Download websites that use Vaadin

About Vaadin

A framework that keeps the user interface on the server is a strange thing to look for on the public web, because most of what gets built with it is not public. Vaadin has been developed since 2002 by Vaadin Ltd., written in Java, and released under the Apache 2.0 licence. The programming model holds component state in the server process and sends only differences to the browser, which suits internal business software very well and marketing sites very badly.

Filing the framework under Web frameworks is a taxonomy compromise rather than a description. The code a browser executes is JavaScript, so a front end scanner finds it there, but almost nobody writes JavaScript to use it. The buyer is a Java team, usually inside an organisation where the back end language was settled long before the web tier existed, and the appeal is that one team can ship a working interface without a second team owning a separate front end stack.

As of September 2026 we detect Vaadin on 407 sites, and the honest reading is that we are counting the exceptions. Applications of this kind sit behind corporate single sign on, on internal hostnames, in link graphs no crawler will ever enter. What reaches the open web is a narrow fringe: customer portals, dealer and partner logins, booking systems, public sector services and the occasional product site. Treat the population as a sample of a much larger installed base rather than as a census of it.

Version data is where the population becomes interesting. We hold 79 distinct releases under this label, and the one we record most often is 7.6.8, which sits well behind the line the vendor ships today. Spread of that width on a framework of this age is less a sign of neglect than a sign of what the software is for. Line of business applications get commissioned, delivered, and then maintained by whoever inherits them. Moving across a major version of a user interface framework means retesting every screen, and no marketing pressure ever demands it, so the release a site reports is often the release it was born with.

The Apache 2.0 licence has a consequence for anyone trying to size this market from outside. The framework is free to take, so there is no purchase record, no download that maps to a company name and no partner directory that covers the base. Vaadin Ltd. sells tooling, components and support on top, which means the vendor's own customer list is a subset of real use and a biased one, weighted towards organisations large enough to buy a contract. A detection dataset is the only available view of the rest.

Practical uses follow from that gap. Consultancies and recruiters looking for Java teams with an ageing web tier can find them by release. Vendors of competing enterprise interface stacks can size a migration market and aim specifically at the older lines. Security researchers need an exposure count for a framework whose public deployments are portals handling real transactions rather than brochure pages. A lookup on one domain confirms one site. Only the full export lets you ask which release runs where, on which suffix, and beside what else, which is the question every one of those groups arrives at.