Shotcut is a full video editor for Windows, macOS and Linux that costs nothing and has no watermark. It edits on a multi-track timeline with audio and video filters, transitions, keyframes, colour correction, titles and speed changes, and because it is built on FFmpeg through the MLT framework, it opens almost any format directly without converting it first. Proxy editing keeps 4K footage smooth on modest hardware.
It has been developed for more than a decade by Dan Dennedy, who also leads MLT, the engine underneath Kdenlive and several other editors, and it ships a new release roughly every month. That steady pace, plus the fact that it runs the same on all three desktop systems, is why it is one of the standard answers to "what is a free video editor".
The interface is denser than consumer editors and takes an hour or two to learn, and it is not aimed at heavy colour grading or effects work. Version 26.9.27 was current when scanned; it is GPL-3.0 with about 15,500 stars.
- Repository: github.com/mltframework/shotcut
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: C++. Stars: 15.5K. Forks: 1,550. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit 70bc326
Who it is for
YouTubers, students and anyone who needs more than a phone editor but does not want to pay for Premiere or Final Cut, particularly on Linux, where good editors are scarce.
Getting started
1. macOS (Homebrew)
brew install --cask shotcut2. Linux (Flathub)
flatpak install flathub org.shotcut.Shotcut3. Windows installer, portable ZIP and other downloads
open https://www.shotcut.org/download/Safety scan
We cloned mltframework/shotcut at commit 70bc326 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no install hooks and no bare-IP URLs. The scanner's 1.1 million TypeScript lines are Qt translation files, which also use the .ts extension; the editor itself is about 95,000 lines of C++.
- Of 1,206 committed binary files, almost all are .tgs animated emoji stickers in the elements folder. The rest is Dr. Mingw (drmingw/x64), an open-source crash-report helper for MinGW builds on Windows: drmingw.exe, exchndl.dll, mgwhelp.dll, plus Microsoft's dbghelp.dll and symsrv.dll.
- The only Shotcut server in the code is check.shotcut.org, used for the optional check for a new version. Everything else is licence text and documentation links.
- No known advisories: the two lockfiles are tiny helper packages for exporting chapters and EDL files.
- 8 workflows, none using pull_request_target. OpenSSF Scorecard rates it 1.7 with a zero for dangerous workflows, because two build workflows put github.head_ref into a shell command; both run only on a schedule or by hand, never on pull requests. No third-party action is pinned to a commit. Licence and contributing guide present; no security policy or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 1,206 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 8 workflows. None use pull_request_target. 10 of 10 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 34 distinct hosts referenced from source; most often www.gnu.org, github.com, forum.shotcut.org, www.apache.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 0 advisories across 3 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. src/qml/export-chapters/package-lock.json: 2 packages, 0 advisories; src/qml/export-edl/package-lock.json: 3 packages, 0 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 1.7 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Committed binaries (1206)
drmingw/x64/bin/dbghelp.dll: PE (Windows executable), 2 MBdrmingw/x64/bin/mgwhelp.dll: PE (Windows executable), 797 KBdrmingw/x64/bin/drmingw.exe: PE (Windows executable), 204 KBdrmingw/x64/bin/symsrv.dll: PE (Windows executable), 137 KBdrmingw/x64/lib/libmgwhelp.a: .a, 84 KBelements/emojis/nature/083-lizard.tgs: .tgs, 51 KBdrmingw/x64/bin/exchndl.dll: PE (Windows executable), 28 KBelements/emojis/object/100-notebook.tgs: .tgs, 15 KBelements/emojis/object/123-package.tgs: .tgs, 11 KBelements/emojis/nature/003-gorilla.tgs: .tgs, 10 KBelements/emojis/object/013-kimono.tgs: .tgs, 10 KBelements/emojis/nature/078-peacock.tgs: .tgs, 10 KBelements/emojis/food/002-melon.tgs: .tgs, 9 KBelements/emojis/person/170-wrestling.tgs: .tgs, 9 KBelements/emojis/person/133-villain.tgs: .tgs, 9 KBelements/emojis/travel/026-japanese_shiro_castle.tgs: .tgs, 9 KBelements/emojis/person/158-showgirls.tgs: .tgs, 9 KBelements/emojis/activity/003-fireworks.tgs: .tgs, 9 KBelements/emojis/food/080-moon_cake.tgs: .tgs, 9 KBelements/emojis/nature/123-fern_plant.tgs: .tgs, 8 KBelements/emojis/nature/023-zebra.tgs: .tgs, 8 KBelements/emojis/person/139-genie.tgs: .tgs, 8 KBelements/emojis/person/164-surfing.tgs: .tgs, 8 KBelements/emojis/person/168-mountain_bike.tgs: .tgs, 8 KB- and 1,182 more
By the numbers
| Stars | 15.5K |
|---|---|
| Forks | 1,550 |
| Contributors | 83 |
| Commits | 7,418 |
| Open issues | 45 |
| Open pull requests | 6 |
| Releases | 196 |
| Latest release | v26.9.27 |
| Licence | GPL-3.0 |
| Main language | C++ |
| Project age | 14 years |
| Last push | Oct 25, 2026 |
| Tracked files | 3,160 |
| Lines of code | 1.1M |
| Checkout size | 89 MB |
Lines by language: TypeScript 985.6K, C++ 95.6K, C/C++ header 18.6K, JavaScript 15.9K, Shell 4,246, Markdown 1,063.
Questions
Is Shotcut free?
Yes. Shotcut is free and open source under GPL-3.0, with no watermark, no account and no paid tier.
Is Shotcut good for beginners?
It is usable after an hour or so, and the official site has video tutorials. It is more capable and more cluttered than simple editors like Clipchamp or iMovie, so expect to learn where the filters and timeline tools live.
Can Shotcut edit 4K video?
Yes. It supports 4K and higher resolutions, and its proxy editing feature creates lighter copies of your footage for smooth playback while editing, then exports from the originals.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.