NetBird self-hosting licence 2026: what the Commercial Starter at 2,000 euros changes
Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.
Building remote access sovereignly, without licence traps? We plan and operate NetBird on your infrastructure or ours inside the EU, including identity provider and access policies - see managed secure access and NetBird expertise, or book an initial consultation.
NetBird has opened up its self-hosting licensing: instead of "price on request" there is now a figure on the pricing page. The Commercial Starter costs 2,000 euros per year for up to 50 users and 500 devices (netbird.io/pricing, as of July 2026). That is more than a price adjustment. It moves the line at which self-hosted zero-trust networking becomes realistic for mid-sized companies. This article sorts out what stays free, what the licence unlocks and when it pays for itself.
Table of contents
- What NetBird changed
- What the Community Edition covers
- What the Commercial Starter unlocks
- The maths: when the licence pays off
- Self-hosted and cloud cut the features differently
- What this means for NIS2 projects
- When you do not need the licence
- How we approach it at WZ-IT
- Further guides
What NetBird changed
The background starts in August 2025. NetBird moved the server-side components management/, signal/, relay/ and the dashboard from BSD-3 to AGPLv3, effective with version 0.53.0 (announcement dated 4 August 2025). Clients and the root repository stayed BSD-3. Self-hosting for your own organization remained explicitly permitted.
What stayed open was the question of commercial features. The documentation still describes exactly one "Enterprise Commercial License" and names no prices; anyone who wanted it had to contact sales. In GitHub discussion #6543, users publicly asked in June 2026 for transparent pricing, direct purchase without a sales call and a clearly delimited Community Edition. One participant reported on 25 June 2026 a quote of 11,000 US dollars for one year at 50 users. That is a user report rather than an official list price, but it explains why the debate gained momentum.
The newly published Commercial Starter answers both points: a public figure, and a tier below Enterprise. Notably the documentation does not yet reflect this tiering - on this point the pricing page is more current than the docs.
What the Community Edition covers
The most important part of the news is not the price but what does not sit behind it. The free Community Edition has no user and no device limit and includes:
- peer-to-peer connections including encryption, and the Control Center
- SSO and MFA via your own identity provider
- access controls and device posture checks
- private DNS, NetBird Networks and network routes
- audit event logging
- community support
That is the complete functional basis for identity-based remote access. How the architecture underneath works is explained in What is NetBird?; connecting the identity provider is covered in Connecting NetBird to Authentik or Keycloak.
What the Commercial Starter unlocks
The commercial licence adds operational features, not security features (documentation):
| Feature | Community | Commercial Starter | Enterprise |
|---|---|---|---|
| Users / devices | unlimited | up to 50 / 500 | from 50 / unlimited |
| SSO and MFA with your own IdP | ✓ | ✓ | ✓ |
| Access policies, posture checks | ✓ | ✓ | ✓ |
| Audit event logging | ✓ | ✓ | ✓ |
| Active-active HA (management, signal) | - | ✓ | ✓ |
| SCIM provisioning | - | ✓ | ✓ |
| Device approvals | - | ✓ | ✓ |
| EDR and MDM integrations | - | - | ✓ |
| Traffic-flow logging and streaming | - | - | ✓ |
| Support | community | SLA, dedicated contact | |
| Price per year | 0 euros | 2,000 euros | on request |
Technically the switch is unspectacular: the key goes into the deployment's .env as NB_LICENSE_KEY, the server validates it on startup and unlocks the features. No reinstall is required, which makes moving from Community to Commercial Starter an operational decision rather than a project.
The maths: when the licence pays off
The price gets interesting compared with the vendor's own cloud. NetBird Cloud costs 6 euros per user per month on the Team plan and 12 euros on the Business plan; the free entry tier covers 5 users and 100 machines (as of July 2026).
Pure licence cost per year, excluding infrastructure:
| Users | Cloud Team (6 euros) | Cloud Business (12 euros) | Self-hosted Starter |
|---|---|---|---|
| 20 | 1,440 euros | 2,880 euros | 2,000 euros |
| 30 | 2,160 euros | 4,320 euros | 2,000 euros |
| 50 | 3,600 euros | 7,200 euros | 2,000 euros |
The break-even sits at roughly 28 users against the Team plan and roughly 14 users against the Business plan. Because the Starter is a flat fee, the gap widens with every additional user until the 50-user limit is reached.
What honestly belongs on the other side of the ledger is everything the cloud includes and self-hosting does not: servers, updates, monitoring, backups and availability. Those costs are real and push the break-even upwards. The difference is their nature - they are largely fixed and do not grow with every new hire. How that develops against other vendors' seat pricing is calculated in Tailscale pricing 2026.
Self-hosted and cloud cut the features differently
One detail that comparison tables tend to lose: the same feature sits at different levels in the two models.
- Device posture checks are already included in the free self-hosted Community Edition. In the cloud they require the Business plan at 12 euros per user per month.
- Audit event logging is free when self-hosting. In the cloud it starts with the Team plan.
- SSO and MFA with an enterprise IdP are free when self-hosting. The free cloud tier only offers social SSO; your own identity provider requires the Team plan.
For companies with compliance requirements this inverts the usual logic. Precisely the features needed for evidence are cheapest when self-hosting, not most expensive.
What this means for NIS2 projects
The German NIS2 implementation act has been in force since 6 December 2025, and the BSI explicitly lists multi-factor authentication solutions among the risk management measures. For companies still running OpenVPN, WireGuard or a VPN appliance, that is the trigger for migration.
The assessment is therefore unambiguous: meeting the MFA requirement with NetBird costs no licence fee. Factor verification happens in the identity provider anyway, for example in Authentik or Keycloak, and connecting it is part of the Community Edition. Which other paths exist and where their limits are is compared in Retrofitting MFA for VPN; the regulatory frame is placed by NIS2-compliant remote access.
What you pay for is resilience of the control plane and automated provisioning. Both are operations, not compliance.
When you do not need the licence
Three cases in which the 2,000 euros are unnecessary:
When you stay below 50 users and maintain accounts manually. SCIM automates creating and deactivating accounts. Anyone already keeping groups in the identity provider passes them to NetBird via the JWT claim - that works in the Community Edition and covers the larger part of the benefit.
When a short outage of the control plane is acceptable. Existing peer connections keep running because traffic flows directly between peers. What is affected are new logins and token renewals. For many mid-sized companies that is a maintenance window, not an outage.
When you are above 50 users. Then the Starter no longer applies and you are back in an Enterprise negotiation. That step should be known before the build, not when onboarding employee number 51.
Conversely the licence is money well spent as soon as remote access is business-critical, staff turnover is frequent, or an auditor wants to see automated deprovisioning.
How we approach it at WZ-IT
We start projects on the Community Edition as a rule and settle the licence question against three points: how many users will there be in twelve months, how critical is the access, and is there an obligation to evidence automated deprovisioning? Only that determines whether the Commercial Starter makes sense.
What we take on is the part that genuinely creates effort when self-hosting: control plane inside the EU, connecting the identity provider including the MFA rule, the group and policy model, site connectivity via routing peers, updates and monitoring. Anyone who wants that as a fixed price instead of a per-seat model will find it in our VPN flat rate.
What we do not do is sell a licence you do not need. In most setups below 30 users the Community Edition is the right answer.
Further guides
- What is NetBird? - architecture, operating models and positioning
- Connecting NetBird to Authentik or Keycloak - OIDC, group sync and where MFA is enforced
- Retrofitting MFA for VPN - the three paths compared
- Tailscale pricing 2026 - seat pricing against self-hosting
- NetBird vs Tailscale - the direct comparison
- Managed secure access - operations, SLA and site connectivity
Unsure whether Community Edition or licence? We work through your case with you instead of recommending blanket answers - including the migration path from OpenVPN, WireGuard or an appliance. Book an initial consultation.
Sources
- NetBird pricing: cloud and self-hosted tiers
- NetBird docs: Enterprise Commercial License
- GitHub discussion #6543: Licensing, Enterprise features, Transparent pricing, Community Edition
- NetBird: announcement of the move to AGPLv3 (4 August 2025)
- NetBird docs: connecting identity providers
- BSI: NIS-2 and multi-factor authentication
Frequently Asked Questions
Answers to important questions about this topic
The Community Edition stays free, with no user or device limit. New above it is the Commercial Starter at 2,000 euros per year for up to 50 users and 500 devices. For larger estates there is still an Enterprise licence with pricing on request (as of July 2026).
More than many expect: peer-to-peer connections including encryption, the Control Center, SSO and MFA via your own identity provider, access controls, device posture checks, private DNS, network routes and audit event logging. Users and devices are unlimited. That is enough to build NIS2-capable remote access without licence costs.
Active-active high availability for management and signal, SCIM provisioning of users and groups, device approvals and email support. The Enterprise licence adds EDR and MDM integrations plus traffic-flow event logging and streaming.
On pure licence cost: the Commercial Starter costs about the same as 28 users on the cloud Team plan (6 euros per user per month) or about 14 users on the Business plan (12 euros). Above that, self-hosting is cheaper. Against it you have to count infrastructure and operations, which the cloud price includes.
No. The building blocks that matter for NIS2 sit in the free Community Edition: multi-factor authentication via your own identity provider, access policies instead of a flat network, posture checks and audit logging. What you pay for is operational comfort, not security features.
Through the NB_LICENSE_KEY environment variable in the deployment's .env file. On startup the server validates the key and unlocks the licensed features. Moving up from the Community Edition does not require a reinstall.
Written by
Timo Wevelsiep
Co-Founder & CEO
Co-Founder of WZ-IT. Specialized in cloud infrastructure, open-source platforms and managed services for SMEs and enterprise clients worldwide.
LinkedInLet's Talk About Your Idea
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Leading companies trust WZ-IT
Timo Wevelsiep & Robin Zins
Managing Directors of WZ-IT