DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-03
- 📦 Latest release: v0.18.1 (2026-04-21)
- 🐞 Open issues: 3479
- 🌟 Stars: 135.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: excalidraw.com
- Source: github.com/excalidraw/excalidraw
- License: MIT
- Deployment: Browser-Based / Local-First | Docker Container
- Jurisdiction: Czechia 🇨🇿 / EU 🇪🇺 (Excalidraw s.r.o.)
- Compliance (SaaS): Excalidraw+ security and compliance page
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Minimal (1/5) - A static site served from one nginx container; the editor runs and stores drawings in each user's browser, and nothing of the app runs on the server
- Maintenance: Minimal (1/5) - Pull or rebuild the static image; no database, migrations or server-side state to back up
- User Management: Minimal (1/5) - No accounts, roles or audit log in the free build: anyone with a room link can join, and TLS is left to your proxy
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? Excalidraw is a virtual whiteboard for sketching diagrams in a hand-drawn style on an infinite canvas. It runs in the browser, saves drawings there and exports them as open JSON files, and it encrypts shared and collaborative drawings in the browser before they leave it. It serves anyone who sketches ideas, flows or architecture, alone or with others.
The Strategic Verdict:
- 🔴 For organisations that must control who sees a drawing: Caution. The free build has no accounts or roles, and every install sends usage data to a third-party analytics service with no setting to stop it (User Management, The Compliance Shift).
- 🟢 For individuals sketching diagrams on their own devices: Strong Buy. A static site with no license fee keeps drawings in each user's browser and exports them as open JSON files (Complexity, Cost of Ownership, Exit).
2. Cost of Ownership
| Cost Component | Excalidraw (Self-Hosted) |
|---|---|
| Pricing Model | No license fee |
| Operations | Alongside existing services; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the owner: Excalidraw+, a managed service; for self-hosted installs, community support or a paid service provider |
| Exit | Scene files (.excalidraw JSON, images embedded) |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: Excalidraw s.r.o., the project's owner, is registered in Czechia, under EU law and the GDPR. The owner runs Excalidraw+, a hosted service where your data can live; its hosts include a party domiciled in or controlled from the US. Data that party holds for Excalidraw+ is within reach of the US CLOUD Act, wherever it is stored, if the party is based in the US or its US parent controls the data.
- The Compliance Shift: Every install sends usage data to Simple Analytics B.V. in the Netherlands with no setting to switch it off, so the operator must account for that transfer in its own compliance work. Live collaboration, share links and AI requests go to the owner's own servers by default, and only a rebuild with your own backends changes that. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist). Any audit of Excalidraw+ (such as SOC 2 or ISO 27001) covers the owner's own systems, never your install.
- License Risk: Excalidraw is under MIT, an OSI-approved permissive license (what it allows and requires). MIT lets anyone, the owner included, release modified versions under other terms, closed ones too.
4. Market Landscape
🏢 Proprietary Incumbents
- Miro: Miro is a cloud workspace where teams plan and design together on shared boards.
Data held by: RealtimeBoard, Inc., United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Its audit logs and choice of data region come only on its top plan.
Exit: PDF, image, CSV or board backup file per board, Board Export API, bulk export only in a higher tier, partial export (comments, votes) - Lucidchart: Lucidchart is a cloud workspace for diagramming and data visualization.
Data held by: Lucid Software Inc., United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Single sign-on, user provisioning and a choice of data region come only on its top plan.
Exit: PDF, image, Visio, CSV or JSON per document, REST API; bulk backup as a .laf file, proprietary format, partial export (tasks, notes, interactive actions)
🤝 Open-Source Alternatives
—