45.3k stars · MIT · v3.91.0 (2026-10-15) · Track this in Rising ↗
A full content database with a generated admin screen and API, for content that has real structure rather than being blog posts.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 27 Oct 2026, the same day before this check.
Latest release v3.92.0 on 22 Oct 2026.
Public since January 2021, a little over 5 years.
45,519 stars and 4,345 forks.
514 commits and 254 new issues in the last 90 days.
590 contributors. 568 pull requests merged in 90 days.
A security policy says how to report a problem. 50 published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 27 Oct 2026 from the repository on GitHub. Covered in Edition 14.
▶Repo detailsthe review · specs · pros & cons · install
What it does
Payload is a content system that runs inside a Next.js application, and Next.js is a framework for building websites in JavaScript. Content is stored in PostgreSQL, MongoDB or SQLite, which are databases. Collections of content are described in TypeScript, and Payload builds the admin screens and the reading interface from that description. It includes user accounts, roles and permissions, file uploads, drafts and version history. Version 3.91.0 was published on 15 October 2026, and releases land most weeks. It does not keep content in files, so a site generator cannot read it off disk; the content is read over the network instead.
Why it matters
Who it suits. It suits content with structure rather than prose: a template gallery where each item has a name, a picture, a category and a difficulty, or a glossary that a website and an application both read from. It suits a team that needs separate accounts and permissions. Skip it while the content is a few dozen posts, because entries 1 to 3 do that job with no server at all.
Verdict. The honest answer once files stop fitting, and the wrong answer before that. Plan one to two gigabytes of memory, a database, and the time to keep both patched. Its MIT licence is a real MIT licence with no carved-out folders, which is worth noting beside directus/directus and strapi/strapi, the two obvious alternatives.
Summary (Key Points)from the README
Key features
- Next.js native: Installs directly inside an existing `/app` folder, so the frontend and backend can share one codebase.
- Server-side data access: Queries the database directly in React Server Components, without REST or GraphQL.
- Type safety: Fully TypeScript, with automatic types generated for your data.
- Built-in auth and access control: Auth comes out of the box, with granular Access Control and document and field-level hooks for every action.
- Versions, drafts and localization: Supports document versions, draft workflows and localized content.
- Flexible content editing: Includes a block-based layout builder, the Lexical rich text editor and conditional field logic.
- Extensible admin: The React admin can be customized, and server components can extend the Payload UI.
- Security: Uses HTTP-only cookies and CSRF protection.
- Templates and plugins: Official and community templates (website, ecommerce) and plugins are available, with a template starter using Tailwind.
Ways to install
| Platform or method | What it needs | Effort |
|---|---|---|
| create-payload-app (website template) | Run `pnpx create-payload-app@latest -t website`; the README says to install the required software first, but does not list it | One command, plus local setup |
| Deploy on Cloudflare | Cloudflare Workers, R2 for uploads and D1 for the database | One click |
| Deploy on Vercel | A Next.js front end, a Neon database and Vercel Blob for media | One click |
Important
- Prerequisites not listed: The README tells you to install "all of the required software" but does not name it, so check the project's docs before starting.
- Platform services: The one-click options depend on specific services (Cloudflare Workers, R2, D1; Vercel, Neon, Vercel Blob), so the setup is tied to those providers.
- Migration from v2: Upgrading from v2 requires following the separate 3.0 Migration Guide.
- Community content: Community templates and plugins are not officially supported, so review them before relying on them.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- MIT licence with no carved-out folders, so a paid product can be built on it without reading fine print.
- Released most weeks. Version 3.91.0 is three days old.
- It provides a reading interface over the network at no extra work, so a website and an application share one copy of the content.
- It is a Node.js application with a database behind it. That is two more things to deploy, watch and update.
- Plan one to two gigabytes of memory. Check the machine has room before installing anything.
- It assumes Next.js. On a site built with another generator it becomes a separate content store that the site reads from, which is two moving parts rather than one.
npx create-payload-app@latest
