Self-Hosted Hand-Drawn Whiteboard

Design & Creative

A hand-drawn style whiteboard website that runs on your own computer: draw boxes, arrows and text from the toolbar, export PNG or SVG, or save a file that can be edited again. Entering the site takes a username and password generated at random by a script, and the canvas content is kept in the user’s own browser. The settings that connect to the upstream cloud services were closed at build time. Derived from a frozen snapshot of an open-source project under the MIT licence; the delivery adds a Dockerfile that builds the image from source, a single-service orchestration file, a script that generates the username and password, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness3 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who want to draw flowcharts and sketches on a hand-drawn style whiteboard on their own machine, and do not want to hand the drawings to a cloud service.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview1,333 paths

▸dev-docs71

.gitignore
README.md
babel.config.js
docs/
docusaurus.config.js
package.json
sidebars.js
src/
static/
tsconfig.json
…

▸examples38

with-nextjs/
with-script-in-browser/

▸excalidraw-app53

App.tsx
CustomStats.tsx
ExcalidrawPlusIframeExport.tsx
app-jotai.ts
app-language/
app_constants.ts
bug-issue-template.js
collab/
components/
data/
…

▸firebase-project6

.firebaserc
.gitignore
firebase.json
firestore.indexes.json
firestore.rules
storage.rules

▸packages1061

common/
element/
eslintrc.base.json
excalidraw/
fractional-indexing/
laser-pointer/
math/
tsconfig.base.json
utils/

▸public26

Assistant-Regular.woff2
Cascadia.woff2
Virgil.woff2
_headers
android-chrome-192x192.png
android-chrome-512x512.png
apple-touch-icon.png
favicon-16x16.png
favicon-32x32.png
favicon.ico
…

▸scripts24

build-locales-coverage.js
build-node.js
build-version.js
buildBase.js
buildDocs.js
buildPackage.js
buildUtils.js
buildWasm.js
locales-coverage-description.js
quickstart/
…

▫AGENTS.md

▫ATTRIBUTION.md

▫CLAUDE.md

▫CONTRIBUTING.md

▫Dockerfile

▫Dockerfile.quickstart

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫crowdin.yml

▫delivery-manifest.txt

▫docker-compose.yml

▫package.json

▫setupTests.ts

▫tsconfig.json

▫vercel.json

▫vitest.config.mts

▫yarn.lock

▫Config and hidden files 33

Latest passing run

Clone → Checkout → Toolchain → Build images → Whiteboard auth and offline build

Pre-purchase Disclosure

What you are buying

A self-hosted hand-drawn style whiteboard: draw boxes, arrows and text from the toolbar, export an image or save a file that can be edited again. Entering the site takes a username and password, and the canvas content is kept in your own browser. You bring it up with Docker Compose.

Derived from an open-source project under the MIT licence, and not the original project itself. Our work: the settings that connect to the upstream cloud services closed at build time, a password-protected web server, an orchestration file, a credential generation script and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 47a5e18.

Known limitations

The service listens only on port 3000 of the local machine 127.0.0.1, over plain HTTP, and the password check is not encrypted in transit
There is a single shared username and password, with no multiple users or permissions
The canvas content is kept in the browser’s local storage and not on the server
Switching browser, changing the address or clearing browser data makes the original drawings invisible
The connections for share links, live collaboration, AI drawing and the paid edition link were closed at build time
The menu may still show buttons for the features above
Address strings for the library and for the paid edition are still in the built files
The first build downloads packages from the network, fetching from registries and package repositories during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit b7de45e. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start without WHITEBOARD_HTPASSWD; a single service), Dockerfile.quickstart (base images fixed by digest; build-offline.vars is read in before the build), scripts/quickstart/build-offline.vars (empties the endpoints that point to the upstream cloud services and turns usage reporting off), scripts/quickstart/nginx.conf (every path except the liveness check needs a username and password), scripts/quickstart/40-write-htpasswd.sh (it refuses to start without a password hash) and scripts/quickstart/init-env.sh (openssl generates a random username and password, .env is mode 600, existing credentials are not overwritten). The upstream front-end source was not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and 40-write-htpasswd.sh are ours (read line by line); the build goes through Dockerfile.quickstart (read line by line: yarn installs from the lock file, the front end is built and the output is copied into an nginx image, with no download piped straight into a shell). The changes to upstream’s index.html and font plugin only remove outbound connections and add no download that runs.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Excalidraw. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the front-end dependencies are declared in package.json and locked by yarn.lock, and the packages themselves are fetched from the package repository when the buyer builds; the base images come from a registry. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).