Pixelorama is a pixel art editor for drawing sprites, tiles and animations. It has a frame and layer timeline with onion skinning, pixel-perfect lines, indexed colour mode, palettes, tilemap layers for rectangular, isometric and hexagonal tiles, and rotation and scaling algorithms designed for pixel art, such as cleanEdge and OmniScale. Non-destructive layer effects like outlines and drop shadows can be changed later without touching the artwork.
It is built with the Godot game engine, which makes it a natural fit for game developers: it exports PNG, sprite sheets, animated PNG, GIF and video, attaches custom metadata to layers and frames, and can batch-export from the command line. A web version runs in the browser with nothing to install, and community extensions add tools such as converting pixels to voxels.
It is MIT-licensed, with about 10,800 stars and 98 contributors, at v1.2.3 when scanned, for Windows, macOS, Linux and the web.
- Repository: github.com/Orama-Interactive/Pixelorama
- Licence: MIT (MIT License)
- Language: GDScript. Stars: 10.8K. Forks: 588. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit 70454ff
Who it is for
Pixel artists and indie game developers who want a capable, free alternative to paid sprite editors, and beginners who want to try pixel art in a browser first.
Getting started
1. Windows (winget)
winget install OramaInteractive.Pixelorama2. macOS (Homebrew)
brew install --cask pixelorama3. Linux (Flathub)
flatpak install flathub com.orama_interactive.PixeloramaThe web version runs at orama-interactive.github.io/Pixelorama with no install. Builds are also on GitHub releases, itch.io and Steam. To run it from source you need Godot 4.7.1.
Safety scan
We cloned Orama-Interactive/Pixelorama at commit 70454ff on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no install hooks. The scanner does not count GDScript, the language most of Pixelorama is written in, so its line total of about 5,300 covers only the Python, Markdown and YAML around the roughly 250 GDScript files.
- The 2 committed binaries are addons/applinks/bin/debug/applinks-debug.aar and the matching release file, 4 KB Android libraries used by an app-links plugin for the Android build. The desktop and web versions do not use them.
- Almost no outside hosts: a few links to gitlab.com, gnu.org and Stack Overflow. There is no package manager lockfile in a Godot project, so there was nothing to check for advisories.
- 5 workflows, none using pull_request_target; none of the 7 third-party actions is pinned to a commit. Its OpenSSF Scorecard is 3.5 out of 10, which reflects process (little formal code review, no branch protection or security policy) rather than anything in the code. Dependabot and contributing guide present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 2 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 5 workflows. None use pull_request_target. 7 of 7 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 3 distinct hosts referenced from source; most often gitlab.com, www.gnu.org, stackoverflow.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | 3.5 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Committed binaries (2)
addons/applinks/bin/debug/applinks-debug.aar: JAR, 4 KBaddons/applinks/bin/release/applinks-release.aar: JAR, 4 KB
By the numbers
| Stars | 10.8K |
|---|---|
| Forks | 588 |
| Contributors | 98 |
| Commits | 4,266 |
| Open issues | 67 |
| Open pull requests | 18 |
| Releases | 46 |
| Latest release | v1.2.3 |
| Licence | MIT |
| Main language | GDScript |
| Project age | 7 years |
| Last push | Oct 25, 2026 |
| Tracked files | 1,383 |
| Lines of code | 5,283 |
| Checkout size | 13 MB |
Lines by language: Python 2,208, Markdown 2,034, YAML 550, JSON 415, Shell 76.
Questions
Is Pixelorama free?
Yes. Pixelorama is free and open source under the MIT licence, including the web version and the GitHub, winget, Homebrew and Flathub builds. The project accepts support through Patreon.
Can I use Pixelorama in the browser?
Yes. The web version on GitHub Pages has the same editor and saves files through your browser's download and upload dialogs, so nothing is stored on a server.
Can Pixelorama export sprite sheets for games?
Yes. It exports sprite sheets as well as PNG, animated PNG, GIF and video, can attach custom data to layers and frames, and can batch-export from the command line for a build pipeline.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.