Payload

Short verdict: Payload is a free, MIT-licensed CMS that runs inside your Next.js app: you define content in TypeScript and get an admin panel, REST, GraphQL and a direct Local API, with the content in your own database. In our test, live preview, drafts, versions, image resizing and scheduled publishing worked without paying anything. The gaps sit around the code: since Payload joined Figma in June 2025, Payload Cloud takes no new projects, SSO and audit logs are Enterprise-only with no public price, and scheduled posts never go live until you add a job runner. It suits TypeScript teams on Next.js who host their own apps; teams whose editors want to add fields themselves, or who want vendor hosting at a published price, should look elsewhere.

How we reviewed it: On 25 October 2026 we installed Payload 3.92.0 with create-payload-app (website template, SQLite) on Linux with Node.js 22.22.0, then created an admin user, uploaded an image, and wrote, previewed, published and scheduled posts at 1440 x 900. We read them back through REST, GraphQL and the Local API, timed the install, dev server and build, and blocked and logged every request that tried to leave the machine. Timings are single runs on a shared 4-core cloud machine. We did not create a Payload account, so Enterprise features and Payload Cloud come from Payload's own pages, and we did not test MongoDB, Postgres, localization, the MCP plugin or the 4.0 beta.

What you get for $0

What we found

One command and five questions, then a 957 MB install

npx create-payload-app asked for a project name, a template, a database (MongoDB by default; we picked SQLite, which needs no server) and whether to install Payload's skill for Claude Code, Codex or Cursor. There was no account or cloud login. It generated PAYLOAD_SECRET but left CRON_SECRET and PREVIEW_SECRET as YOUR_..._HERE placeholders. The npm install took 73 s with an empty cache: 823 packages, 957 MB. Payload 3.92.0 requires Node.js 22.23.4 or 24.22.1, both released two days before it, while the pricing page still says 20.9.0; on our 22.22.0, npm warned but everything ran.

Live preview and drafts work out of the box

The template's Posts collection comes with drafts, autosave, live preview, Lexical rich text and SEO fields. Our 1600 x 1000 JPEG came back in six sizes made with sharp, with focal point and crop controls. The eye icon opens the site beside the form at phone, tablet or desktop size, and a title change appeared in the preview 0.27 s after typing on the production build. Every save is kept: a draft, an autosave and a publish gave three versions, and editing a published post offers Revert to published. While the post was a draft, anonymous REST requests got nothing back; with a login token, ?draft=true returned it.

Scheduled publishing needs a job runner you add yourself

Schedule Publish takes a date, time and time zone. The dialog preselected Unpublish even on a never-published draft, so our first event was the wrong type. The bigger gap: a publish scheduled for 17:40 had not happened two minutes later. Payload's docs warn that scheduled jobs never run unless something processes the jobs queue, and the template sets nothing up for a self-hosted server. npx payload jobs:run published the post but recorded the job as failed, because the template's cache-refresh hook only works inside a Next.js request. Calling /api/payload-jobs/run, as a cron job would, worked cleanly. It refused anonymous calls but accepted the placeholder YOUR_CRON_SECRET_HERE. The one-click Vercel template calls it once a day at midnight, per its vercel.json, so a post scheduled for 9:00 would go live at the next midnight run.

The content model is TypeScript, and one config feeds three APIs

Collections, fields, access rules and hooks live in payload.config.ts, and there is no schema builder, so editors cannot add a field. In return, Payload generates TypeScript types and serves the same model over REST, GraphQL and the Local API, which reads the database from server code without HTTP: our first query took 115 ms, the next 5 ms. Permissions are functions you write, down to single fields, not a role editor. The official MCP plugin, also MIT-licensed, adds an /api/mcp endpoint for AI agents with per-user API keys; we read its docs but did not run it.

Telemetry and Gravatar are on by default

With outside requests blocked and logged, none of our content tried to leave; telemetry and avatars did. Each time Payload starts, it posts a 1.7 KB event to Payload's telemetry server: a random install ID, a hashed project ID, versions, the database adapter and feature counts. Our 12-minute dev session tried 9 times and the build 3 times, and Next.js tried to send its own telemetry 18 times. The admin also loads each user's picture from Gravatar, which receives an MD5 hash of their email address. telemetry: false, admin.avatar: 'default' and NEXT_TELEMETRY_DISABLED=1 turn these off.

No Payload Cloud for new projects, and an Enterprise tier with no price

The pricing page lists self-hosting (free), one-click deploys to Vercel and Cloudflare, which those companies bill for, and Enterprise behind a demo request. Payload Cloud is not taking new projects; existing ones keep running but will have to move eventually, per Payload's notice. Enterprise adds SSO, audit logs, approval workflows, A/B testing, AI translation and support. Its visual editor and real-time co-editing are marked Coming Soon, although the pricing page lists visual editing as included. None of the Enterprise code is in the open-source repository or on public npm.

Install and build

Most of the weight is Next.js: about 385 MB of the production install, against 76 MB for Payload's own packages. Next.js 16.3.3, pinned by the template, had critical remote code execution advisories and sharp 0.35.4 a high one; updating to Next.js 16.4.3 and sharp 0.35.5 took 13 s, cleared both, and the build still passed. Still flagged: Vitest, a test tool (critical), and happy-dom (high), which Payload's Lexical package pulls in.

What you still have to set up

• Hosting. A Node.js server or serverless platform, a database, persistent storage for uploads and an email adapter (without one, Payload only logs emails).

• A job runner. A cron job that calls /api/payload-jobs/run with a real CRON_SECRET, or Payload's autoRun setting on a long-running server.

• Secrets and updates. Replace the placeholder secrets, update Next.js and sharp past the versions the template pins, and decide on telemetry and Gravatar.

• SSO and approvals. An Enterprise contract, or your own code using Payload's custom auth strategies and access functions.

• Your frontend. The template's site is a starting point: it loads its logo from GitHub, and its seed button wipes the database.

Pros and cons

Pros

• Live preview, drafts, versions, scheduled publishing, localization and field-level permissions are all in the free MIT core.

• Content stays in your own MongoDB, Postgres or SQLite database, and the admin and APIs deploy with your Next.js app.

• Generated TypeScript types and an in-process Local API that answered in 5 ms in our test.

• Active project: 9 stable releases in 90 days, 1.1 million weekly npm downloads and an official MCP plugin.

Cons

• No vendor hosting for new projects, and Enterprise features have no public price.

• Heavy: 823 packages and 957 MB installed, and the admin runs only on Next.js until 4.0.

• Scheduled publishing does nothing until you add a job runner, and the CLI runner fails with the website template.

• Telemetry and Gravatar requests are on by default, and the template's secrets are placeholders.

• Editors cannot change the content model; every field is code.

How Payload compares

• Strapi also keeps content in your own SQL database, but its Live Preview and scheduled Releases need the Growth plan, $45/month for 3 users; Payload includes both free. Pick Strapi if your developers want to build content types in a UI, or want vendor hosting: Strapi Cloud Starter costs $35/month.

• Sanity gives editors free click-to-edit visual editing and real-time co-editing, which Payload lacks, but your content lives only in its hosted Content Lake. Pick it if editors work on documents together; Growth costs $15 per seat a month.

• Directus builds its admin over existing SQL tables that you manage in its Data Studio, not in code. Pick it for a database you already have; its free Core is capped at 3 seats and 25 collections.

See all CMS platforms we list.

Who should use Payload

Use Payload if you build on Next.js, want the content model in TypeScript next to your app code, and will run your own server and database; agencies get the same free license for every client site. Look elsewhere if editors need to add fields themselves, if you want vendor hosting at a published price, or if you need SSO and audit logs without an Enterprise contract.

FAQ

Is Payload free?

Yes. Payload is MIT-licensed and free to self-host, with no limit on editors, projects or content. Only Enterprise features such as SSO, audit logs, approval workflows and dedicated support cost money, and Payload does not publish their price.

Can I still host on Payload Cloud?

Not for a new project. Payload Cloud stopped taking new projects after Payload joined Figma, and its new-project page says creation is only available for Enterprise teams. Existing projects keep running. Payload points new users to self-hosting or its one-click templates for Vercel and Cloudflare.

Which databases does Payload support?

MongoDB, Postgres and SQLite through official adapters, plus Vercel Postgres and Cloudflare D1. We tested SQLite, which needs no database server; according to Payload's docs, the only field type SQLite lacks is the Point field.

Do I need Next.js to use Payload?

For the admin and API, yes in version 3: Payload installs into a Next.js app, and the 4.0 beta adds TanStack Start. Your public site can use another framework such as Astro, Nuxt or SvelteKit and read content over REST or GraphQL; Payload has an official Astro example that runs the two side by side.

Does Payload support SSO?

Only in Enterprise, which connects SAML and OAuth 2.0 identity providers and is priced on request, per Payload. The free version lets you write your own authentication strategy in code, but that is development work, not a ready-made feature.