A JavaScript backend with full system access, a native webview window (WebKit on macOS, WebView2 on Windows, WebKitGTK on Linux), and nothing else. No Electron. No bundled Chromium. No HTTP server. No ports.
tinyjs is an open-source tool and runtime for building cross-platform desktop applications for macOS, Windows, and Linux in approximately 6 MB.
The main features of this framework include:
Ultra-Lightweight Footprint (~6 MB): While tools like Electron ship at \(\ge\)150 MB and Tauri at 10 MB, tinyjs packages only a 600 KB window process, the txiki.js backend runtime, and your plain application code by reusing the native webview engine already pre-installed on the host OS (WebKit on macOS, WebView2 on Windows, WebKitGTK on Linux).
Pure JavaScript Backend (txiki.js): Runs its backend on txiki.js (QuickJS + libuv), granting full system access—including files, sockets, subprocesses, FFI, SQLite, fetch, and WebSockets—entirely in JavaScript without needing a Rust compiler or build step.
Zero-Port Security Architecture: Inter-Process Communication (IPC) between the webview window and the backend takes place over a private Unix socket (or named pipe on Windows) located in a private temporary directory, ensuring no ports are opened, scanned, or collided with.
Native System Controls: UI elements such as real desktop menu bars, file open/save panels, and alert/confirm/prompt dialogs are rendered directly by native OS frameworks (such as AppKit on macOS) rather than emulated HTML divs.
Flexible Tooling & Hot Reloading: Supports zero-dependency development with plain HTML/CSS/JS out of the box with instant hot reloading, or scaffolds React, Vue, Svelte, Solid, and TypeScript projects powered by Vite and esbuild.
Hosted Web App Wrapping: Can point its window at an existing web URL while maintaining a strict, per-origin capability gate in tinyjs.json to control which native APIs that site is permitted to call.
Bundling & Automatic Updates: Emits codesigned .app bundles for macOS, portable folders for Windows, and Linux tarballs, featuring a built-in updater that validates SHA256 signatures, swaps binaries in place, and automatically rolls back on failure.
Agent-Ready Ecosystem: Includes a built-in skill file in every project template so AI coding agents immediately understand the full API surface.