PhotoCraft is a free image editor that sets out to do what Photoshop does. Its authors describe it as a clean-room reimplementation written entirely in Rust: layers, masks, adjustment layers, layer styles, type, vectors, brushes, filters with live previews, CMYK and Lab colour at up to 32 bits per channel, and real PSD and PSB files that it opens and saves back. It is a native app with no Electron and no web view, the canvas is drawn on the GPU, and it needs no account.
It comes from the ArtCraft team as one of their Crafting Apps, alongside tools for vector art, video and PDFs. The repository is only about five weeks old, created on 30 September 2026, and already has about 78,000 stars, 539 contributors and 24 releases, the latest being v0.21.0. Every menu item runs a command from a single registry of more than 500, so a script or an AI agent can do what you can click, through a command-line tool or an MCP server.
Be realistic about what it is today. The project itself labels this early alpha and says it is not yet a Photoshop replacement for daily professional work. The gaps it lists are AI and generative features, 15 missing tools, depth in typography and professional workflows, and plug-in compatibility.
- Repository: github.com/storytold/photocraft
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Rust. Stars: 77.6K. Forks: 13.7K. Last push: Nov 7, 2026.
- Scan: safe, Nov 7, 2026, commit f68e227
Who it is for
People who want to open and edit PSD files without an Adobe subscription and can live with rough edges, hobbyist editors on Mac, Windows or Linux, and developers who want to batch-edit images or have an agent do it. Professionals with deadlines should wait.
Getting started
1. Easiest: download the app from the project page
https://getartcraft.com/apps/photocraft2. Or pick a specific build: Windows .msi, macOS .dmg, Linux AppImage, .deb, .rpm or Flatpak
https://github.com/storytold/photocraft/releases/latest3. Optional: edit from the terminal with the command-line tool
photocraft-cli run wave.psd --cmd filter.sharpen.smartSharpen --params '{"amount":80}' --out wave-final.png4. Optional: let an AI agent drive it over MCP
photocraft-cli mcpOur scan covers the source code, not the prebuilt installers. The project says its Windows installers are code-signed and its Mac app is signed and notarized, and each release includes SHA256 checksums and signatures.
Safety scan
We cloned storytold/photocraft at commit f68e227 on Nov 7, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits. The 1 pattern hit is a test file, crates/codecs/tests/it/tiff_photoshop.rs, holding a run of raw bytes that mimic Photoshop metadata in a TIFF.
- 10 advisories across 902 pinned packages: 1 high and 9 unrated. The high one is in lopdf 0.38.0, where a PDF with deeply nested objects can overflow the stack, so a crafted file can crash the app. Seven of the unrated ones only say a Rust library is no longer maintained. The other two are one certificate-checking issue in the TLS libraries behind the network update check.
- The one committed binary, crates/algo/data/libfacedetection.bin (about 107 KB), is the weights of a small face detection network from the BSD-licensed libfacedetection project. It powers Detect Faces in Select > Color Range and Face-Aware Liquify, and runs on your machine with no model download or cloud service. The browser build leaves it out.
- 5 files named build.rs, none of which downloads anything. Two embed the Windows icon and version info, one optionally embeds fonts, one bakes in the contributor credits, and crates/text/src/psd/build.rs is ordinary source code rather than a build script. No npm hooks and no installer scripts.
- The README says offline, with one exception in its docs: the desktop app asks GitHub for the latest release once at launch. It sends no document or personal data, and you can turn it off under Preferences > General. None of the 29 hosts is an analytics service; they are mainly GitHub, file-format references such as ns.adobe.com and the release signing services.
- 10 workflows, none using pull_request_target. 27 of 40 third-party actions are pinned to a commit. Dependabot is on and there is a security policy, though it says there is no dedicated private channel for reporting yet. The scanner sees no licence file only because the licences are two files, LICENSE-MIT and LICENSE-APACHE.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 5 Cargo build scripts |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 10 workflows. None use pull_request_target. 13 of 40 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 29 distinct hosts referenced from source; most often github.com, ns.adobe.com, www.calligra.org, getartcraft.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 10 advisories across 902 pinned packages: 0 critical, 1 high, 0 moderate, 0 low, 9 unrated. Cargo.lock: 901 packages, 10 advisories; examples/plugins/invert-rs/Cargo.lock: 1 packages, 0 advisories. |
| Project hygiene | Has security policy, automated dependency updates. Missing CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| crates/codecs/tests/it/tiff_photoshop.rs:11 | long-hex-escape-run (test/example) | img.meta.photoshop_resources = Some(b"8BIM\x03\xed\x00\x00\x00\x00\x00\x10\x00\x48\x00\x00\x00\x01\x00\x01\x00\x48\x00\x00\x00\x01\x00\x01".to_vec()); |
Committed binaries (1)
crates/algo/data/libfacedetection.bin: .bin, 107 KB
Worst known vulnerabilities (10 of 10)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-6fj4-rcr3-r7rr | high | lopdf@0.38.0 | lopdf has a stack overflow via deeply nested PDF objects |
| RUSTSEC-2024-0436 | unknown | paste@1.0.15 | paste - no longer maintained |
| RUSTSEC-2024-0370 | unknown | proc-macro-error@1.0.4 | proc-macro-error is unmaintained |
| CVE-2026-111943 | unknown | rustls-webpki@0.103.15 | Certificate verification may accept distrusted intermediates |
| RUSTSEC-2026-0206 | unknown | rustybuzz@0.20.1 | `rustybuzz` is unmaintained |
| RUSTSEC-2026-0192 | unknown | ttf-parser@0.25.1 | `ttf-parser` is unmaintained |
| CVE-2026-111943 | unknown | webpki-root-certs@1.0.9 | Bundled root certificates allow trust in distrusted emSign intermediates |
| RUSTSEC-2026-0371 | unknown | zbus_names@4.3.4 | `zbus_names` is unmaintained |
| RUSTSEC-2026-0370 | unknown | zvariant@5.15.0 | `zvariant` is unmaintained |
| RUSTSEC-2026-0372 | unknown | zvariant_derive@5.15.0 | `zvariant_derive` is unmaintained |
By the numbers
| Stars | 77.6K |
|---|---|
| Forks | 13.7K |
| Contributors | 539 |
| Commits | 9,773 |
| Open issues | 2,456 |
| Open pull requests | 1,310 |
| Releases | 24 |
| Latest release | v0.21.0 |
| Licence | Apache-2.0 |
| Main language | Rust |
| Project age | 5 weeks |
| Last push | Nov 7, 2026 |
| Tracked files | 3,002 |
| Lines of code | 1M |
| Checkout size | 79 MB |
Lines by language: Rust 926.8K, JSON 39.9K, Markdown 30.4K, TOML 4,246, Shell 1,549, YAML 1,431.
Questions
Is PhotoCraft free?
Yes. The code is open source under your choice of MIT or Apache-2.0, the downloads are free, and there is no account. The ArtCraft logos and brand assets are under their own terms, which only matters if you fork it.
Can PhotoCraft replace Photoshop?
Not yet, by its own account. Much of Photoshop's surface exists in some form, but the project calls itself early alpha and says it is not ready for daily professional work. AI and generative features and plug-in compatibility are among its biggest gaps. It is worth trying, not worth moving a business onto.
Does it open my PSD files properly?
Its own test figures are strong: 307 of 309 files in the psd-tools test set render the same after opening and re-saving. Those are the project's numbers, not ours, and we did not test them. Keep your originals while it is in alpha.
How does it relate to ArtCraft?
It is made by the ArtCraft team, as one of their free Crafting Apps. It is a separate app that stands on its own. We also list ArtCraft in our directory at /artcraft/.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.