Heroku vs Vercel vs Railway in 2026: pricing, what each does best and when to leave
Comparison · · 7 min read
Vercel is the best place for a Next.js frontend. Railway is the quickest way to run always-on containers next to a database. Heroku still works, but since February 2026 it only gets maintenance, so don't start anything new there.
Below: how each one bills as of November 2026, what it does best, and when moving to your own VPS pays off. Full disclosure: SecuryBlack, the VPS option in this table, is our product.
Heroku vs Vercel vs Railway at a glance
Prices as of November 2026, in US dollars.
| Heroku | Vercel | Railway | SecuryBlack + your VPS | |
|---|---|---|---|---|
| Pricing model | Per dyno, per month: $7 Basic, $25 Standard-1X | $20 per developer on Pro with $20 of usage included, then usage on top | $5 Hobby or $20 Pro, each including that much usage, then about $20 per vCPU and $10 per GB of RAM a month | Fixed monthly VPS price; SecuryBlack free during the beta |
| Free tier | None. Eco dynos cost $5 and sleep after 30 min idle | Hobby, non-commercial use only | $1 of credit a month, 0.5 GB of RAM per service | The VPS is paid |
| Workers / websockets | Yes: worker dynos and WebSockets | Beta: WebSockets close at the function time limit; Daemons for workers | Yes, any long-running process | Yes, any process on your server |
| Databases | Heroku Postgres from $5, $50 for Standard-0 | None of its own: Neon, Supabase, Upstash via Marketplace | One-click Postgres, MySQL, Redis, MongoDB; you turn backups on | On the same server, with encrypted backups |
| Regions | US and EU (more with Private Spaces) | 19 compute regions, 126+ CDN locations | 4: California, Virginia, Amsterdam, Singapore | Wherever your provider has a data centre |
| Where data lives | Heroku, on AWS | Vercel, plus your database provider | Railway | Your server, at the provider you pick |
| Lock-in | Medium: the app moves, add-ons need replacing | Medium: Next.js runs anywhere, Vercel-only services don't | Low: Railpack or Dockerfile builds | Low: containers on a server you rent |
| Security and ops | Heroku runs the platform | Vercel runs the platform | Railway runs the platform | You own the server; SecuryBlack audits it and backs it up |
1. Heroku: still running, no longer moving
On 6 February 2026 Heroku announced a "sustaining engineering model": stability, security, reliability and support instead of new features. Enterprise contracts are no longer sold to new customers. If you pay by card, nothing changed: same prices, same service. No shutdown date has been announced.
- Pricing (as of November 2026): per dyno and month, Eco $5, Basic $7, Standard-1X $25, Standard-2X $50 and Performance-M $250. Heroku Postgres starts at $5 (Essential-0); Standard-0 costs $50.
- Good at: classic web apps with a Procfile, worker dynos and add-ons. It's mature and predictable.
- Weak at: no free tier, only US and EU on the shared runtime, and a roadmap that has mostly stopped.
Ideal for: apps that already run there and run fine.
2. Vercel: the best home for Next.js, billed per seat plus usage
- Pricing (as of November 2026): Hobby is free but limited to non-commercial use. Pro costs $20 per developer per month and includes $20 of usage credit. Above that, functions are billed by active CPU (from $0.128 per hour) and invocations ($0.60 per million). See Vercel pricing.
- Flat Rate CDN: since September 2026, new Pro teams pay a fixed price for CDN traffic. 1 million requests and 1 TB of transfer are included, then tiers go from $20 a month (10 million requests) to $300 (150 million). A spike no longer lands on the bill; sustained growth moves you up a tier the next month. It covers the CDN, not your functions (Vercel's announcement).
- Backend: WebSockets have been in public beta since June 2026, but a connection only lives until the function's max duration (5 minutes on Hobby, up to 800 seconds on Pro), so clients must reconnect. Background workers (Daemons) and Docker images are also in beta. Databases come from Marketplace providers such as Neon, Supabase or Upstash.
- Good at: a preview deployment for every pull request, a global CDN and first-class Next.js support from the company that builds it.
Ideal for: Next.js frontends, marketing sites and apps whose backend lives somewhere else.
3. Railway: containers and databases, billed by the second
- Pricing (as of November 2026): Hobby costs $5 a month and Pro $20 per workspace; each includes that amount of usage. Beyond it you pay per second: about $20 per vCPU and $10 per GB of RAM a month, $0.15 per GB of volume and $0.05 per GB of egress. The free plan gives $1 of credit a month. See Railway pricing.
- What that means: an API and a Postgres that each sit at 1 GB of RAM use about $20 a month in memory alone, before CPU. Light services cost little; busy ones add up.
- Good at: any long-running process, one-click Postgres, MySQL, Redis and MongoDB, and a clear UI to wire services together. It builds with Railpack or your Dockerfile.
- Weak at: 4 regions, and database backups are yours to turn on.
The October 2026 incident. On 21 October Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables. They were encrypted, but for some of them the attacker obtained the decrypted contents. Railway asked every user to rotate all variables and registry credentials, and paused deployments during the investigation. If you're on Railway and haven't rotated yet, do it today.
Any platform that holds your secrets can be breached, your own server included. The difference is scope: on a VPS your secrets sit on one machine you control, not in a shared system with millions of other users.
Ideal for: MVPs, bots, APIs with a database and multi-service prototypes.
4. SecuryBlack + your own VPS
You rent a VPS from Hetzner, DigitalOcean, OVH or any provider and connect it to SecuryBlack, a hosted panel.
- Deploys (beta): connect GitHub and every push is built with Railpack on your server and published on your domain with SSL. If the new version fails its healthcheck, the previous one keeps serving. One-click templates cover common apps.
- Measured: a Next.js 16.4 app on a 2 vCPU VPS took 110 s on its first deploy, 59 s per push with build cache, and runs in 74 MB of RAM. The Vercel to VPS guide has the steps and the two things that broke.
- Keeping the server healthy: a security audit (FerroSentry) checks SSH, the firewall, ports and updates and gives you the exact command for each fix. Hardening is one click, and you confirm it. Backups are encrypted, with restore and an alert if one stops arriving. Uptime monitors watch your apps. The agent (OxiPulse) is open source and written in Rust.
- Cost: you pay your VPS provider a fixed monthly price. SecuryBlack is free during the beta.
- The trade-off: you own a server. SecuryBlack cuts the work, but the server is still yours. There are no pull request previews or docker-compose builds yet, no global CDN (put Cloudflare in front), and capacity is fixed until you move to a bigger machine. Restores are manual, so practise one before you need it. Coming from Coolify? See our SecuryBlack vs Coolify comparison.
Ideal for: indie hackers, agencies and technical startups that want a predictable bill and control over their infrastructure.
When to choose each
Stay on Vercel if you work alone or in a small team, ship a Next.js frontend and your traffic is modest. Pro at $20 a month is a fair price, the Flat Rate CDN keeps traffic predictable, and moving would save you little while costing you previews and the CDN.
Pick Railway if you need always-on services and a database running this afternoon. Stay while the bill is small: per-second pricing is hard to beat for light services. Rotate your secrets first.
Stay on Heroku if your app runs fine and the bill is acceptable: card prices didn't change and there's no deadline. Don't start a new project there: no free tier, no new features, and new enterprise contracts aren't sold.
Move to your own VPS when:
- you pay Vercel Pro for several developers, at $20 a seat;
- your functions burn CPU, or your Railway services hold RAM around the clock;
- you need long-lived WebSockets or workers that aren't in beta;
- you pay for a database elsewhere that could run on the same server;
- you want your data on a server and in a country you choose.
If you run a SaaS in production, a growing database, demanding backend processes or client servers, your own VPS gives you a predictable bill. SecuryBlack helps you monitor it, protect it, back it up and, in beta, deploy from GitHub. Deploy your first app: it's free during the beta.