Pricing

Free to use. Free to run yourself.

The encryption is not the paid part and never will be. What a paid plan buys is the shape around it — vaults, an audit trail, the accounts that make a share attributable to somebody, and a way for someone outside to send a credential in.

01 / Plans

Four tiers, one security model

No plan weakens the guarantee. A paid share is encrypted exactly the same way a free one is, and the server can read neither.

No prices yet, on purpose.Only the Community tier exists today. The paid tiers are being built and priced, and putting a figure here before it has met a customer would make it a commitment rather than a plan — so ask, and you get the current thinking with its caveats attached. See the FAQ for what is actually available now.

Community

Freeforever, no account, unlimited users

Nothing to pay and nothing to sign

Everything needed to hand one person a password safely, and the whole thing under MPL-2.0 if you would rather run it yourself. This is the product as it exists today.

Browser-side AES-256-GCM encryption
Anonymous link sharing, no sign-in
Expiry up to 1 day without an account, 7 days signed in
Up to 12 views per share
Optional Argon2id passphrase
Named-recipient, domain and CIDR restrictions
Destroy-after-reading
Self-host under MPL-2.0, free and unsupported

Share a secret

TeamPlanned

Up to 25users in one organisation

Flat monthly price for the organisation, not per seat

For a team that shares credentials often enough to want them organised, attributable, and revocable in one place.

Everything in Community
Accounts, organisations and roles
Shared vaults and team-owned shares
Secret requests — ask someone outside to send you one
Slack app — create and request from a channel
Country and subdivision restrictions
Email notification and OTP, bundled not metered
Creator-side deletion and recovery

Ask what Team costs

BusinessPlanned

Up to 100users in one organisation

Flat monthly price, a few times the Team tier

For an organisation that has to answer to an auditor, and wants the controls that come with that without a procurement cycle.

Everything in Team
Enforced single sign-on
Audit log, searchable, 90-day retention
Audit export to your own SIEM
Retention policy engine
Custom domain
Intake vaults with settings a member cannot loosen

Ask what Business costs

EnterprisePlanned

Unlimitedusers, no seat ceiling

Annual contract, invoiced through procurement

Defined by the obligations we take on rather than by where it runs. Every tier is hosted, including this one — the difference is what we sign.

Everything in Business
Multi-year audit retention
SAML and SCIM against your identity provider
Data residency in a region you choose
Signed DPA and security-review support
Availability commitment
Invoiced procurement

Talk to us

Four things are settled even though the figures are not. Paid tiers are priced flat for the organisation rather than per seat, so adding an auditor or a contractor to a vault does not change the bill. The user counts are ceilings, not meters — nothing is billed by the secret, the recipient, or the message. Annual billing costs less than paying monthly. And a lapsed subscription drops an organisation back to Community rather than locking anyone out of a secret they have already stored.

02 / Self-hosting

The unpriced option

The backend is one Rust binary over a SQLite/libSQL file. There is no licence key and no phone-home, because there is no paid on-premises tier for one to police.

MPL-2.0, and what that means for you

Run it, modify it, and combine it with your own proprietary code — the licence permits all three, and there is no obligation triggered by running a modified copy as an internal service. What it asks is that changes to ravendrop's own files be published, so a modification to the cryptography cannot be made silently.

MPL-2.0

Docker, one command

A hardened, non-root image and a Compose stack with an ordered one-shot migration, a persistent volume, and a readiness check.

No cost

Your database, your region

Encrypted payloads and the control plane share one schema. Point it at a local file or a remote libSQL instance in whichever jurisdiction you have to answer to.

No cost

Same boundary as the hosted service

The HTTP security and network-access boundaries are shared code. Self-hosting does not mean running a weaker build.

No cost

What it does not come with

Accounts, vaults, SSO and the audit trail are hosted-only, and self-hosting is unsupported. If you need both your own hardware and the paid feature set, we are not the right answer — better to hear that here than after an evaluation.

Community only

03 / Never priced

Some things do not get a meter

Metering a security control puts a customer's instinct to control cost against their own posture. These stay in every tier, at any volume.

Second factors

A one-time code sent to an email recipient is mandatory and cannot be switched off. Billing per message would mean a customer trimming their invoice by trimming a second factor, so codes are bundled — or you bring your own provider and pay it directly.

Every tier

Audit-trail integrity

Hash chaining and signed checkpoints are how the log is worth reading at all. How long it is kept and where it can be streamed is what a tier buys; the record being tamper-evident is not.

Every tier

Getting your data out

Export is free on every tier, and security patches reach every deployment including the ones we do not run. Lock-in is a poor argument for a product bought on trust.

Every tier