[email protected]

n8n Alternative: n8n, Activepieces and Node-RED Compared

n8n Alternative: n8n, Activepieces and Node-RED Compared

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

Do you run n8n or Node-RED, or are you planning an automation platform? On the pages for n8n and Node-RED we describe hosting, operations and workflow development. We classify the licence situation with you in advance. View the n8n page · Book an intro call (free and non-binding)

Anyone looking for an n8n alternative finds many tool lists. In operation these questions usually arise: What does the licence allow, what does running it cost, and what happens to the existing workflows? This article compares n8n with Activepieces and Node-RED on these criteria and relies on licence texts, vendor documentation and the GitHub API. As of 5 November 2026.

The focus is on licence, operations and migration. For a comparison of n8n with Dify, Flowise and Langflow for AI applications, see the article Dify, Flowise, Langflow and n8n compared. The licence is repeated here only as far as the comparison needs it. This article is not legal advice.

Table of contents

In brief

Question Answer
Is n8n open source? No, according to the vendor. Licence: Sustainable Use License 1.0 (fair-code)
When is the n8n licence a reason for an alternative? When hosting an instance on which customers build workflows themselves, and when embedding it in a product in which end users configure workflows
Internal use, contract work, installation at the client Allowed according to the licence FAQ
Direct alternative Activepieces: MIT core, enterprise features in ee directories under a commercial licence
Different tool Node-RED: Apache 2.0, event-driven flows for devices, protocols and edge
SSO without a licence Node-RED through your own configuration without a licence surcharge; n8n from Business, Activepieces from Team
Security advisories 5 May to 5 Nov 2026 Activepieces 8, Node-RED 0; n8n considerably more, total not verified (not directly comparable)
Migration According to our research no official importer found; flows are rebuilt, credentials created in the target

When is an n8n alternative worth considering

In our assessment the licence alone is no reason to switch for companies running n8n for their own processes. Anyone running n8n for their own processes uses it, according to the vendor, "for your own internal business purposes", and that is explicitly allowed. An alternative is worth examining in these cases:

  • Customers are to build workflows themselves. Anyone who hosts n8n and gives customers the editor is, according to the FAQ, not covered without an agreement (the FAQ names exceptions for time-limited training and workshop settings).
  • End users are to configure workflows in your own product. The FAQ also excludes this for a custom UI, the API, MCP or an AI agent.
  • Roles, SSO or versioning are needed without buying a licence key. With Activepieces large parts of this are also paid. Node-RED brings user permissions, Git projects and, through configuration, SSO, but no role model like the enterprise tiers (see below).
  • The task is a different one. Anyone connecting devices, sensors or protocols is often closer to the task with Node-RED than with a tool for SaaS processes.

In our assessment a wish for "more open source" as an end in itself does not belong here. Which operational features are free differs per tool and is listed in the section on roles, SSO and audit.

What the n8n licence allows

The vendor's licence FAQ states the principle: "If workflows are only created or modified by you or people in your organization, you can use n8n under the Community license for free." The core text of the Sustainable Use License limits use to "your own internal business purposes or for non-commercial or personal use". Files with .ee. in the name or .ee in the directory name are under the n8n Enterprise License and may be used in production only with a valid licence.

The licence FAQ lists the following:

Allowed (wording of the FAQ) Not allowed (wording of the FAQ)
"Use n8n community version to help run your business" "Host n8n as a service and allow your clients to build workflows"
"Build automations for your clients on your instance, as long as your clients do not have the possibility to create or edit them." "Allow external end users to build or configure their own workflows through your product, whether via a custom UI, our API, MCP, or an AI agent acting on the user's behalf."
"Charge your customers for workflow creation, setup, and maintenance services." "Fork n8n's code to launch your own automation product"
"Charge your customers for training and consultancy services" "White-label n8n by removing our branding and offering n8n as is."
"Use n8n behind the scenes in your own product, where users can use and trigger the automations you built, and even connect their own accounts to them." "Use enterprise features that ask for a license key without an Enterprise license."
"Run several instances of n8n community version"

For service providers the FAQ section "Consulting and agency use" matters most. Consulting and automation services are explicitly permitted there if n8n remains the internal tool and clients receive outputs, not access. Operating it as a managed service is possible "provided clients do not access your n8n instance directly". The number of clients is not limited; access is the deciding factor. Installing on a client's own server is allowed "provided that you are not also hosting for them".

How typical constellations relate to the FAQ:

Constellation Situation according to the wording of the FAQ
Own instance, provider builds the workflows, client receives results Allowed, also for a fee
Installation and maintenance on the client's server, without hosting by the provider Allowed
Dedicated instance per client, hosted by the provider, client with viewer or trigger access, provider builds the workflows Not clearly regulated: "clients do not have the possibility to create or edit them" concerns only building, while the agency section also requires that clients do not access the instance directly. Whether a separate instance per client still counts as an internal tool is not regulated by the FAQ
Client builds workflows themselves on a hosted instance Not allowed
Using SSO, Git, Environments or external secrets Only with a Business or Enterprise licence key

For constellations with several client environments the FAQ refers to [email protected] and describes a partner programme for managing multiple instances as in development. The vendor also states there that the test is not UI visibility but who controls the workflow logic and whose commercial interests are served. A different usage model requires a separate agreement according to the Community licence page.

How the three licences differ

n8n Node-RED Activepieces
Core licence Sustainable Use License 1.0 (fair-code) Apache 2.0 MIT (community part)
Paid area in the repository Files and folders with .ee (n8n Enterprise License) None in the core packages/ee and packages/server/api/src/app/ee (Enterprise licence, per user seat)
Rights holder per licence text n8n GmbH OpenJS Foundation Activepieces Inc.
Open source by OSI No (statement of the vendor) Yes Community part yes (MIT)
Hosting for third parties, customers build themselves Not allowed without an agreement Allowed Allowed for the MIT part
Internal use Allowed Allowed Allowed

n8n. The licence limits use and redistribution. The vendor acknowledges that it therefore does not call itself open source (Community licence). The contributor agreement and the licence history are covered in the article Dify, Flowise, Langflow and n8n compared.

Node-RED. The LICENSE file carries "Copyright OpenJS Foundation and other contributors" and the text of the Apache License 2.0. Use, hosting and embedding are allowed; conditions include keeping the licence text, notices (NOTICE where applicable) and marking changes. The "Node-RED" trademark belongs to the OpenJS Foundation. Add-on products such as FlowFuse have their own terms: the FlowFuse repository is under Apache 2.0, except the directory forge/ee/ with its own licence.

Activepieces. The LICENSE separates: content under packages/ee/ and packages/server/api/src/app/ee is under the licence in packages/ee/LICENSE, everything else under MIT, except third-party components that keep their own licences. The enterprise licence permits production use only with agreement to the Subscription Terms or another agreement and "a valid Activepieces Enterprise license for the correct number of user seats". The licence page of the documentation confirms: the core is MIT, and enterprise features of a self-hosted instance require a licence. GitHub shows the repository licence as NOASSERTION or Other, presumably because of this mix.

What n8n, Activepieces and Node-RED are suited for

Versions as of 5 November 2026: n8n 2.46.6 (released 4 November), Activepieces 0.92.3-hotfix.2 (28 October), Node-RED 5.0.9 (21 October; version 5.0.0 appeared on 9 June). GitHub stars, rounded: n8n 209,600, Activepieces 25,400, Node-RED 23,800.

Criterion n8n Activepieces Node-RED
Visual editor Yes Yes (flows, agents, tables) Yes, browser-based flow editor
Integrations according to the vendor 2,622 integrations (the page says "2,000+" at the top, the counting rule is not explained) 775 open-source pieces Flow library: 6,360 recent nodes, plus flows and collections
Code Code node with JavaScript and Python Code step, pieces in TypeScript Function node (JavaScript), custom nodes as npm modules
AI and agents AI agent node, MCP server trigger, MCP client Agents, chat, knowledge, MCP server No dedicated AI core feature; integration through community nodes or the HTTP request and function nodes
Strength Process and SaaS integration Process and SaaS integration IoT, edge, protocols (MQTT; Modbus and OPC UA through community nodes)
Projects and access separation Projects: cloud from Starter (one shared project), self-hosted from Business according to the pricing page; the documentation assigns projects and RBAC differently Projects in the paid plans from Team Not built in, FlowFuse as a separate product

The numbers count different things: n8n counts integrations by an unexplained rule, Activepieces pieces, the Node-RED library individual nodes. They are not suitable as a ranking.

Classification by task:

Task Better suited To note
Process automation between many SaaS systems, with execution history and credential management n8n or Activepieces Team features (roles, SSO, Git) are paid in both
Wish for an MIT-licensed core in process automation Activepieces ee features remain paid
Sensors, machine data, MQTT, dashboards, edge devices Node-RED Editor is open without configuration, securing it is up to you
Letting customers build workflows themselves Activepieces (MIT core) or Node-RED, not n8n without an agreement Clarify rights and tenant separation yourself
Keep running existing n8n workflows unchanged n8n Check licence scope if third parties get access

Node-RED processes message objects (msg) in event-driven flows, n8n works with items and expressions, Activepieces with step references. In our assessment (not a comparative test), introducing Node-RED as a 1:1 replacement for n8n leads to a different task than the one Node-RED was originally aimed at.

What is free and what costs money

When self-operated, no licence fee applies to the community core in any of the three cases as long as the terms are met and no enterprise features are used. The vendors additionally offer cloud and licence tiers (pricing pages, retrieved on 5 November 2026):

Tool Tier Price according to the vendor page Included according to the vendor page
n8n Starter EUR 20 per month, billed annually 2,500 executions, 1 shared project
n8n Pro EUR 50 per month, billed annually 10,000 executions, 3 projects, admin roles, workflow history
n8n Business EUR 667 per month, billed annually 40,000 executions, self-hosted only, SSO and LDAP, Git, Environments, 6 projects
n8n Enterprise Individual External secret stores, log streaming, audit logging, SLA
Activepieces Free USD 0 1,000 credits per month, up to 5 users
Activepieces Plus USD 20 per month 10,000 credits, up to 5 users
Activepieces Team USD 200 per month 50,000 credits, 25 users, unlimited projects, SSO, standard roles
Activepieces Ultimate Individual SCIM, custom RBAC, audit logs, secret manager, releases and Git sync
Node-RED Open source No vendor prices No paid area in the core; FlowFuse has its own pricing page

n8n bills by executions, not by steps or users; whether the amounts are net or gross the page does not say. Activepieces bills in the cloud by credits: a run costs 1 credit regardless of the number of steps, AI steps with vendor-paid models cost 2, 10 or 20 credits depending on the model (with your own keys, according to the pricing FAQ, 1 credit per AI step plus model costs), additional agentic actions are counted separately, and overage on Plus and Team is USD 0.007 per credit. The vendor's install page says every plan on the pricing page is also available self-hosted. Whether and how the user limits and the credit model apply to a self-hosted community instance we have not verified.

For n8n, the pricing page lists queue mode under Business, while the documentation on community features states it is included in the Community Edition and multi-main is not. This is not necessarily a contradiction; we follow the documentation. For registered community users (free by email) n8n additionally unlocks folders, debugging in the editor and custom execution data. Business and Enterprise licence keys must, according to n8n, reach the licence server daily.

Which role, SSO and audit features exist without a licence

Feature n8n Activepieces Node-RED
Users and roles Community: instance roles owner and member; cloud Starter already includes one shared project and credential sharing; admin roles from Pro (cloud), for self-hosted the pricing page says Business and the roles documentation says Enterprise; custom roles Enterprise Standard roles from Team adminAuth with user list, permission * or read; no role model like enterprise RBAC
SSO SSO and LDAP from Business (pricing page), OIDC only Enterprise according to the guide From Team OAuth and OpenID through Passport strategies, configured yourself
Git and versioning Git and Environments only in Business and Enterprise Version history (draft and published); releases and Git sync only Ultimate Projects with Git, to be enabled in settings.js
External secret stores Enterprise only Secret manager only Ultimate No central secret manager documented in the core
Audit logs Enterprise only Ultimate only Admin API access can be logged through logging.console.audit (logging); no audit log like in the enterprise tiers
Projects and access separation See above (pricing page: self-hosted from Business) Projects from Team Not built in

Node-RED has one peculiarity: without configuration, anyone who can reach the IP address can use the editor and deploy flows. The documentation considers this state suitable only for a trusted network. Operation for several parties needs upstream protection or separate instances.

How much operations the three tools need

Aspect n8n Activepieces Node-RED
Installation Docker, Docker Compose, npm Docker Compose, Helm npm, Docker, also Raspberry Pi
Database SQLite (default) or PostgreSQL (16, 17, 18 according to the documentation) PostgreSQL File-based (flows.json), no mandatory database
Further components Redis for queue mode; task runner for code nodes Redis; S3 storage in the production setup None
Runtime Node.js (included in the container) Container Node.js 22.9 or newer from version 5.0
Scaling Queue mode in the Community Edition, multi-main paid Worker model Several instances, split by flow set (our architecture suggestion, not described in the documentation)

For n8n a vendor benchmark exists: up to 220 executions per second for a webhook with an Edit Fields step on an AWS c5a.large with 4 GB RAM and PostgreSQL. For Activepieces the production setup documentation recommends as starting values one worker per concurrent flow (0.5 vCPU, 1 GB), one app instance with 1 vCPU and 1 GB per ten workers, PostgreSQL with 2 vCPU and 4 GB, Redis and S3. Both are vendor scenarios or recommendations, not general capacity promises or minimum requirements.

Version jumps. For version 3.0 (status "early access") n8n announces changes: self-hosting only with Docker, no more npm or npx. A migration report under settings shows the impact in five levels (from "Upgrade blocked" to "Capability removed"), see the pages on breaking changes and the migration report. The Activepieces documentation lists versions with restructuring (for example 0.87.0 with changed billing and 0.91.0 with changed provider validation, see breaking changes) and describes a rollback. For Node-RED, version 5.0 requires at least Node.js 22.9 and recommends Node.js 24; older hosts need a runtime update first. An n8n installation running on Ubuntu with Caddy therefore belongs on the checklist before a version jump.

What the security advisories show

The basis is the published GitHub Security Advisories of the repositories in the period 5 May to 5 November 2026, evaluated by us on 5 November 2026. The count is a snapshot; GitHub lists change, and we could not reproduce the n8n total and severity distribution and therefore do not state them. Ratings follow GitHub ("moderate").

Tool Published advisories Distribution by severity Source
n8n Total not verified, see source list Three rated critical, see below List
Activepieces 8 1 critical, 3 high, 4 moderate List
Node-RED 0 2 advisories in the repository overall, both from 19 February 2021 List

The three n8n advisories rated critical, published on GitHub on 13 May 2026 (the CVE records partly followed later), concern CVE-2026-44791 (prototype pollution bypass in the XML node), CVE-2026-44789 (prototype pollution in the pagination of the HTTP Request node up to remote code execution) and CVE-2026-44790 (arbitrary file read through the Git node); the fixes are in versions 2.22.1, 2.20.7 and 1.123.43. Examples rated high are GHSA-6h4x-896x-fw5m (remote code execution in the main process through path traversal when loading the MCP node schema, 5 August; requires authenticated member access) and GHSA-6xcw-7xm6-48c6 or CVE-2026-86083 (expression sandbox escape, 2 September; affects the legacy expression engine). The developments since September are covered in the article n8n security update September 2026.

For Activepieces, the critical advisory GHSA-m992-8rcw-vmrx was a queue dashboard (Bull-Board) reachable without authentication (9 August, affected 0.80.0 to 0.84.0 with the dashboard enabled, fixed in 0.84.1). Rated high (by GitHub; the CNA record of CVE-2026-48499 says critical) are CVE-2026-48499 (access to data of other tenants and code injection through the sandbox cache of code pieces, before 0.84.0), CVE-2026-73081 (command injection in the name of a code step, fixed in 0.80.0) and CVE-2026-73083 (V8 isolate sandbox escape, 0.80.0).

Assessment. The numbers are not comparable without reference to size, attack surface and reporting culture, and 0 advisories for Node-RED does not mean Node-RED installations are secure: there, security depends on the secured editor and the community nodes in use. In the n8n and Activepieces examples named, two patterns recur: sandbox escapes in code execution and permission problems between projects or tenants (not a full frequency analysis). In our assessment a defined update procedure matters for operation, regardless of the tool.

Can an n8n system be migrated

According to our research on 5 November 2026 we found no official importer from n8n to Activepieces or Node-RED; Activepieces itself states that it does not import or convert n8n workflows. Node-RED imports its own flow JSON files. We have not examined third-party converters and do not recommend them.

What, according to our research, does not transfer automatically:

  • the workflow logic, because data model and expressions differ (n8n items and {{ $json... }}, Activepieces step references, Node-RED msg objects)
  • credentials: n8n can also export them decrypted via the CLI (plain text, handle with care); an automatic import into the target tool is not documented, and the target configuration must be adapted
  • execution history, trigger states, variables, roles, projects and community nodes: we are not aware of a documented standard transfer
  • webhook URLs: callers usually have to be switched over unless forwarding keeps the old URLs

A practical path in six steps:

  1. Inventory the workflows: triggers, connected systems, data volumes, code nodes, community nodes.
  2. Map each n8n node to an Activepieces piece or Node-RED node; missing integrations can often, but not always (protocol, authentication), be covered through the HTTP piece or the HTTP request node respectively.
  3. Secure the n8n export (workflow JSON via CLI or API) as documentation of the logic.
  4. Rebuild the flows in the target tool and create the credentials there.
  5. Run in parallel with webhook forwarding until the results match.
  6. Archive execution data if it is needed, because a documented standard import into the target tool is missing.

Anyone switching only for licence reasons should first check whether a clarification with the vendor or an adjustment of the operating model (for example installation on the client's server) makes the switch unnecessary.

What this means when a service provider is involved

Anyone having an automation platform operated by a service provider should clarify three questions in advance:

  • Who builds workflows? If only the provider and your own employees do, that speaks for use within the scope of the FAQ; infrastructure, contractual relationship and client access also matter. If external parties are to use the editor, this is generally not covered (the FAQ names exceptions for time-limited training).
  • Where does the instance run? On your infrastructure or on the provider's. The licence FAQ distinguishes between installation at the client and hosting.
  • Which features are needed? SSO, Git, Environments and external secrets require a licence key with n8n, which comes in addition to the operating costs.

The dedicated instance per client that a service provider hosts is, as described above, a borderline case that the FAQ does not clearly regulate. The vendor names a partner programme in development and [email protected] as the contact. We derive no statement from this. For Activepieces and Node-RED this question does not arise for the respective community core; for Activepieces it remains for the ee features.

Common misconceptions

  • "n8n is open source." No, the vendor does not call itself that. The source code is viewable, and use is limited by the Sustainable Use License.
  • "Self-hosted means free for everything." No. Features with .ee (n8n) or in the ee directory (Activepieces) need a licence, and with n8n limits apply to hosting for third parties.
  • "Activepieces is entirely MIT." Only the community part. The enterprise directories are under a commercial licence.
  • "Node-RED replaces n8n 1:1." No, the tasks differ: device and protocol flows versus process and SaaS integration.
  • "Workflows can be exported and imported." According to our research not automatically between the tools. The export documents the logic, and the rebuild starts from scratch.
  • "No advisories means secure." No. Node-RED published none in the period, yet security depends on editor access and community nodes.

Status and methodology

As of 5 November 2026. The data basis is the LICENSE files of the three repositories, the licence FAQ and Community licence page of n8n, the documentation and pricing pages of the vendors, the GitHub API (releases, stars, published security advisories in the period 5 May to 5 November 2026) and the integration directories of the vendors. Licence texts are quoted verbatim; the classification is not legal advice. Where we did not verify something, the text says so: the user limits and credit model of Activepieces when self-hosted, and third-party converters. The pricing page and documentation of n8n differ on projects, roles and admin rights; we follow the documentation and name the differences. Both pages present queue mode in different places (pricing page under Business, documentation in the Community Edition); this is a different presentation that we do not treat as a contradiction. Statements introduced with "in our assessment" are our own evaluations, not vendor statements. Stars change daily. Prices are vendor statements, for n8n without a statement on net or gross.

Our approach at WZ-IT

For n8n we offer installation, configuration, workflow development, backups and ongoing operation, within the licence and operating scope agreed in each case. For managed hosting, enterprise features or deviating usage models we check the required vendor agreement and include it in the offer on request. For Node-RED we offer installation, managed hosting and operation as well as flow and node development. Activepieces is not part of our offering.

For an enquiry about a switch we proceed as follows:

  1. Clarify the goal: process automation or device and protocol flows, who builds workflows, who gets access.
  2. Classify the licence situation: hold the wording of the vendor licence against the operating model, name borderline cases and clarify them with the vendor. We do not provide legal advice.
  3. Record the inventory: workflows, triggers, systems, code and community nodes.
  4. Plan operation: database, queue, secrets, updates, backups and securing the editor.
  5. Support the switchover: rebuild, parallel operation, shutdown of the old instance.

Monitoring runs 24/7, and the response to P1 incidents follows the service level. More on operations: Managed operations support.

Unsure whether your operating model fits the n8n licence or whether an alternative is the better choice? We classify purpose, licence situation and operations with you. View the n8n page · Book an intro call (free and non-binding)

Further guides

Sources

Timo Wevelsiep

Written by

Timo Wevelsiep

Co-Founder & CEO

Co-Founder of WZ-IT. Specialized in cloud infrastructure, open-source platforms and managed services for SMEs and enterprise clients worldwide.

Frequently Asked Questions

Answers to important questions about this topic

Companies worldwide trust WZ-IT

  • Stadtwerke Brühl
  • DGHO e.V.
  • solarwerkstatt berlin
  • Krüger Dirndl
  • ABCO Water Systems
  • Golem.de
  • EVADXB
  • nextGYM
  • AInergy
  • ml&s
  • Odiseo Solutions
  • Annota
  • ARGE
  • SweetConnect GmbH
  • Aphy AG
  • CORGOS
  • Rekorder
  • SolidProof
  • Yonju
  • Keymate
  • Paritel
  • Mr. Clipart
  • Millenium
  • Negosh
  • Führerscheinmacher
  • BTI
  • Deutsche Gesellschaft für Datenschutz
Read client reviews

Enquiry

Choose workflow automation or have it operated

We operate n8n and Activepieces in Germany, classify your use case and plan the migration between the tools.

  • Straight with Timo and Robin - no sales team, no pitch
  • A professional assessment of your situation
  • Concrete next steps for infrastructure, software or AI

The conversation is free and non-binding.

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
Timo and Robin, founders of WZ-IT

What are you planning?

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH