dalao.ai

Excalidraw

Virtual whiteboard for hand-drawn diagramsOpen source

About Excalidraw

Excalidraw is an online whiteboard whose drawings look sketched by hand. excalidraw.com works with no sign-up; drawings stay in the browser by default, and shared links and live sessions are end-to-end encrypted. The editor itself is an MIT-licensed React component that Notion, Replit, an Obsidian plugin and others have built in. For team storage and collaboration there's Excalidraw+, a paid product run by Excalidraw s.r.o.

EditorialUpdated 9 min read

The Excalidraw interface

What problem it solves

Engineers sketching an architecture, PMs mapping a flow, teachers working through a problem: often all anyone needs is a few boxes and arrows, and firing up Visio or Figma feels like overkill. Excalidraw opens straight onto a canvas with rectangles, diamonds, ellipses, arrows, lines, a free-draw pen, an eraser and text. Arrows snap to shapes and take labels, the canvas is infinite, and there's undo, zoom, pan and dark mode. Lines come out slightly wobbly on purpose, so everyone can tell at a glance that it's a sketch, not a final spec.

Drawings export to PNG, SVG or the clipboard, or save as an open-format .excalidraw JSON file. excalidraw.com is a PWA that works offline and autosaves in the browser. For sharing, there are read-only links and live collaboration rooms.

It started with Christopher Chedeau, vjeux on GitHub, whose profile says he's a front-end engineer at Facebook. His blog post of January 15, 2020 says he began on January 1 that year. For about ten years he'd drawn blog illustrations with a tool called Zwibbler and wanted something to replace it; he admits he started while putting off writing performance reviews. Within two weeks the project had 12,000 unique active users, 1,500 GitHub stars and 26 contributors, and he gave commit access to anyone who landed a pull request. The hand-drawn look comes from the open source Rough.js library, and CodeSandbox and Zeit helped get it off the ground. The same post sets out the project's core value: as little friction as possible before drawing starts, so the shape tools come first on the page. He says he actively blocked proposals to add title selection and login to protect that. At least three people told him to quit his job and build a startup around it; his answer was that he wouldn't, but "the business is up for grab." Chedeau had earlier led the open-sourcing of React Native.

David Luzar, dwelle on GitHub, then took over development. His profile lists him as an Excalidraw co-founder. The business side belongs to Excalidraw s.r.o.: its terms of service specify Czech governing law, and it runs the paid Excalidraw+ accounts, cloud storage and AI features. Donations to the open source project go through Open Collective.

The last big release was library version 0.18.0 on March 11, 2025. It added a command palette, multiplayer undo and redo, editable element stats, text wrapping, Chinese, Japanese and Korean fonts, elbow arrows, flowcharts, scene search, image cropping and element linking. It also moved the bundle from UMD to ES modules, a breaking change. Version 0.18.1 on April 21, 2026 is a security patch for an upstream Mermaid XSS flaw, CVE-2025-54881.

An open source virtual hand-drawn style whiteboard. Collaborative and end-to-end encrypted.

Excalidraw README

Key features

End-to-end encrypted sharing. A March 2020 post on the official blog explains it. A drawing is encrypted with AES-GCM in the browser before upload, so the server only ever holds ciphertext, and the key lives after the # in the link, a part browsers never send to the server. PR #2833, merged in 2021, replaced the original all-zero IV with a random one. The catch: the link is the key, and anyone holding the full link can open the drawing.

Drops into any React app. The editor ships as an npm component; installation is npm install react react-dom @excalidraw/excalidraw. The docs cover the API, styling and self-hosted fonts. It doesn't support server-side rendering, so in Next.js it loads through a dynamic import with SSR turned off. excalidraw.com itself is built on the same component, and its source lives in the same repo.

Shape libraries and an open format. The official libraries site hosts community shape libraries, and users can also keep a personal library. Everything exports as .excalidraw JSON, which moves freely between the Obsidian plugin, the VS Code extension and the web app. Since 0.18 there are CJK fonts, and SVG export subsets fonts to keep files small.

AI and agents. The AI page lists three ways in: describe a diagram in a sentence and get an editable one back, paste Mermaid code and convert it to native shapes (no AI involved and no request limits), or let an agent such as Claude, Codex, Cursor or OpenCode draw on the canvas over MCP. The free tier gets 10 AI requests a day and Plus gets 100, or an admin can add an OpenAI, Anthropic, Gemini, Grok or OpenRouter key, and then Excalidraw's request limits no longer apply. In a Plus workspace the admin decides whether AI runs at all, which model it uses and whether members may use personal keys. API keys come read-only or write; personal keys see only what that person can see, and workspace keys never open a private collection. Every API call is logged. Agents can also lay out several screens as wireframes from a description, which can then be annotated and clicked through as a prototype.

A command-line tool. The official CLI, open-sourced in October 2026 under MIT, renders .excalidraw files to PNG locally with no account. Add an Excalidraw+ API key and it also manages scenes and collections from the terminal. Output is JSON by default, so it works with jq, scripts and AI agents. It needs Node.js 22 or newer and renders with an installed browser: Chrome, Edge, Chromium or Firefox.

How it compares

tldraw is another source-available infinite canvas that also embeds as a React component. The difference is licensing and focus. tldraw's SDK needs a commercial license in production; its site offers a 100-day trial, startup pricing and a free hobby license. Its focus is an extensible canvas SDK. Excalidraw's editor is MIT-licensed.

draw.io, made by jgraph, is a general-purpose diagram editor. Its source is Apache 2.0, though the README says it doesn't accept pull requests and only the core team develops it. It comes as a web app and a desktop app.

Commercial whiteboards such as Miro and FigJam focus on team workshops, sticky notes, voting and templates, with accounts, permissions and storage all in the vendor's cloud. On the Excalidraw side, cloud storage, access management and comments come with Excalidraw+.

Who uses it, and who it's for

As of 2026-10-25 the GitHub repo has about 134,000 stars, 15,800 forks and about 364 contributors with GitHub accounts (GitHub API, 2026-10-25). The npm downloads API shows 553,851 downloads of the @excalidraw/excalidraw package from 2026-10-16 to 2026-10-22 (as of 2026-10-26). The README names Google Cloud, Meta, CodeSandbox, the Obsidian Excalidraw plugin, Replit, Slite, Notion and HackerRank as integrators, and there's a community VS Code extension. The Excalidraw+ security page claims "thousands of customers" store their diagrams there (vendor's claim).

Who it's for

Engineers and product teams who need a quick architecture diagram, flowchart or wireframe to talk something through. Anyone who needs a no-account whiteboard for ad hoc collaboration that doesn't collect what's on the canvas. Developers who need a whiteboard inside their own React app without a commercial license. Obsidian users and other note-takers who keep sketches next to their notes.

Not for

Work that needs precise alignment, standard notation such as BPMN, UML or network diagram libraries, and polished deliverables. Companies that need sticky-note walls, voting and template marketplaces for large workshops. Teams building complex custom interactions on a canvas as the base of their own product.

Getting started

Drawing: excalidraw.com works with no account. Work autosaves to that browser and is lost when switching machines or clearing the cache; Save to file exports a .excalidraw copy. For drawing together, Share opens a live room whose link carries the key.

Embedding: the install command is npm install react react-dom @excalidraw/excalidraw, and the component is imported along with @excalidraw/excalidraw/index.css. In Next.js it loads through next/dynamic with ssr: false. Fonts load from a CDN by default; self-hosting them means copying node_modules/@excalidraw/excalidraw/dist/prod/fonts into the static folder and setting window.EXCALIDRAW_ASSET_PATH. Since 0.18 the package is ESM-only, so TypeScript's moduleResolution can't be node or node10 anymore; only bundler or node16 work. Unreleased changes ship in the @excalidraw/excalidraw@next prerelease.

Command-line rendering: the official CLI installs with npm install -g @excalidraw/cli (npx @excalidraw/cli --help also runs it), and excalidraw render drawing.excalidraw --out drawing.png turns a file into an image locally, no login needed. Both input and output accept - for stdin and stdout, so it slots into scripts and pipelines. When no browser is found, EXCALIDRAW_BROWSER_PATH points to one. Managing scenes on Excalidraw+ requires excalidraw login --api-key <key> or EXCALIDRAW_API_KEY.

Self-hosting the web app: there is an official Docker image; docker run --rm -dit --name excalidraw -p 5000:80 excalidraw/excalidraw:latest serves it on port 5000. The docs say the image has no analytics or tracking code, but sharing and collaboration don't work on self-hosted instances yet.

As of 2026-10-25 the latest library release is v0.18.1 (April 21, 2026); the previous feature release, v0.18.0, came out on March 11, 2025.

Pricing & license

The open source editor is MIT-licensed: free to use commercially, modify and redistribute. Free excalidraw.com includes the full editor, one infinite scene, unlimited collaborators, 10 AI requests a day and in-browser end-to-end encryption. Excalidraw+ Plus costs $6 per user per month billed annually or $7 billed monthly (the page says annual saves 14%), with a 14-day free trial. It adds unlimited scenes and folders, cloud saving, access management, comments, voice and screen sharing, presentations, PDF and PPTX export, 100 AI requests a day or a user-supplied key, and MCP and REST APIs in public beta (as of 2026-10-25). The pricing page's comparison table marks MCP and the REST API as not available on Free; they come only with Plus, in public beta. The official comparison page adds some finer differences: free image uploads are compressed while Plus allows up to 4K; a free personal library is stored in the browser while Plus saves it on the server; workspace libraries and library search are marked "soon." The terms say all purchases are non-refundable and a cancellation takes effect at the end of the current paid term. Users keep ownership of what they upload.

Risks & limits

On the free tier work lives only in the browser and disappears with the site data, so backups depend on exported files. With end-to-end encryption the key is in the link, so a leaked link is a leaked drawing. As commenters on Hacker News pointed out, JavaScript on the page can read what's after the #, so the scheme protects against a breached server, not if the web app itself goes wrong. Self-hosted instances can't share or collaborate. Library releases: 0.17.3 shipped on February 9, 2024, 0.18.0 on March 11, 2025 and 0.18.1, a security patch, on April 21, 2026; unreleased changes ship in the @next prerelease, and the move to ES modules in 0.18 means build config changes. Excalidraw+ keeps data in Excalidraw's cloud; the company says it's AES-256 encrypted at rest and TLS in transit, and that it holds SOC 2 Type 1 and Type 2, with the report in its Trust Center. Customer databases are backed up daily with point-in-time recovery for 14 days, and payments go through Stripe, so Excalidraw doesn't keep card details. As of 2026-10-26, open_issues_count from the GitHub API (open issues plus PRs) is 3,418.

Our verdict

Excalidraw's web app works with no sign-up, keeps drawings in the browser by default, and end-to-end encrypts shared links and live sessions; the editor is an MIT-licensed React component that embeds in other apps; cloud storage, access management and comments come with the paid Excalidraw+.

Its limits: on the free tier work lives only in the browser, so backups depend on exported files; the encryption key is in the link, so a leaked link is a leaked drawing; self-hosted instances can't share or collaborate; since 0.18.0 the library has shipped only the 0.18.1 security patch, and unreleased changes ship in the @next prerelease.

Why it stands out

Excalidraw is the whiteboard that made hand-drawn diagrams a serious format for engineers. It runs entirely in the browser, saves locally, and collaborates online with end-to-end encryption (the self-hosted image has no sharing or collaboration), so it is trusted in rooms where most tools are not.

Christopher Chedeau started it as a holiday project, David Luzar took it further, and it is now run by Excalidraw s.r.o. in the Czech Republic. As a library it is embedded by Google Cloud, Meta, Notion, Obsidian, Replit and many others. The rendering is built on Rough.js and a great deal of care about how a line should wobble.

It runs in the browser, saves locally, encrypts online collaboration end to end, and is embedded as a library by Google Cloud, Meta, Notion and others.

Sources

Official

  1. excalidraw/excalidraw (GitHub)GitHub · Accessed Oct 25, 2026
  2. Excalidraw READMEGitHub · Accessed Oct 25, 2026
  3. Excalidraw LICENSE (MIT)GitHub · Accessed Oct 25, 2026
  4. Excalidraw ReleasesGitHub · Accessed Oct 25, 2026
  5. Release v0.18.0 (2025-03-11) · excalidraw/excalidrawGitHub · Accessed Oct 25, 2026
  6. Release v0.18.1 · excalidraw/excalidrawGitHub
  7. Christopher Chedeau: Reflections on Excalidrawplus.excalidraw.com
  8. Excalidraw Blog | End-to-End Encryption in the Browserplus.excalidraw.com

Updates & reading