three.js is how most 3D on the web gets made. It wraps the browser's low-level graphics APIs in friendly building blocks: a scene, a camera, meshes, materials, lights and a renderer. A spinning cube takes about twenty lines, and the same library powers product configurators, data visualizations, portfolio sites, browser games and many of the 3D effects you see on landing pages.
The core ships WebGL and WebGPU renderers, with SVG and CSS3D renderers as add-ons. Around it sit loaders for glTF, FBX, OBJ and other 3D formats, post-processing effects, physics and VR and AR helpers, plus more than 600 live examples, a manual and full documentation on threejs.org. The site also hosts a free browser-based editor for arranging scenes.
three.js was started by Ricardo Cabello (mrdoob) and has been open source since 2010. It is MIT-licensed, with about 118,000 stars and more than 2,600 contributors. Release r187 came out on 30 October 2026.
- Repository: github.com/mrdoob/three.js
- Licence: MIT (MIT License)
- Language: JavaScript. Stars: 118.3K. Forks: 37K. Last push: Nov 13, 2026.
- Scan: safe, Nov 13, 2026, commit acf77e4
Who it is for
Web developers adding 3D to a site or app, creative coders and designers making interactive experiences, and game and visualization builders who want to stay in JavaScript. You need some JavaScript to use the library.
Getting started
1. Add it to your project
npm install three2. Then import it in your code
import * as THREE from 'three';3. Browse the live examples for something to start from
https://threejs.org/examples/Safety scan
We cloned mrdoob/three.js at commit acf77e4 on Nov 13, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits across 6,098 files and about 1.1 million lines, mostly JavaScript and HTML examples. The 11 pattern hits are all very long lines in vendored, minified libraries (acorn, esprima, the meshoptimizer decoders, a TIFF reader) and two copies of the SMAA anti-aliasing lookup textures written as data.
- The 19 committed binaries are example assets: 16 glTF and model .bin files, one FBX head model and two EXR textures used by the examples and the manual. None is an executable.
- 2 advisories, both in the development lockfile: a moderate one in minimatch and a low one in deepmerge, used by build and test tools. The library itself has no runtime dependencies.
- The hosts are what a graphics library documents: threejs.org, GitHub, Khronos and MDN references, CDNs for the examples, and links to papers and Shadertoy. We found no analytics service.
- Six workflows, no pull_request_target, and both third-party actions are pinned to commits. A security policy, Renovate, CodeQL, contributing guide and code of conduct are present. OpenSSF Scorecard gives it 7.2 out of 10.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 11 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 19 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 6 workflows. None use pull_request_target. 0 of 2 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, threejs.org, en.wikipedia.org, www.ecma-international.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 2 advisories across 250 pinned packages: 0 critical, 0 high, 1 moderate, 1 low. package-lock.json: 252 packages, 2 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | 7.2 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (11)
| Where | Rule | Match |
|---|---|---|
| editor/js/libs/acorn/acorn.js:36 | very-long-line | 4317 chars |
| editor/js/libs/esprima.js:4644 | very-long-line | 6677 chars |
| editor/js/libs/esprima.js:4646 | very-long-line | 8007 chars |
| examples/jsm/libs/meshopt_clusterizer.module.js:7 | very-long-line | 21948 chars |
| examples/jsm/libs/meshopt_decoder.module.js:7 | very-long-line | 9482 chars |
| examples/jsm/libs/meshopt_decoder.module.js:9 | very-long-line | 13788 chars |
| examples/jsm/libs/meshopt_simplifier.module.js:7 | very-long-line | 34473 chars |
| examples/jsm/libs/utif.module.js:454 | very-long-line | 4381 chars |
| examples/jsm/loaders/materialx/MaterialXNodeInterfaceRegistry.js:525 | very-long-line | 3042 chars |
| examples/jsm/postprocessing/SMAAPass.js:218 | very-long-line | 44306 chars |
| examples/jsm/tsl/display/SMAANode.js:701 | very-long-line | 44306 chars |
Committed binaries (19)
manual/examples/resources/models/cartoon_lowpoly_small_city_free_pack/scene.bin: .bin, 4 MBexamples/models/fbx/Head_69.fbx: .fbx, 2 MBexamples/textures/piz_compressed.exr: .exr, 2 MBexamples/textures/matcaps/040full.exr: .exr, 1 MBexamples/models/gltf/MaterialsVariantsShoe/glTF/MaterialsVariantsShoe.bin: .bin, 706 KBexamples/models/gltf/DamagedHelmet/glTF/DamagedHelmet.bin: .bin, 559 KBmanual/examples/resources/models/animals/Zebra.bin: .bin, 557 KBmanual/examples/resources/models/animals/Cow.bin: .bin, 512 KBmanual/examples/resources/models/animals/Horse.bin: .bin, 468 KBmanual/examples/resources/models/knight/KnightCharacter.bin: .bin, 457 KBmanual/examples/resources/models/animals/Llama.bin: .bin, 401 KBmanual/examples/resources/models/animals/Pig.bin: .bin, 396 KBmanual/examples/resources/models/animals/Sheep.bin: .bin, 395 KBmanual/examples/resources/models/animals/Pug.bin: .bin, 384 KBmanual/examples/resources/models/3dbustchallange_submission/scene.bin: .bin, 292 KBmanual/examples/resources/models/mountain_landscape/scene.bin: .bin, 137 KBexamples/models/gltf/DamagedHelmet/glTF-instancing/GpuInstancingRotation.bin: .bin, 1 KBexamples/models/gltf/DamagedHelmet/glTF-instancing/GpuInstancingScale.bin: .bin, 1 KBexamples/models/gltf/DamagedHelmet/glTF-instancing/GpuInstancingTranslation.bin: .bin, 1 KB
Worst known vulnerabilities (2 of 2)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-g3hv-75wg-m249 | moderate | minimatch@10.2.6 | minimatch has potential denial of service via globparts amplification |
| GHSA-gcqx-w48m-w2h4 | low | deepmerge@4.3.1 | deepmerge mergeObject() allows prototype poisoning of returned objects |
By the numbers
| Stars | 118.3K |
|---|---|
| Forks | 37K |
| Contributors | 2,619 |
| Commits | 48.6K |
| Open issues | 258 |
| Open pull requests | 145 |
| Releases | 179 |
| Latest release | r187 |
| Licence | MIT |
| Main language | JavaScript |
| Project age | 16 years |
| Last push | Nov 13, 2026 |
| Tracked files | 6,098 |
| Lines of code | 1.1M |
| Checkout size | 592 MB |
Lines by language: JavaScript 551.7K, HTML 404.7K, Markdown 105.3K, JSON 38.7K, CSS 8,980, GLSL 1,600.
Questions
Is three.js free?
Yes. three.js is free and open source under the MIT licence, including for commercial projects.
Do I need to know WebGL to use three.js?
No. That is the point of it. You work with scenes, cameras, meshes and lights, and three.js handles the WebGL or WebGPU calls. Knowing some 3D basics such as coordinates and materials helps.
Can I make games with three.js?
Yes, many browser games use it, but it is a rendering library, not a full game engine. For a complete engine with an editor, physics and export to desktop and mobile, Godot, also on this list, is the closer fit.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.