Penpot: the open-source Figma alternative you can self-host for free

The math on design collaboration tools keeps getting worse: Figma charges per editor seat, your files live in a proprietary format, and the data sits on someone else’s cloud. Penpot runs the other direction — MPL-2.0 licensed, self-hostable, and written in Clojure for a decade now; the repository dates to late 2015 under the name UXBOX and went public in 2021. The mechanism worth seeing first: design files are plain SVG, CSS, HTML and JSON with no proprietary binary, so your design assets are things you can actually walk away with. The repository counted 60,621 stars as of October 3, 2026, and version 2.18.1 shipped on October 1. The WeChat account 山风与路 ran a detailed write-up on October 3 that even verified issue numbers — this entry leaned on that legwork.

Core features

• Files are code: designs are stored in open standard formats, and the Inspect panel hands developers real CSS and HTML instead of eyeballed spacing. The official README states it as the core claim: “works with open standards like SVG, CSS, HTML, and JSON.”
• Native design tokens: tokens follow the W3C DTCG spec — change a color, size or spacing value once and every reference updates, with JSON export that feeds straight into a frontend style library.
• Real CSS Grid and Flexbox: layout behavior on the canvas follows the same rules the browser runs, removing a translation layer between design and implementation.
• Self-hosting has no seat fees: what you pay for is governance — the Enterprise plan ($25/member/month) adds an admin console, SSO and auditing, on both cloud and self-hosted. The cloud free tier caps at 8 members with unlimited viewers and 10GB of storage; Unlimited is $7/member/month (vendor pricing page, October 2026). The free self-hosted edition rides on the open-source code; the official phrasing, as quoted by the article, is “unlimited users, teams and files.”
• MCP server: officially provided and model-agnostic, with the pitch that the canvas becomes a programmable space — AI agents can read and also write your design files. The npm package @penpot/mcp is at version 2.15.4, and local mode starts with a single npx @penpot/mcp@stable.
• Still moving fast: canvas rendering is migrating from SVG toward WASM plus WebGL (the render-wasm commits), with the export service following onto the new renderer.

Typical use cases

• Teams with hard data-compliance requirements: self-host into your own security and backup policies so design data never leaves the building — the official site leads with this.
• Design-system teams: tokens, components and themes managed in one place, with library-wide updates on a single change.
• Engineering teams bringing AI into the design flow: the MCP server works with Claude, Cursor, Codex and friends, letting agents work directly on the canvas.

Quick start

Self-hosting wants a Linux server and Docker; the official path is a compose file:

curl -o docker-compose.yaml \
  https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml
docker compose -p penpot -f docker-compose.yaml up -d

It listens on port 9001 by default; add a reverse proxy for production since real-time collaboration depends on WebSockets. If you’d rather not operate anything, the cloud at penpot.app has a free tier with no card required.

Summary

This fits teams that value data sovereignty and open formats over a maximal plugin ecosystem; designers deep in Figma’s community and plugin world will feel the gap. Two pieces of background: Adobe abandoned its Figma acquisition in December 2023, but Penpot had already established itself — sign-ups jumped 5,600% in a single day when the deal was announced in 2022 (reported by CNBC and TechCrunch), and it closed an $8M Series A led by Decibel that same year. Second, the Clojure stack is genuinely hard to hire for, which is why a ~40-person team at Spain’s Kaleidos has been carrying the project. Three cautions: a connected MCP agent can write to your canvas — create, rename, move, delete, restyle — and the official advice is to verify the setup with read-only actions first; issue #11939 tracks a batch of CVE dependency fixes labeled as a release blocker for 2.19.0; and issue #11957 reports background MCP plugins being interrupted when another plugin opens. MPL-2.0 is file-level weak copyleft and friendly to commercial use, so building a product on top is unobstructed.