Cloudflare R2 vs S3 vs Vercel Blob: Object Storage Compared 2026

Object storage feels like a commodity. You upload files, you download files. How different can the options really be?

The answer: wildly different, especially once you factor in egress costs. AWS S3 charges $0.09 per GB for data transferred out to the internet. If your app serves 10TB of images, videos, or downloads per month, that is $900/month in egress alone, on top of storage costs. Cloudflare R2 charges $0 for egress. Zero. That single pricing difference can save startups thousands of dollars per month.

But pricing is not the only factor. S3 has 18 years of enterprise features, battle-tested durability (99.999999999%, eleven 9s), and deep integration with the entire AWS ecosystem. Vercel Blob offers the simplest developer experience for Next.js projects but with significant limitations. Each option fits different projects and scales.

If you are already evaluating your broader cloud infrastructure costs, object storage is often the second-largest line item after compute, making this decision financially significant.

Cloudflare R2

• Storage: $0.015/GB/month
• Class A operations (writes): $4.50 per million requests
• Class B operations (reads): $0.36 per million requests
• Egress: $0 (free, unlimited)
• Free tier: 10GB storage, 1M Class A, 10M Class B operations per month

AWS S3 (Standard)

• Storage: $0.023/GB/month (first 50TB)
• PUT/POST: $5.00 per million requests
• GET: $0.40 per million requests
• Egress: $0.09/GB (first 10TB), $0.085/GB (next 40TB)
• Free tier: 5GB storage, 20K GET, 2K PUT per month (12 months)

Vercel Blob

• Storage: Included in Vercel plan (100GB on Pro)
• Operations: Included (rate limits apply)
• Egress: Included in Vercel bandwidth (1TB on Pro)
• Pricing: Part of Vercel Pro at $20/month per team member

Cost at Scale Example

For a SaaS app storing 500GB of user uploads and serving 5TB of egress per month:

• Cloudflare R2: $7.50 storage + ~$2 operations = ~$10/month
• AWS S3: $11.50 storage + ~$2 operations + $450 egress = ~$464/month
• Vercel Blob: $20/month (within Pro plan limits)

The S3 egress cost is 46x higher than R2 for the same workload. That gap widens as traffic grows.

Cloudflare R2

R2 stores data across Cloudflare's global network of 300+ locations. Reads are served from the nearest edge location, which means low latency globally without configuring anything. Combined with Cloudflare's CDN (automatically enabled for public buckets), R2 delivers excellent performance for user-facing content. Write latency is slightly higher than S3 because data replicates across more locations.

AWS S3

S3 stores data in a single region (e.g., us-east-1). Reads from the same region are fast (5 to 20ms). Reads from other continents are slow (100 to 300ms) unless you add CloudFront (AWS's CDN) in front of S3. CloudFront adds another cost layer ($0.085/GB for distribution) but is necessary for global performance. S3 Transfer Acceleration can speed up uploads from distant locations at $0.04/GB.

Vercel Blob

Built on Cloudflare R2 under the hood (Vercel confirmed this). Inherits R2's global distribution and CDN benefits. The Vercel layer adds convenience (automatic CDN URLs, built-in image optimization) but also adds a dependency: you are locked into Vercel's platform for serving the content.

Latency Comparison

For a user in Tokyo accessing a file uploaded in the US: R2 serves from the nearest Cloudflare edge (10 to 40ms), S3 without CloudFront serves from us-east-1 (150 to 250ms), S3 with CloudFront serves from a nearby PoP (20 to 60ms after cache warm-up). For global audiences, R2's built-in CDN is a significant advantage over raw S3.

Cloudflare R2 DX

R2 is S3-compatible: it accepts S3 API calls, works with the AWS SDK, and supports most S3 features (presigned URLs, multipart uploads, lifecycle policies). Migration from S3 is straightforward: change the endpoint URL and credentials. Cloudflare Workers (serverless functions) integrate natively with R2 for server-side processing.

Limitations: no S3 Object Lock (for compliance immutability), no S3 Select (SQL queries over objects), no S3 event notifications (use Workers instead), and the web dashboard is less feature-rich than the S3 console.

AWS S3 DX

S3 has the richest feature set of any object storage service. Versioning, lifecycle policies, cross-region replication, server-side encryption (SSE-S3, SSE-KMS), access logs, inventory reports, Object Lock for compliance, and deep IAM integration. The AWS SDK is available in every major language. Every tutorial, every StackOverflow answer, every library supports S3.

The downside: IAM policies are notoriously complex. A simple "allow this app to read and write to this bucket" permission can involve 20 lines of JSON policy. New developers routinely misconfigure S3 buckets, leading to data exposure. The breadth of features creates cognitive overhead.

Vercel Blob DX

The simplest developer experience of the three. Upload files with a one-line function call: put('filename.jpg', file, { access: 'public' }). Returns a CDN URL immediately. No bucket configuration, no IAM policies, no CDN setup. Perfect for Next.js apps on Vercel.

Limitations: only works within Vercel's ecosystem, limited API compared to S3 or R2, no programmatic lifecycle policies, and the 100GB storage limit on Pro requires Enterprise for more. Not suitable as a general-purpose storage layer.

AWS S3: Enterprise-Grade

S3 leads in compliance certifications: SOC 2, HIPAA, PCI DSS, FedRAMP, ISO 27001, and dozens more. Fine-grained IAM policies, bucket policies, access point policies, VPC endpoints for private network access, and Object Lock for WORM (Write Once Read Many) compliance. For regulated industries (healthcare, finance, government), S3's compliance portfolio is unmatched.

Cloudflare R2: Good and Improving

R2 supports server-side encryption, access control via Cloudflare API tokens, and CORS configuration. Cloudflare holds SOC 2 Type II, ISO 27001, and PCI DSS certifications. R2 specific compliance features are growing but do not yet match S3's depth. No Object Lock equivalent, which means R2 cannot satisfy SEC Rule 17a-4 or similar immutable storage requirements.

Vercel Blob: Platform-Level Security

Security is handled at the Vercel platform level. Files are either public (anyone with the URL) or private (only accessible via server-side API calls). No bucket policies, no access logging, no fine-grained permissions. Sufficient for user avatars and marketing assets. Insufficient for sensitive documents, healthcare records, or financial data.

For comparison: if your project has compliance requirements like enterprise cloud infrastructure typically demands, S3 remains the safest bet. R2 covers most startup use cases. Vercel Blob is for convenience, not compliance.

S3 to R2 Migration

Because R2 speaks the S3 API, migration is mechanical: create an R2 bucket, run a sync tool (rclone, AWS CLI with custom endpoint) to copy objects, update your application's endpoint URL and credentials, and you are done. Cloudflare provides a Super Slurper tool for one-time bulk migrations from S3. Migration of 1TB typically takes 2 to 6 hours depending on object count.

R2 to S3 Migration

Equally straightforward since R2 supports S3-compatible tools. Use rclone or the S3 SDK to copy objects out of R2 (remember: R2 egress is free, so the migration costs nothing on the R2 side). S3 ingress is also free. The only cost is the time to copy.

Vercel Blob Migration

This is where lock-in becomes real. Vercel Blob does not support the S3 API. Exporting files requires using Vercel's list and download APIs to enumerate and copy every object. For large storage volumes, this is slow and cumbersome. Migration planning should happen before you commit to Vercel Blob for critical storage.

Our Lock-In Assessment

S3 and R2 are low lock-in: the S3 API is a de facto standard, and data moves freely between them. Vercel Blob is medium-high lock-in: convenient within Vercel but painful to leave. If portability matters (and it should), prefer R2 or S3 over platform-specific storage solutions.

Here is the decision framework:

• Choose Cloudflare R2 if egress costs matter (serving lots of files to users), you want built-in global CDN without extra configuration, your application does not require S3-specific compliance features (Object Lock, S3 Select), and you want the best price-to-performance ratio. R2 is the default recommendation for most startups in 2026.
• Choose AWS S3 if you are in a regulated industry requiring specific compliance certifications, you use other AWS services heavily and want tight integration, you need advanced features (Object Lock, Glacier archival, S3 Inventory, cross-region replication), or your organization already has AWS expertise and IAM infrastructure.
• Choose Vercel Blob if you are building a Next.js app on Vercel and need simple file uploads (avatars, thumbnails, PDFs), your storage needs are under 100GB, and developer experience and deployment speed are your top priorities.

For most startups: start with R2 for user-facing storage (images, documents, downloads) and S3 for anything with compliance requirements. Use Vercel Blob only for convenience in small Next.js projects where you do not mind the platform dependency.

Need help architecting your storage layer or migrating away from expensive S3 egress? Book a free strategy call and we will design the right storage strategy for your specific workload and budget.