Tools/payloadcms/payload

Payload

Open source fullstack Next.js framework with backend superpowers

45.7k ★+122/wkgrowthTypeScriptMIT License →trending

View on GitHub →Compare in CMS →Homepage →

Replaces:Contentful Sanity Storyblok WordPress.com

See how it compares →

The Lens

By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.

Updated Oct 2026

Payload is a CMS that installs inside your Next.js app. You define content in TypeScript and get an admin panel, REST and GraphQL APIs, auth, access control, drafts and versions, localization and file uploads. It's MIT licensed and free, and that stayed true after Figma bought the company in June 2025.

Self-hosting is the only way to start a new project. Payload Cloud has paused new signups during the Figma transition, though existing projects keep running. You deploy a Node app on MongoDB, Postgres or SQLite, and the one-click templates target Vercel with Neon or Cloudflare Workers with D1 and R2.

Solo and small teams: free, and still the strongest CMS for Next.js work. Larger teams needing SSO, approval workflows or audit logs need an Enterprise quote; there's no published price, and the visual editor is still marked coming soon. Want the CMS as a separate service? Look at Strapi or Directus.

The catch: patch discipline. Since mid-September Payload has published dozens of advisories, including SQL injection in the Postgres and SQLite adapters, remote code execution in the Form Builder plugin, and access control bypasses. Anything below 3.90 is exposed. Figma owning the roadmap is the slower risk.

Free vs Self-Hosted vs Paid

open core

Free: The whole framework is MIT licensed: TypeScript content modeling, admin panel, REST and GraphQL APIs, auth, versions and drafts, localization, blocks layout builder, Lexical rich text, live preview, hooks and granular access control. Latest stable is 3.92.0 (October 22, 2026); 4.0 is in beta.

Self-hosted: Runs anywhere Node.js 20.9.0+ runs, on MongoDB, Postgres or SQLite. Official one-click templates deploy to Vercel (Neon database plus Vercel Blob) or Cloudflare (Workers, D1, R2). Payload Cloud has paused new signups since the Figma deal, so new projects pay for their own hosting, database and media storage. Stay on 3.90.0 or later: the September and October advisories include SQL injection, RCE in the Form Builder and Import Export plugins, and several access control bypasses.

Paid: Enterprise only, priced by sales call with no public number. It runs self-hosted or hosted by Payload and adds dedicated support, SSO with any SAML or OAuth 2.0 provider, publishing workflows, audit logs with rollback, A/B variant testing, AI auto-embedding and AI writing and translation tools, unlimited custom domains, white-labeled email and roadmap influence. The visual editor and multiplayer editing are listed as coming soon.

Free and MIT to self-host, which is the only way to start while Payload Cloud signups are paused. SSO, approval workflows and audit logs mean an Enterprise quote with no published price.

What to do by team size

Solo: free; one-click deploy to Vercel or Cloudflare, or any Node host
Small team: free; the MIT core already covers auth, access control, drafts and localization
Medium team: free core, but get an Enterprise quote early if SSO or approval workflows are coming
Large team: Enterprise for SSO, audit logs and dedicated support; quote only, so start that conversation before you build

Self-hosting ops:moderate

View pricing page →

Get tools like this every Wednesday

One featured tool, three on the radar. No fluff.