decaporg/decap-cms

What it does

Decap CMS is a single-page application written in React that you mount at an /admin address on a site you already publish. Someone visits that address, signs in, and gets a clean screen for editing the content; every change becomes a commit in the repository, so the files themselves are the content store and there is no separate database. What the screen offers is declared in one config.yml file: collections, fields and widgets, with widgets shipped for boolean, date, file, image, list, markdown, number, object, relation, select, string and text, plus components that embed inside the text. It works against several repository hosts — Bitbucket, a hosted gateway, GitHub, GitLab and a test backend — and recent work adds another. It does not implement passwords at all: its own security document states the project "does not store passwords, delegating authentication to providers". An optional editorial workflow adds draft, review and ready states, backed by branches and pull requests. It supports several languages, media folders and pluggable media libraries. It does not have a content interface of its own, no database and no server-side part in the default install — it is a browser program talking to a repository host. It does not host or build the website. The editorial workflow does not work against a local repository through the development proxy, which its own documentation states. And centralised user management, advanced roles, a database proxy and paid support are all routed to a commercial offering, so they are outside the open-source part.

Why it matters

Who it suits. Anyone running a site built from files — a documentation site, a company blog, a marketing site — who needs a non-technical colleague to change the text without learning git or opening an editor. It suits that job better than a database-backed system because there is nothing extra to run, back up or patch, and the content history is the repository history. Skip it if you want live collaborative editing, several people typing in one document at once, which it does not do. Skip it too if you want a content interface other programs can read from, because there isn't one.

What people say. The most authoritative outside account is three and a half years old and is about ownership rather than quality. Netlify's own engineering blog, in a post by Min Kim on 23 February 2023, announced that it was handing the project — then called Netlify CMS — to an agency partner, which renamed it Decap CMS and took over the packages, the accounts, the repositories and the website; Netlify is the party giving the project away and it sells the hosting and identity services the default configuration leans on, so that is a first-party announcement with a commercial interest, not analysis. Joost van der Schee at the web agency Usecue corroborated the handover independently in a post dated 24 February 2023; a practitioner's note, and his firm builds the kind of sites this software serves. Beyond 2023 there is no credible dated review of it that we could find — the searches returned only auto-generated directory pages, and we used none of them. One more thing belongs here because it is a competitor's claim and must carry its own label: the README of sveltia/sveltia-cms describes itself as a "complete modern rewrite", says Decap "has been neglected for years", and claims to have solved 365 reported issues from Decap's tracker. That is a rival project stating its case, none of it independently verified, and the checkable part cuts against the strong version: Decap released version 3.16.3 on 22 September 2026 and merged work in early October 2026.

Verdict. Still the sensible default for this job, with one caveat about resourcing and one about development safety. It is not abandoned — code landed on 8 October 2026, five pull requests were opened on 2 October, and the newest release is three weeks old — but 565 open issues on a project whose own security document says it is "a community-maintained open-source project without dedicated security staff" is a real signal about how much attention it can give. The thing to be careful about is the local development proxy, npx decap-server: it listens on port 8081, has no authentication of any kind, writes to your repository on behalf of whoever reaches it, and does not bind to the local machine only unless you tell it to. Before version 3.8.0 it accepted requests from anywhere. If you want a drop-in replacement whose compatibility is the whole pitch, look at sveltia/sveltia-cms; if you want visual editing on the page itself, tinacms/tinacms does that and was Edition 35's late substitution.