--- url: /en/compare/decap-cms.md description: >- How Sveltia CMS and Decap CMS, formerly Netlify CMS, compare on maintenance, security, performance and features, including what Sveltia CMS can’t do. --- # Sveltia CMS vs. Decap CMS Netlify CMS stalled in early 2022. Two projects carry it on today: * **Decap CMS** is Netlify CMS renamed. A Netlify agency partner took it over in February 2023 and kept the React codebase. * **Sveltia CMS** is a rewrite from scratch in Svelte, started in November 2022. It shares no code with Netlify CMS but reads the same configuration file. We make Sveltia CMS, so read this page with that in mind. The [full comparison](/en/docs/successor-to-netlify-cms) cites the Decap CMS issue behind each point. Figures were checked on November 11, 2026. ![Sveltia CMS vs. Decap CMS](/images/highlights/sveltia-vs-decap.webp?20261112) ## Short Answer * **New site**: Use Sveltia CMS. Decap CMS is only the better choice if you need one of the [features Sveltia CMS doesn’t have](#what-decap-cms-has-that-sveltia-cms-doesn-t). * **Existing Decap CMS site on GitHub, GitLab, Gitea or Forgejo**: Switch. For most sites, it’s a one-line change. * **Existing site on Git Gateway, Bitbucket or Azure DevOps**: You can’t switch without moving to another backend first. ## At a Glance | | Sveltia CMS | Decap CMS | | --- | --- | --- | | Codebase | New, written in Svelte | Netlify CMS, written in React | | Version | 0.x, with 1.0 planned for late 2026 | 3.x | | Releases in the past year | 331 | 19 | | Longest release gap in the past year | 14 days | 46 days | | Commits in the past year, excluding bots | 2,584 | 330 | | Longest commit gap in the past year, excluding bots | 4 days | 21 days | | Weekly npm downloads | 37.8k (`@sveltia/cms`) | 25.6k (`decap-cms-app`) | | GitHub stars | 3.1k | 19.5k, mostly from the Netlify CMS years | | Contributors | {{ stats.contributorCount }}, with outside pull requests limited to localization and small fixes | 575, most of them from the Netlify CMS years | | Showcase of real sites | [{{ stats.siteCount }} sites](/en/showcase), {{ stats.fromNetlifyDecapCount }} of them moved from Netlify/Decap CMS | None, only an examples page of 26 templates and demos | | Testimonials | [{{ stats.testimonialCount }} from developers](/en/#developers-love-sveltia-cms) | None on its website | | Typical bug fix | Within 8 hours | Many reports get no response | | Open issues | 28 | 377 | | Open pull requests | 0 | 45 | | Open discussions | 71 | 147 | | Discussions started in the past year | 93 | 8 | | Bundle size (gzipped) | Under 800 KB | 1.4 MB | | Packages installed from npm | 47, with no known vulnerabilities | 496, with 32 known vulnerabilities | | Content loading on GitHub and GitLab | All at once with GraphQL | REST by default, GraphQL opt-in | | Local editing | In Chromium browsers, no server | Needs the `decap-server` proxy | | Dark mode | Follows the system setting | No | | Phones and tablets | Optimized for touch, installable as an app | Responsive layout since 3.13 (June 2026) | | I18n | Built in from the start | Basic, with [documented limitations](https://decapcms.org/docs/i18n/#limitations) | | Asset management | Full Asset Library | File picker dialog | | Backends | GitHub, GitLab, Gitea, Forgejo | Same, plus Git Gateway, Bitbucket and Azure DevOps | | License | MIT, free | MIT, free, with optional hosting that’s paid for teams | | Funding | The maintainer and sponsors | The maintainer company, Decap Turbo, a public grant and sponsors | Sources: [npm registry](https://www.npmjs.com/package/@sveltia/cms), [Sveltia CMS releases](https://github.com/sveltia/sveltia-cms/releases), [Decap CMS releases](https://github.com/decaporg/decap-cms/releases), the [Sveltia CMS](https://github.com/sveltia/sveltia-cms) and [Decap CMS](https://github.com/decaporg/decap-cms) repositories. The download figures are for November 6 to 12, 2026. For the same week a year earlier, they were 1.1k for Sveltia CMS and 9.7k for Decap CMS. `decap-cms` is a wrapper that installs `decap-cms-app`, so counting both would count the same installs twice. Neither figure includes sites that load the CMS from a CDN. Contributor counts exclude bots and AI agents. Sveltia CMS only [accepts pull requests](https://github.com/sveltia/sveltia-cms/blob/main/CONTRIBUTING.md#pull-requests) for localization and trivial changes such as typo fixes, so almost all of its code comes from the maintainer. Of the 575 people who have contributed to Decap CMS, 443 did so only before the takeover in February 2023. Only 132 have contributed since then. ## Maintenance Sveltia CMS ships several releases a week. Bug reports are usually fixed within 8 hours, sometimes within an hour or two. So far, it has solved 395 issues filed against Netlify/Decap CMS, or 870 counting duplicates. Decap CMS still runs the Netlify CMS codebase. Its maintainers took over code they didn’t write, along with its backlog: by [their own count](https://decapcms.org/state-of-decap/), 377 issues are open, many of them feature requests from the Netlify CMS years. Decap CMS releases irregularly, sometimes with more than two months between patch releases. Its first release under the new name took six months. Many bug reports go without a response, and issues were [closed as stale](https://github.com/decaporg/decap-cms/issues?q=is%3Aissue+%22Closing+as+stale%22) after the takeover without being fixed. Of the 45 open [pull requests](https://github.com/decaporg/decap-cms/pulls), 17 have been waiting for more than a year, two of them from the Decap CMS team. Twelve have been waiting for more than two years. Sveltia CMS is maintained by one developer, [Kohei Yoshino](https://github.com/kyoshino), with 2,584 commits to its main branch in the past year. Decap CMS is maintained by a company, but the work is effectively less than one full-time developer’s. In the past year, one person made 227 of the 381 commits to its [main branch](https://github.com/decaporg/decap-cms/commits/main), 186 of them between August and October 2026. Before August, that person averaged about five commits a month. Dependabot made another 51. Decap CMS maintainers are sometimes absent for weeks. The main maintainer made no commits for 43 days from January 8, 2026, and for 38 days from June 15. Four times in the past year, nobody but Dependabot committed anything for about three weeks. ## Funding Sveltia CMS is [funded by its maintainer](/en/docs/faq#why-is-it-free) and its [sponsors](https://github.com/sponsors/kyoshino), with 8 current public sponsors on GitHub. It has no paid service. Decap CMS is funded by its maintainer company, PM d.o.o., and by Decap Turbo, its paid hosting service. [Decap CMS says](https://decapcms.org/state-of-decap/) Turbo exists to keep the open source project maintained. Yet the Decap CMS [roadmap](https://decapcms.org/features/#roadmap) lists three features, all of them for Turbo and none for the open source CMS. The project was also awarded a [€60,000 public grant](https://czk.si/podprti_projekti/decap-cms-40/) from Slovenia’s Centre for Creativity for “Decap CMS 4.0”. The grant page lists Turbo subscriptions as a goal, aiming for 150 subscribers in the first year. Sponsorship of Decap CMS is small: 3 current public sponsors on [GitHub](https://github.com/sponsors/decaporg) and $1,321 received in total on [Open Collective](https://opencollective.com/decap). There, it has more admins than backers: 6 admins and 5 backers, not counting donations synced from GitHub Sponsors. ## Security Both projects have had vulnerabilities. The difference is how severe they were and how they were handled. * **Sveltia CMS** has published [12 security advisories](https://github.com/sveltia/sveltia-cms/security/advisories): 8 low and 4 medium. Each one was fixed within a few hours of being reported and names the release with the fix. * **Decap CMS** has published [6 advisories](https://github.com/decaporg/decap-cms/security/advisories), all in September and October 2026: 2 critical, 2 high, 1 medium and 1 low. The two critical ones are in `decap-server`, the proxy that Decap CMS needs for local editing. How Decap CMS handled them: * An [XSS vulnerability](https://github.com/advisories/GHSA-xp8g-32qh-mv28) reported in September 2025 still lists no patched version. No security update was announced for it. * A [proxy server vulnerability](https://github.com/decaporg/decap-cms/issues/7692) reported in January 2026 was fixed a week later, but the fix wasn’t released until late February. No advisory was published at the time. * A [path traversal vulnerability](https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr) in `decap-server`, rated critical, was reported in April 2026 and took four months to fix. When the reporter posted the details publicly, the maintainers deleted the issue without replying. The CVE was then credited to a second reporter. See [issue #8037](https://github.com/decaporg/decap-cms/issues/8037). * Until version 3.13.0, the Markdown preview rendered HTML without sanitizing it by default, which [allowed XSS](https://github.com/decaporg/decap-cms/security/advisories/GHSA-38w6-4fqr-x68q). Sveltia CMS has sanitized it by default since version 0.105.0. Dependencies tell the same story. Installing the latest `@sveltia/cms` from npm adds 47 packages, and `npm audit` finds no known vulnerabilities. Installing `decap-cms-app` 3.17.3 adds 496 packages, with 32 known vulnerabilities. The 7 rated high all come from the old Markdown parser that Decap CMS still uses. * In October 2026, Decap CMS [added overrides](https://github.com/decaporg/decap-cms/pull/8046) to force patched versions of some vulnerable packages. Overrides only apply inside Decap CMS’s own repository, so sites that install it from npm still get the vulnerable versions. * The Plate editor behind its RichText widget has an [XSS advisory](https://github.com/advisories/GHSA-qrfj-mgw8-j9c6) from September 2026. The [upgrade that fixes it](https://github.com/decaporg/decap-cms/pull/8047) has been open since October 23. Sveltia CMS has no proxy server, so the `decap-server` vulnerabilities don’t apply to it. Its builds are published with npm provenance, and GitHub commits made by the CMS are signed. All of the last 100 commits to the Sveltia CMS repository are signed as well. For Decap CMS, 76 of the last 100 commits by people rather than bots are unsigned. See [Security](/en/docs/security) and the [full comparison](/en/docs/successor-to-netlify-cms#better-security). ## Performance * **Smaller bundle**: under 800 KB gzipped, against 1.4 MB for Decap CMS. * **Svelte**: Sveltia CMS is written in Svelte, which compiles to efficient JavaScript. Decap CMS is written in React, which runs a virtual DOM and a large runtime. * **Fewer requests**: on GitHub and GitLab, Sveltia CMS fetches all content at once with GraphQL, so entries and assets are listed and searched instantly. Decap CMS fetches files one by one over REST unless `use_graphql` is turned on, and Relation fields can send hundreds of extra requests. * **Faster saves**: saving to GitHub uses a single GraphQL mutation. * **No proxy for local editing**: Sveltia CMS reads and writes a local repository through the browser’s File System Access API, which is only available in Chrome, Edge and other Chromium-based browsers. Decap CMS works in any browser but sends every read and write through `decap-server`. Details: [Better Performance](/en/docs/successor-to-netlify-cms#better-performance). ## Editing Things content editors notice right away: * **Other people’s changes aren’t lost**: Sveltia CMS checks the repository before every save and warns if someone else changed the entry. Decap CMS saves over the other change without a warning. See [Conflict Resolution](/en/docs/ui/content-editor#conflict-resolution). * **Rich text that doesn’t crash**: the editor is built on [Lexical](https://lexical.dev/). The Slate-based editor in Decap CMS has a long record of crashes, lost formatting on paste and broken input in Chinese, Japanese and Korean. * **A real Asset Library**: folders, renaming, replacing, bulk upload and download, and a list of the entries using each file. Renaming or deleting a file updates the entries that use it. Decap CMS only offers a file picker dialog. * **Search**: full-text search across all collections, sorted by relevance. * **Bulk editing**: change many entries in a table and save them in one commit. Details: [Better Content Editing](/en/docs/successor-to-netlify-cms#better-content-editing). ## User Experience * **Dark mode**: Sveltia CMS follows the system’s light or dark appearance by default, and either one can be chosen in the settings. Decap CMS has no dark mode. A [request for one](https://github.com/decaporg/decap-cms/issues/3267) has been open since February 2020. * **Phones and tablets**: more than a responsive layout, with navigation built for small screens, floating action buttons, larger buttons and QR code sign-in from a desktop. The CMS can also be installed as an app. Decap CMS only made its layout responsive in 3.13 (June 2026). * **Keyboard shortcuts**: [shortcuts](/en/docs/ui#keyboard-shortcuts) open the Content Library or the Asset Library, start a search and create a new entry. Decap CMS has no shortcuts outside its text editors. * **Accessibility**: Sveltia CMS works toward WCAG 2.2 Level AA and publishes an [accessibility statement](https://github.com/sveltia/sveltia-cms/blob/main/ACCESSIBILITY.md). Decap CMS has neither a target nor a statement. Accessibility in Sveltia CMS covers: * keyboard alternatives for drag-and-drop, such as reordering list items and resizing panes * a collection tree in the sidebar that can be navigated and expanded with the keyboard * WAI-ARIA roles and labels for screen readers, with an announcement on every page change * the operating system’s reduced motion, reduced transparency and increased contrast settings In Decap CMS, the [umbrella issue for accessibility](https://github.com/decaporg/decap-cms/issues/1333) has been open since 2018. Files in the media gallery [can’t be selected with the keyboard](https://github.com/decaporg/decap-cms/issues/7077), an issue open since January 2024. Details: [Better UX](/en/docs/successor-to-netlify-cms#better-ux) and [Better Accessibility](/en/docs/successor-to-netlify-cms#better-accessibility). ## Multilingual Content I18n was part of the Sveltia CMS design from day one. In Decap CMS, it was added later and comes with [limitations](https://decapcms.org/docs/i18n/#limitations) that Sveltia CMS doesn’t have: * File collections can store each language in its own file or folder. * List and Object fields can be duplicated between languages. * Slugs can be localized, including the folder names of nested entries. * Text can be translated with one click through [translation services](/en/docs/integrations/translations), including Google Cloud Translation and AI models. * Right-to-left languages work in the editor. Details: [Better I18n Support](/en/docs/successor-to-netlify-cms#better-i18n-support). ## Configuration and Data * **Validation you can act on**: every time the CMS loads, the configuration is checked against a JSON schema and against rules a schema can’t express. Errors name the collection and field. Decap CMS needs `unsafe-eval` in your Content Security Policy to validate its configuration. * **Consistent output**: Sveltia CMS saves an empty string, an empty array or `null` for empty fields, and keeps keys in the order of your fields. Decap CMS sometimes omits empty fields and sometimes doesn’t. * **Database-like features**: [unique values](/en/docs/fields#unique), [auto-increment numbers](/en/docs/fields/number#auto-increment) and [cascading updates and deletions](/en/docs/fields/relation#cascading-updates) for Relation fields. * **More field types**: [Compute](/en/docs/fields/compute) and [KeyValue](/en/docs/fields/keyvalue), on top of every field type Decap CMS has. Details: [Better Configuration](/en/docs/successor-to-netlify-cms#better-configuration) and [Better Field Types](/en/docs/successor-to-netlify-cms#better-field-types). ## Workflows * **Editorial Workflow** works on GitHub, GitLab, Gitea and Forgejo. Decap CMS doesn’t support it on [Gitea or Forgejo](https://github.com/decaporg/decap-cms/issues/7115). Before publishing, Sveltia CMS checks that the pull request contains only the entry. Decap CMS merges the pull request as it stands, so anything else pushed to the branch goes live with it unseen. * **Preview Workflow** saves each change to a pull request for a deploy preview, then publishes without review stages. Decap CMS has no equivalent short of the full Editorial Workflow. * **Open Authoring** works on GitHub, GitLab, Gitea and Forgejo. In Decap CMS, it’s [GitHub only](https://github.com/decaporg/decap-cms/issues/7823). Details: [Better Workflows](/en/docs/successor-to-netlify-cms#better-workflows). ## Documentation Sveltia CMS has a page for every field type, configuration examples in YAML, TOML, JSON and JavaScript, a [migration guide](/en/docs/migration/netlify-decap-cms) with compatibility notes, [framework guides](/en/docs/frameworks) and a [showcase](/en/showcase) of {{ stats.siteCount }} real sites. The Decap CMS documentation is incomplete or out of date in places: * The [Decap CMS 3.0 announcement](https://decapcms.org/blog/decap-3/) calls it “fully backward compatible,” but 3.0 removed the Date widget. * The [Git Gateway page](https://decapcms.org/docs/git-gateway-backend/) doesn’t mention that Netlify has deprecated it. * The [examples page](https://decapcms.org/docs/examples/) lists 26 starter templates and demos, most of them from the Netlify CMS years, rather than real sites. It was last updated in October 2024. * The platform guides still cover Gatsby, whose future is uncertain, and Gridsome, which is no longer maintained. Details: [Better Documentation](/en/docs/successor-to-netlify-cms#better-documentation). ## What Decap CMS Has That Sveltia CMS Doesn’t Sveltia CMS doesn’t support the following. If you depend on any of them, Decap CMS is the only option of the two for now. * **Git Gateway and Netlify Identity**: Netlify has deprecated Git Gateway. An alternative with user management is [on the roadmap](/en/docs/roadmap), but not available yet. * **Bitbucket and Azure DevOps backends**: their APIs can’t fetch many files at once, so they would be slow. * **Decap Turbo**: a hosted service that adds login, roles, a database-backed content proxy, an activity log, site variables and deploy notifications. The free plan covers 1 site and 1 editor, so a team needs Pro, from €19 a month for 5 editors. * **Editor notes**: the `editor.notes` option, which stores notes as comments on GitHub or GitLab issues. * **Remark plugins**: they don’t work with the Lexical-based editor. * **Code field themes and key bindings**: the Code field uses Shiki instead of CodeMirror. * **Undocumented APIs**: custom backends and custom media libraries registered through undocumented methods. * **Some UI languages**: Sveltia CMS isn’t translated into every language Decap CMS supports yet. The full list, with workarounds, is in the [migration guide](/en/docs/migration/netlify-decap-cms#features-not-to-be-implemented). ## Switching For most sites, switching is a one-line change in the CMS’s `index.html` file: ```diff - + ``` Your existing configuration file keeps working, with a few behavior differences to check: * The CMS must be served over HTTPS or from `localhost`. * Empty optional fields are saved as empty values rather than left out. * Uploaded filenames aren’t slugified unless you enable the [`slugify_filename` option](/en/docs/media#slugification-of-filenames). Follow the [migration guide](/en/docs/migration/netlify-decap-cms) for the details, or browse [sites that have already migrated](/en/showcase?migrated-from=decap-cms).