Independent reviews. IonBin has no partnerships with the tools on this page and was not paid for these listings. Our evaluations are our own, based on public documentation and our research. Product names are trademarks of their owners and are used for identification only. How disclosure works.

Brand & assets / Icon design tool

Forma / Icon Creator

Style individual icons and inspect exported SVG output.

Documentation reviewed

Source review

What this status means

Understand the resource

What it is.

Forma / Icon Creator is a browser editor for choosing and styling icons, with export controls for individual SVG or PNG files and larger library exports. In the tested path, a selected Coffee icon accepted a new primary color and produced an SVG; that result covers one small export, not every icon pack or export mode.

When it is useful

You need a small icon adjusted to a product's color and visual treatment.

A proposed application

Put it to work.

This example illustrates a possible use. The proposed workflow and expected result are separate from the bounded checks recorded below.

Try this

Choose a simple icon, set a synthetic brand color and export an SVG. Inspect the file, check its pack license and test it at the smallest intended size.

Result to aim for

A styled icon file with explicit checks for rights, legibility and safe embedding.

Before you start

What you need.

  • A browser and the appropriate license for the selected icon pack.
  • Check exported files before embedding them, and supply meaningful labels when an icon conveys an action or status.

The practical boundaries

What to watch for.

  • A successful single SVG export does not establish that every export stays local to the browser.
  • The publisher's privacy documentation describes server processing for library ZIP jobs; that data handling was not exercised.
  • Small-size legibility and accessible use still need review in the destination interface.

Review record

What we could establish.

  • A Coffee icon was selected, its primary color changed to #1E40AF and one 1,188-byte SVG exported. The sample contained the chosen color and no matched script, event-handler, foreignObject or external-reference patterns; this was a bounded check, not a complete sanitizer or pack-wide audit.
Source coverage and runtime coverage are separate

The source-review notes describe documentation and identity. The account-free evaluation below records exactly which public interaction or local fixture was checked, what happened, and what remains untested.

Check current access, terms, licensing and data handling before using a resource with your own material.

Runtime and security evaluation

What the evaluation covers.

Bounded runtime checkedAccount-free ·

One synthetic icon edit and SVG export succeeded. The exported sample passed limited static pattern checks; library ZIP, PNG and broader privacy behavior remain untested.

Methods: Public HTTP response · Public browser sample · Source review. A completed check covers the stated sample; it is not a safety certification.

Target
https://iconcreator.dev/
Version or capture
Unversioned public page observed 2026-10-19
Integrity scope
SHA-256 2edb117b41ce5ebdd2accf7a70e286bdc34559a1800e7bc0b4a6af3f46dfdf49 of one initial HTML response (3910 bytes). This does not fingerprint the entire application or its dependencies.

Test conditions

  • Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.
  • Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.
  • No owner browser profile, account, credentials, purchase, upload, private fixture or service write.

Individual checks and observations

  1. Icon search and selection

    pass

    Public browser sample: Search coffee, select the visible Coffee icon and change its primary color to #1E40AF.

    Observed: The search displayed nine matching controls; selecting Coffee enabled Undo, and the editor accepted the color.

  2. Synthetic SVG export

    pass

    Public browser sample: Export the single icon as SVG and inspect the downloaded bytes in memory.

    Observed: A 1,188-byte SVG included #1E40AF and valid opening/closing SVG markers. SHA-256: ef5e996b0603f9b287f94e993e87d5eee0fec4c5bf6a44e79a1a6c4203291577.

  3. Bounded SVG pattern check

    pass

    Source review: Scan the exported bytes for script tags, event-handler attributes, foreignObject and external-reference patterns.

    Observed: Zero matches were found for each checked pattern. This is not an exhaustive SVG sanitizer or proof that every export is safe.

  4. Other export modes

    not-run

    Public browser sample: Export PNG or a whole-library ZIP.

    Observed: Only one SVG was exported; no library job or uploaded asset was used.

Security findings and boundaries

A synthetic icon edit/export, bounded static SVG inspection, passive page observations and the publisher's privacy documentation.

Observed · info

One inspected output had no matched active-content patterns

The 1,188-byte sample had no detected script, event-handler, foreignObject or external-reference patterns. The check is limited to this file and these patterns.

Documented · caution

Library ZIP exports use server processing

The privacy page describes a server job that stores design settings and an export record for library ZIP generation. This workflow and the stated retention/link behavior were not verified.

Practical advice · caution

Do not infer local-only processing

The single export succeeded while non-GET requests were blocked, but GET requests remained allowed and the download URL scheme was not recorded. This does not prove that design data never leaves the browser.

Practical caveats

  • Inspect the license of the selected icon pack; one pack's terms do not cover every collection.
  • Check rendering and accessibility in the final application, especially at small sizes and when icons act as controls.

What remains untested

  • One synthetic Coffee icon and one SVG only; no upload, PNG export, library ZIP, account or purchase.
  • Static patterns are not a full sanitizer; no stored-data, retention, backend or network-payload audit.

Security limits

  • Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.
  • Request blocking changes application behavior; no secure/safe certification is implied.

Evaluation sources

  1. Public icon editor
  2. Publisher privacy documentation

Download this evaluation record (JSON)

Follow the evidence

Sources and further reading.

  1. Public icon editor
  2. Publisher privacy documentation

Keep exploring

More in brand & assets.

View category

Documentation reviewed

Logosystem

Study how marks behave across forms and motion.

Documentation reviewed

Logobook

Explore the construction of symbols and wordmarks.

Documentation reviewed

Logoinspo

Filter identity references by style, industry and color.