How much does Cloudflare R2 cost?

Standard storage, Infrequent Access, and operation rates

R2 charges based on the total volume of data stored and two classes of operations: Class A operations (which are more expensive and tend to mutate state) and Class B operations (which tend to read existing state). Standard storage has no minimum storage duration, so you only pay for what you keep.

Infrequent Access storage cuts the monthly storage fee to $0.01 per GB-month, but it adds two catches. First, there is a data retrieval fee of $0.01 per GB whenever you access or retrieve data, which includes reading or copying an object. Second, it enforces a 30-day minimum storage duration. If you write an object to Infrequent Access and delete, replace, or move it after 3 days, you are still billed for the full 30 days of storage.

Operations are split into three cost categories:

• Class A operations ($4.50 per million on Standard, $9.00 per million on Infrequent Access) cover mutations, uploads, and administrative bucket writes.
• Class B operations ($0.36 per million on Standard, $0.90 per million on Infrequent Access) cover reads and metadata checks.
• Free operations cost $0 and include DeleteObject, DeleteBucket, and AbortMultipartUpload.

R2 also gives every account 100,000 buckets for free. That allowance is shared across all storage classes and applies regardless of your Workers plan; additional buckets cost $0.10 each per month.

How storage volume is calculated

R2 bills storage in gigabyte-months (GB-month). A GB-month is calculated by averaging your peak storage per day over a 30-day billing period.

If you store 300 GB for 10 days and then delete every object for the remaining 20 days of a billing cycle, your daily peak is 300 GB for 10 days and 0 GB for 20 days. Averaged across the 30 days, your billable storage is 100 GB-months. Subtracting the 10 GB-month free tier leaves 90 billable GB-months on Standard storage, coming out to $1.35.

Because Standard storage has no minimum duration, temporary files, build artifacts, and test runs only count against your storage while they sit in the bucket.

Class A vs. Class B operations: what belongs where

Every request sent to R2 falls into Class A, Class B, or the free category. If you misconfigure an application loop to list a bucket constantly or upload objects in tiny pieces, Class A fees can overtake your base storage cost quickly.

Class A operations ($4.50 per million)

Class A operations change state, configure buckets, or list inventory:

• PutObject
• CopyObject
• ListObjects
• CreateMultipartUpload
• UploadPart
• UploadPartCopy
• ListParts
• CompleteMultipartUpload
• ListMultipartUploads
• PutBucket
• ListBuckets
• LifecycleStorageTierTransition
• PutBucketEncryption
• PutBucketCors
• PutBucketLifecycleConfiguration

Because ListObjects is a Class A operation, tools that poll buckets to check for new files run up Class A charges instead of cheaper read charges.

Class B operations ($0.36 per million)

Class B operations inspect or read stored data:

• GetObject
• HeadObject
• HeadBucket
• UsageSummary
• GetBucketLocation
• GetBucketEncryption
• GetBucketCors
• GetBucketLifecycleConfiguration

Free operations ($0.00)

Deleting data does not incur operation charges:

• DeleteObject
• DeleteBucket
• AbortMultipartUpload

How failed requests get billed

Failed requests depend on where the failure happens. Requests that fail during authentication or authorization are never charged. You will not pay for:

• HTTP 401 (Unauthorized) from missing or invalid credentials
• HTTP 403 caused by SignatureDoesNotMatch, ExpiredRequest, or RequestTimeTooSkewed
• HTTP 403 (AccessDenied) when valid credentials lack permission for that operation

Requests that pass authentication and authorization but fail later for application-level reasons are billed under their normal class. For instance, a PutObject returning HTTP 412 (PreconditionFailed) from an If-None-Match header counts as a Class A operation. Similarly, a PutObject returning HTTP 400 (BadDigest) because of a mismatched Content-MD5 header is billed as a Class A operation.

Is Cloudflare R2 egress really free?

There are no charges for egress bandwidth for any storage class. Egressing directly from R2 - including via the Workers API, S3 API, and r2.dev domains - does not incur data transfer charges and is free.

If an asset stored in R2 is downloaded a million times directly through the S3 API or over a public link, Cloudflare charges zero dollars for the petabytes of outbound traffic. You only pay for the 1 million Class B GetObject requests ($0.36 if you exceed the 10 million free monthly operations allowance).

The one catch is downstream services: if you connect other metered services to an R2 bucket, you may be charged by those services. For instance, if you run code on a cloud provider outside Cloudflare that downloads R2 files over the public internet, R2 does not charge you to send that traffic, but your external cloud provider might bill you for ingress or compute processing according to its own pricing sheet. For details on how Cloudflare bills adjacent compute products, see our guide on how Cloudflare Workers pricing works.

Public bucket access: r2.dev vs. custom domains

By default, buckets are never publicly accessible and will always require explicit user permission to enable.

When you need an R2 bucket to serve files publicly, you have two options:

1. Expose your bucket using a Cloudflare-managed https://r2.dev subdomain.
2. Expose your bucket as a custom domain under your control.

The r2.dev subdomain is intended for non-production use cases. It does not support WAF custom rules, caching, access controls, or Bot Management. If you want caching or security rules in front of bucket traffic, you must configure the bucket behind a custom domain.

To turn on the development URL in the dashboard:

1. In R2, select the bucket you want to modify.
2. On the bucket page, select Settings.
3. Under Public Development URL, select Enable.
4. In Allow Public Access?, confirm your choice by typing allow and select Allow.

If you expose an r2.dev URL publicly and scrapers hammer it, you will not pay for bandwidth, but every download triggers a Class B GetObject request.

Migration costs with Super Slurper and Sippy

Cloudflare provides two native tools to copy data into R2 from other object stores without managing external migration servers.

Super Slurper

Super Slurper is free to use. You are only charged for the Class A operations that Super Slurper makes to your R2 bucket.

• Objects smaller than 100 MiB upload in a single Class A operation.
• Objects 100 MiB or larger use multipart uploads to increase transfer success rates, performing multiple Class A operations.

Sippy

Sippy is Cloudflare's on-the-fly incremental migration tool. Sippy is free to use; you are only charged for the operations Sippy makes to your R2 bucket.

• Objects smaller than 200 MiB upload in a single Class A operation.
• Objects 200 MiB or larger use multipart uploads and perform multiple Class A operations.

For both migration tools, R2 charges nothing for the inbound network bandwidth. You only pay for the Class A writes into R2, alongside any egress fees your source storage provider levies to let data leave their network.

Monitoring R2 spend with Costbrake

Because R2 egress is free, standard storage invoices rarely jump from bandwidth spikes. The common risk comes from runaway Class A write loops, heavy multipart chunking, or public development URLs being scraped for millions of Class B reads.

Costbrake watches what you spend across 23 cloud, AI and SaaS providers - including Cloudflare, AWS, and Google Cloud - and alerts you on spikes, budget thresholds, month-end forecasts, and new charges. Checks run hourly on the Free plan, every 5 minutes on Pro and Team, and up to every minute during an active spike. Spike alerts fire when an hour costs more than 3x the usual 7-day baseline and at least $5 more than usual.

For Cloudflare, Costbrake tracks live usage priced at list rates, with billed daily dollars matching your invoice about a day later. If an r2.dev test bucket is left open and runs up unexpected Class B read charges, Costbrake includes an opt-in, reversible brake on Pro and Team plans to turn off the r2.dev URL for that specific bucket. The brake only runs when an admin clicks and confirms it in the app; it never triggers on its own, it does not delete resources, and your S3 API credentials, Workers bindings, and custom domains keep working.

To set up monitoring without copying manual credentials, point your coding assistant to agent setup. You approve the temporary session in the app, and it connects Cloudflare with read-only analytics permissions. If you want to put hard caps on accompanying compute, read our guide on whether you can put a spending limit on Cloudflare Workers, Durable Objects and R2, or check how to configure alerts when Cloudflare usage jumps. For account tier limits and plan features, see Costbrake pricing.