PAPERLESS_CONSUMER_POLLING_INTERVAL to a number of seconds, and raise PAPERLESS_CONSUMER_STABILITY_DELAY from its 5-second default if large scans get picked up half written. Older guides call these PAPERLESS_CONSUMER_POLLING and PAPERLESS_CONSUMER_INOTIFY_DELAY, names that version 3 replaced. For the NAS itself, our small business NAS picks cover boxes that run Paperless-ngx in Docker next to the share, and if the paper pile also includes old family prints, the photo scanner guide for Immich covers that side.
