NETROOM
Excalidraw is a virtual whiteboard for diagrams in a hand-drawn style: architecture sketches, user flows, wireframes and anything else that is quicker to draw than to describe. It runs in the browser with no sign-up - open a tab and start drawing. There are libraries of ready-made shapes, export to PNG and SVG, collaboration over a link with end-to-end encrypted rooms, and files you can keep locally or in your own storage. Open source, with a self-hosted option for teams.
Squoosh compresses images in the browser: drop a file in, pick a format and a quality, download the result. A slider puts the original and the compressed version side by side, so you can see exactly where artefacts start and stop just before them. It handles a range of formats, each with its own controls - from a single quality dial to the codec's own parameters. Nothing is uploaded: the work happens on your device, and it runs offline once installed as an app. Built by Google Chrome Labs, open source, no sign-up.
The Cyber Swiss Army Knife, built by the UK's GCHQ. You chain operations into a "recipe" and push text or a file through it: base64, XOR, AES, DES, Blowfish, hashes, hexdumps, X.509 and IPv6 parsing, archive extraction, charset conversion. Everything runs in the browser - nothing is sent to a server, and you can download the page and use it offline. Apache 2.0 plus Crown Copyright. Invaluable for picking apart logs, dumps and suspicious payloads.
A Swiss army knife for PDFs in the browser, running on your own server: merge and split, rotate, compress, convert to and from office formats, OCR, sign, redact, and chain operations through a REST API - over fifty tools in all. The point is that files never reach someone else's cloud. One docker run gets you going, and a desktop client and Kubernetes charts exist too. It is open core: the base is open source while some capabilities sit behind paid Server and Enterprise plans.
Heads-up: this package was renamed. Install @base-ui/react instead - that is where the stable 1.x lives, while the old name is stuck at 1.0.0-rc.0 and marked deprecated. The library itself is headless primitives from the people behind MUI, Radix and Floating UI: dialogs, menus, selects and popovers with zero styling, but careful accessibility and focus management. A solid base for your own Tailwind design system. MIT.
Completely unstyled components from the Tailwind team: Dialog, Menu, Combobox, Listbox, Popover, Tabs, Switch, Disclosure. Behaviour, focus management, keyboard handling and aria are built in while the look is entirely yours - ideal when the design is custom rather than a bought theme. The set is noticeably smaller than Radix: no tooltip, no slider, no conventional accordion - but the API is simpler and transitions come free through data attributes. Client only, so use client in Next.js. React 18 and 19, MIT.
The veteran of JS i18n: interpolation, plurals, contexts, namespaces, lazy-loaded translation bundles, language detection from browser or cookie. The core ships dependency-free; everything else is a plugin (react-i18next for hooks, i18next-http-backend for loading). The ecosystem is huge and you pay for it in configuration - setting up i18next takes noticeably longer than next-intl or Lingui. Best when translations come from a CMS or TMS, or the app isn't React-only. v26 is current, MIT.
This is a CLI, not a component library - an important distinction. Running shadcn add dialog copies the component source straight into your project under components/ui, and from then on it is yours: edit it like any file, with no npm updates coming. Radix UI and Tailwind sit underneath, so primitives and accessibility come from there. It belongs in devDependencies. Registries let you serve your own components to a team over a URL. The obvious downside: tracking upstream fixes is manual.
This package is deprecated - the library was renamed and you should install @heroui/react instead. The last release under the old name is 2.6.11 from January 2025, and nothing more is coming. The library itself is alive: Tailwind plus React Aria components, accessibility built in, dark mode, Framer Motion animations. Migrating means renaming the package, the imports and the Tailwind plugin. Seeing @nextui-org means stale deps.
Firebase's server SDK for Node: it authenticates with a service account and bypasses security rules entirely, so it belongs strictly in route handlers, server actions and cron jobs - a leaked key means full database access. It does what the client SDK cannot: create users, set custom claims, send push in bulk, read and write without restrictions. It will not run on an edge runtime; it needs real Node. Keep initialisation behind a singleton or hot reload will spawn duplicate apps. Apache-2.0.
Client for Ably, a paid realtime cloud: pub/sub channels, presence, message history, guaranteed delivery and connection recovery after drops. React hooks ship inside the same package (ably/react), so no extra wrapper is needed. The 2.x line is actively released and licensed Apache-2.0. Take it when you need dependable realtime without running your own socket server and can pay per message. For heavy, predictable traffic a self-hosted socket.io setup is cheaper.
The Pusher Channels client: channel subscriptions, private and presence channels authorised by your backend, automatic reconnects, transport fallbacks. Pusher runs the WebSocket infrastructure, so you never stand up or scale a socket server. The trade-offs are per-connection billing and routing your data through someone else's service. Still released, MIT. Compare with Supabase Realtime and Ably first; self-hosted Socket.IO is cheaper if you already run a backend.
The Socket.IO client. Worth being clear: this is not WebSocket but a protocol on top of it, with HTTP long-polling fallback, automatic reconnection, rooms, delivery acknowledgements and named events instead of raw messages. Which means the server must be socket.io too - it will not talk to a plain ws server or the WebSocket API. Reach for it when users have flaky networks and you would rather not hand-write reconnection logic. Without the fallbacks, native WebSocket saves you tens of kilobytes.
Runs TypeScript and ESM in Node directly: `tsx script.ts` with no compile step first. It is esbuild underneath, so startup is instant - but types are not checked, since this is a runner, not a compiler, and you still need `tsc --noEmit` alongside. It ships a watch mode, a REPL, and `--import tsx` to hook into any node process. Against ts-node it wins on speed and on not fighting ESM or tsconfig paths out of the box. One dependency, esbuild. MIT, frequent releases.
Adobe's hook library covering behaviour and accessibility, but not markup: useButton, useSelect, useDatePicker and roughly a hundred more. They hand back props while you write every DOM node and style yourself - maximum control, maximum code. Its standout strengths: calendar and number internationalization via @internationalized/*, careful handling of touch, pen and mouse input, and RTL. Releases are constant, with 3.52.0 in September 2026. If writing the markup is not appealing, use react-aria-components. Apache-2.0.
Google's client SDK: authentication, Firestore, Realtime Database, Storage, callable Cloud Functions, push and analytics, all in one npm package. Since version 9 the API is modular - you import getAuth and getFirestore individually and the bundler drops the rest; skip that and a couple of hundred kilobytes sneak in. It runs in the browser only, so in Next.js it belongs in client components, with firebase-admin covering the server. The vendor lock-in is real: leaving Firestore later is expensive. Apache-2.0.
A WebSocket that reconnects itself: exponential backoff, a queue for messages sent while offline, pings, and the same API in the browser and in Node. It grew out of PartyKit and now lives in Cloudflare's repo, but it talks to any server, not just Workers and Durable Objects. A usePartySocket hook covers React. A solid replacement for reconnecting-websocket - newer and typed. Not a protocol, just a dependable wrapper. MIT.
Sanity's official Next.js toolkit: a typed client for GROQ queries, cache tags and revalidation wired for the App Router, live draft previews, and Sanity Studio embedded at a /studio route. If your content already lives in Sanity it replaces every hand-rolled wrapper. It pulls in @sanity/client and, with the studio, the entire editor - keep that out of your public bundle. Released almost weekly, MIT.
A tiny loader: Stripe.js itself is not in the package - loadStripe fetches the script from Stripe's domain at runtime. That is deliberate; bundling the library would break the PCI isolation story and cut you off from fraud-detection updates. One practical consequence: js.stripe.com must be allowed in your CSP. The function returns a promise, so call it once outside your component rather than on every render. The publishable key used here is not a secret and belongs on the client.
Sending mail from Node: SMTP, attachments, HTML, DKIM, connection pools, OAuth2 for Gmail. The de facto standard for over a decade and still shipping releases. It is Node-runtime only - it will not run on the edge or in a browser, so keep the route on runtime 'nodejs' on Vercel. The licence is MIT-0, unusual but maximally permissive. At volume a transactional API like Resend wins: deliverability is about domains, not libraries.
Moment.js's successor, from the same author: immutable DateTime objects, real time zones and locales via the built-in Intl API, intervals, durations, ISO parsing and formatting. Zero dependencies and about 20 KB - lighter than Moment, heavier than date-fns or day.js, because it ships a full time model rather than a bag of functions. Take it when the project does serious zone and calendar arithmetic. Releases are rare, the last in autumn 2025: stable, not abandoned. MIT.
The client for Sanity, a headless CMS that queries content with GROQ rather than GraphQL. It is isomorphic: browser, Node and edge all work. You get CDN-backed reads, mutations and patches with optimistic locking, asset uploads, and a Live Content API for instant updates without revalidation. In Next.js people usually reach for next-sanity instead, which already wires up caching, tags and draft mode. Few dependencies. Keep any write-enabled token strictly on the server.
A file uploader with manners: drag and drop, image previews, progress, cancel, resume after a dropped connection, chunked uploads for big files. The core is vanilla JS with no dependencies, so for React you also need react-filepond - filepond alone gives you no component. Cropping, resizing, EXIF rotation and type or size validation come as plugins, each its own package. Entirely client-side, so mark it use client in Next.js. MIT, actively maintained, regular releases.
A full-coverage Redis client for Node: Cluster, Sentinel, pipelining, Lua scripting, pub/sub, streams, auto-reconnect and an offline command queue. Promises and TypeScript types come built in. Against the official node-redis it wins on mature cluster support and lags slightly on RESP3. Redis Inc. has maintained it since 2021, and v6 landed in mid-2026. In serverless, reach for @upstash/redis or an HTTP client instead - long-lived TCP connections fare badly there.
Two hundred-plus standalone date functions: format, addDays, differenceInHours. You import only what you use and the bundler drops the rest, unlike Moment.js which arrived whole with every locale attached. Nothing is mutated, it works on the native Date, and it has zero dependencies. Version 4 finally brought first-class time zones, though through the separate @date-fns/tz package. Want Moment-style chaining instead? Use dayjs. Want a stricter time model? Look at Temporal or js-joda. MIT, ESM and CJS.
A browser UI for Vitest: a tree of files and tests, failures with readable diffs, a module graph, and click-to-rerun for a single test. Start it with the --ui flag next to watch mode. It earns its place once the suite is large enough that terminal output stops being readable. Goes in devDependencies and is pinned to an exact Vitest version through its peer dependency, so upgrade both together. It never reaches your production bundle. MIT.
A crop-selection widget over an image: the frame drags with mouse, touch and keyboard, with fixed aspect ratio, circular crop, and min/max size constraints. Know where its job ends - the package only hands you coordinates in pixels or percent; the actual cropping is yours to do on a canvas or on the server. Zero dependencies, 115 KB unpacked, React 16.13+, ISC license (effectively MIT). Actively maintained: 11.1.2 landed June 2026.
An ODM over the official driver: schemas, validation, pre and post middleware, populate instead of hand-rolled joins, virtuals and discriminators. Types are inferred from the schema, and v9 speaks Standard Schema. You pay for the convenience in weight and an extra abstraction layer - heavy aggregations still get written against the driver directly. The classic Next.js and serverless trap is reconnecting on every request; cache the connection on globalThis. Frequent releases, MIT.
Editors' picks