shouldiuse.io

Categories

VERDICT

Penpot Review

Depends

Should I use Penpot?

Open-source design platform for teams building digital products, spanning design, code, and AI workflows. - penpot.app

· 1 month ago

Buy if you want a free or self-hosted design tool and can accept rougher edges than Figma. Skip if your team already runs on Figma or needs a spotless security record.

Confidence

Medium. Based on 40+ public sources; many review snippets were truncated, so quotes may be partial.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence found
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Professional$7/mo
EnterpriseCustom

Best for

  • Startups dodging per-seat design bills
  • Teams needing self-hosting or data control
  • Design-dev duos wanting open standards
  • Open-source-first orgs

Not for

  • Teams already fluent in Figma
  • Anyone wanting Figma-level polish and plugin breadth
  • Security-sensitive orgs without staff to patch or self-host
  • Buyers wanting turnkey enterprise support

Gotchas - check before you buy

medium

Community openly asks how long the free tier stays free; pricing may shift

medium

Five pricing editions; admin console and governance gated to higher plans

medium

Leaving Figma means relearning workflows; reviewers cite parity gaps

low

Self-hosting needs DevOps effort; managed hosting via Elestio costs extra

Pros and cons

Pros

  • Free, open-source core with self-host or on-prem option
  • Open standards mean flexibility and less vendor lock-in
  • Used by more than 10,000 companies
  • Judged a mature Figma alternative by reviewers
  • Flex/CSS grid layouts, plugins, and AI MCP experiments

Cons

  • G2 reviewers say Figma still edges it out
  • Some users call it a budget Figma clone
  • Modest 4.0/5 user rating on SoftwareAdvice
  • Several 2026 CVEs, including a critical RCE
  • Even fans admit they keep re-testing without committing

Sources & method

- 12 sources - Active 2026 CVE record — including a critical MCP remote code execution — though the vendor publishes a security whitepaper and supports self-hosting.

official x1review x6security x2news x3
  • CVE-2026-45805: Critical RCE via Penpot MCP, Remote code execution vulnerability in Penpot's MCP integration, rated critical.
  • CVE-2026-47666: Stored XSS, Penpot vulnerable to stored cross-site scripting.
  • CVE-2026-26202: Arbitrary file read, Information disclosure flaw, CVSS 7.5.
  • CVE-2026-17613: Auth bypass, Authorization bypass vulnerability.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free core; paid starts $7/mo
  • Ease of use: 3/5. Reviewers say Figma still smoother
  • Feature depth: 4/5. Flex, grid, plugins, AI MCP experiments
  • Support quality. No support evidence found
  • Security posture: 2/5. Multiple 2026 CVEs including critical RCE
  • 4.0/5 User rating SoftwareAdvice
  • $7/mo Starting price paid tier, after free
  • Yes Free tier free open-source core
  • 250K+ Users as of $12M raise, 2023

Pricing

Free

$0

  • Open-source core
  • Self-host available

Professional

$7/mo

  • Paid team features

Enterprise

Not disclosed

  • Centralized admin console
  • Deploy in your cloud or on-premises

Security

Active 2026 CVE record — including a critical MCP remote code execution — though the vendor publishes a security whitepaper and supports self-hosting.

  • CVE-2026-45805: Critical RCE via Penpot MCPRemote code execution vulnerability in Penpot's MCP integration, rated critical.10
  • CVE-2026-47666: Stored XSSPenpot vulnerable to stored cross-site scripting.
  • CVE-2026-26202: Arbitrary file readInformation disclosure flaw, CVSS 7.5.11
  • CVE-2026-17613: Auth bypassAuthorization bypass vulnerability.

What users say

Users praise the free open-source model, but many say Penpot still trails Figma on polish.

“I stopped using Figma and switched to Penpot”
XDA Developers
“I really want to love penpot.”
Reddit, r/Penpot
“It just feels like a poor mans Figma”
Reddit, r/UXDesign

Alternatives

Compare Penpot with each alternative.

Full analysis

Based on 40+ public sources; many review snippets were truncated, so quotes may be partial.

Free open-source Figma rival: great for self-hosters and tight budgets, but polish and security lag; Figma teams shouldn't switch.

Methodology

Based on 40+ public sources; many review snippets were truncated, so quotes may be partial.

Read how a report is made.

Sources

  1. Penpot review | TechRadartechradar.com
    review
  2. Penpot Reviews 2026 | G2g2.com
    review
  3. Penpot Reviews | SoftwareAdvicesoftwareadvice.com
    review
  4. Experience using Penpot | Redditreddit.com
    review
  5. I stopped using Figma and switched to Penpot | XDAxda-developers.com
    review
  6. Should you ditch Figma for open-source? | LogRocketblog.logrocket.com
    review
  7. Penpot Pricing | officialpenpot.app
    official
  8. Penpot draws up $12M | TechCrunchtechcrunch.com
    news
  9. Penpot Raises $8M Series A | BusinessWirebusinesswire.com
    news
  10. CVE-2026-45805 Penpot MCP RCE | SentinelOnesentinelone.com
    security
  11. CVE-2026-26202 | NVDnvd.nist.gov
    security
  12. Penpot MCP AI workflows | Smashing Magazinesmashingmagazine.com
    news

Add this review to your site

This check for Penpot says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Penpot Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.