Introducing tldraw offline multiplayer
Hi, this is Kostya, Product Engineer at tldraw.
tldraw offline is great. You can use it anywhere, and so can your agents. People have been having a lot of fun pushing it to its limits and building things like earthquake trackers, PDF-signers, and agent comparisons. But what if you wanted offline to be somewhat online? As in, you wanted your friends or coworkers to be able to join your canvas and collaborate on what you’ve built?
To make multiplayer collaboration possible, we started playing around with the idea of a LAN. As a starting point on the journey to an eventual traditional server deployment, we thought instead that your machine could act as the server.
Here’s the story of how we built tldraw offline multiplayer.
You’re invited to our LAN party
If you already have tldraw offline downloaded, you don’t need to do anything. Just select File > Join in the top menu.
Usually, multiplayer requires hosting a server somewhere. That might be via AWS or another computer in your server room, or as a Cloudflare Durable Object. That’s what we use to handle tldraw.com’s sync.
But for tldraw offline LAN, we flipped that on its head and asked ‘what if the host’s computer was the server’? It runs the same tldraw.com sync package, just as an in-process local server.
That reuse made LAN so fast to build. Rather than inventing multiplayer infrastructure from scratch, the team pointed the existing sync machinery at a process running on someone's laptop.
On top of that, LAN also lets people share scripts — bits of custom code that change what the app can do, like making shapes move on their own, drawing live graphs, or turning the canvas into a game of Tetris.
These scripts work the same way the multiplayer sync does: the host's computer keeps the main copy, and when they change it — say, recoloring the falling blocks in Tetris — that change gets sent out to everyone instantly, so all connected players see the update at the same time.
The craziest part was how fast it was. We tested a multiplayer Tetris game being hosted on one of our laptops against an online multiplayer game, and it was much faster.
While LAN gave us a lot of new possibilities through multiplayer, from games to collaborating on sensitive data without having to worry about it being stored on a cloud, we still needed to think about the security of the scripts we were running on each other’s desktops and what would happen if a bad actor joined the party.
Invite only
Our first way of thinking about this was similar to an office Wi-Fi system: if someone was in the building and connected to our Wi-Fi, we assumed they were an employee or a trusted guest. Similarly, we started building and testing LAN on the assumption that anyone accessing the server could be trusted.
But that becomes tricky when you want to invite more people onto the server - say by hosting a tldraw offline hack night. It’s a similar issue to public Wi-Fi; unlike in the office, you can’t assume everyone in a cafe or an airport has the best intentions.
Thinking about the venue
Electron apps, like tldraw offline, are built with many of the same tools used to make websites, so a lot of what you see in the app is actually a webpage running inside a browser-like window.
To load that webpage, production Electron apps typically serve it using a special address format that starts with file://. which tells the app to “load this file from disk,” the same way a normal webpage loads from a web address.
That's completely harmless on its own. But once an app is willing to run arbitrary code, that same file-loading mechanism becomes a way for a bad actor to reach beyond the app and read files elsewhere on the person's computer.
To close that loophole, tldraw offline stopped loading the app itself from file://. The packaged UI now comes from a private, app-only address—tldraw-app://app—that can serve only files bundled with tldraw. Since the page is no longer treated as a local file, Chromium blocks scripts from loading other files on the computer. Electron also rejects attempts to navigate to a window or frame to a local path, or to open one through the operating system.
Where this goes next
tldraw offline multiplayer is just the first step. The next iteration the team is already thinking about is giving people more ways to run the same server beyond a single laptop on a LAN, including hosting it on a cloud service or on a machine in a server room, so the same collaborative experience can scale beyond a single host's computer.
Try it for yourself and let us know your thoughts on X or Discord.
