UI design in the browser, expressed as SVG, CSS and HTML
Penpot is a design and prototyping platform for user interfaces. It runs in the browser, either on the vendor's cloud or on a server you run yourself, and describes designs with open formats: SVG, CSS, HTML and JSON. The project aims to bring design closer to the shipped product, and to let organizations with strict compliance rules keep the whole design environment in-house. Several people can edit the same file in real time, and solo work is fine too.
CSS Grid layouts, W3C design tokens and an Inspect tab
- Boards lay out with CSS Grid and Flex, so a responsive design behaves like code from the start. Grid support arrived in version 2.0.
- The Inspect tab shows the SVG, CSS and HTML for whatever is selected.
- Design tokens are native and follow the W3C format. They apply to components and to their variants.
- An MCP server lets AI agents read existing designs and create new ones.
- An API with access tokens, webhooks and a plugin system connect the workspace to the rest of a development toolchain.
A Figma alternative on eight containers, with a proprietary paid tier
Positioning: the open source alternative to Figma. That is the headline of the vendor's comparison page against Figma. It sets an Inspect tab that is free on every plan against Figma's Dev Mode, and describes the migration path: export from Figma with the Penpot Exporter plugin, then import into Penpot.
Constraint: eight containers in the official compose file. Frontend, backend, exporter, MCP server and admin console, plus PostgreSQL 15, Valkey 8.1 and Mailpit. Mailpit only catches outgoing mail, so production needs a real SMTP server. The docs strongly recommend HTTPS because some browser APIs don't work without it.
Constraint: outbound calls are on by default. The compose file enables anonymous telemetry, and the frontend's Nginx proxies requests to GitHub for libraries and templates and to Google for fonts. The enable-air-gapped-conf flag removes those proxies, and with them the libraries dashboard and Google Fonts.
Audience: product teams, with sizing counted per editor. The README is aimed at teams building digital products at scale. The recommended settings say 4 CPUs and 16 GB of RAM on the server are enough for thousands of users, with a 50 to 100 GB database for up to ten editors and about 5 GB more per additional editor. Penpot leans heavily on the browser, which is why the docs ask for powerful workstations and recommend the latest stable Chrome.
License: MPL-2.0 core, proprietary admin layer. The FAQ on the pricing page puts it plainly: all core features are open source, and Enterprise adds a proprietary security and management layer made of organizations, an admin console and paid modules. In the cloud, Professional is free, Unlimited costs $7 per editor per month (capped at $175) and Enterprise $25 per member per month. The README lists SSO as an Enterprise feature, yet the configuration docs already cover OIDC, LDAP, Google, GitHub and GitLab login on a self-hosted instance.
Status: version 2.18.5, released October 26, 2026. A minor version ships every one to two months (2.16.0 in June, 2.17.0 in July, 2.18.0 on September 23), followed by closely spaced patches: five for 2.18 during October. Docker images land shortly after each SaaS update. The docs advise upgrading in small steps and warn that the admin console, added to the compose file in 2.18, will be required in a future release.