What Is Cloudflare R2? Cheap S3-Compatible Storage Explained

CodexFuse Team · 2026-11-06T08:37:29.259Z · 27 min read min read

What Is Cloudflare R2? Cheap S3-Compatible Storage Explained

Cloudflare R2 is S3-compatible object storage with zero egress fees, built on Cloudflare's global network. That one sentence is the whole pitch: you store files the way you would in Amazon S3, and you never pay to download them again. If you serve images, videos, backups, or downloads to the public internet, the download bill is usually the part that hurts, and R2 removes it entirely.

This guide answers what Cloudflare R2 is in plain English, what it costs down to the cent, how it compares with Amazon S3, and how to set up your first bucket. Prices and limits here were checked against Cloudflare's own documentation on 6 November 2026, and every worked number was computed from those published prices. If you run a site on VPS hosting, R2 is the natural place to put the files your server used to serve itself.

What Is Cloudflare R2, Exactly?

What is Cloudflare R2? Cloudflare R2 is S3-compatible object storage with no egress fees, built on Cloudflare's global network. It stores unstructured data, which means files rather than database rows: images, videos, podcast episodes, backups, datasets, and machine-learning model artifacts.

It speaks the same S3 API that Amazon S3 uses, so existing tools, SDKs, and code can point at R2 by changing the endpoint and the credentials.

Cloudflare R2 storage is a form of cloud storage, and it works the way object storage always works: you create a bucket, which is a flat container, and you put objects in it. Each object has a key, a path-like string such as tutorials/intro.mp4, and a value of up to 5 TiB of bytes plus a small metadata bag. There are no real folders.

The slashes in a key are decorative, and listing with a prefix and a delimiter only fakes the folder experience.

Cloudflare lists the workloads R2 is built for: storage for cloud-native applications, cloud storage for web content, storage for podcast episodes, data lakes for analytics and big data, and storage output for large batch processes such as machine-learning model artifacts or datasets. It is, in Cloudflare's words, ideal for storing and serving unstructured data that needs to be accessed frequently over the internet, without incurring egress fees. That covers serving web assets, training AI models, and managing user-generated content.

The files themselves are the point, so before anything else: if you need to shrink, resize, or change the format of a file before it goes into a bucket, our file converter handles the conversion in the browser. R2 stores the file; it does not convert it for you.

How Does R2 Work Under the Hood?

R2 is four layers working together: the R2 Gateway, the Metadata Service, the Tiered Read Cache, and the Distributed Storage Infrastructure. The Gateway is the entry point for every API request, and it handles authentication and routing from Cloudflare's global network through Workers. The Metadata Service is a distributed layer built on Durable Objects that stores object metadata, such as the key and the checksum, and keeps reads and writes strongly consistent.

The Tiered Read Cache sits in front of storage using Cloudflare's Tiered Cache, and the Distributed Storage Infrastructure persistently stores the encrypted object data.

A write travels a careful path. The Gateway receives and authenticates the request at the edge, retrieves the encryption key from the Metadata Service, and picks a storage cluster inside the bucket's location. The encrypted data is written and replicated inside the region, and only then does the Metadata Service commit the metadata and send back HTTP 200.

There are no unacknowledged writes: a success response means the data is persisted to disk.

A read is the mirror image. The Gateway authenticates the request, looks up the metadata, tries the tiered read cache first, and otherwise fetches the object from a distributed-storage datacenter in the region that holds the data. The object is decrypted and served.

Because the metadata commit happens before the write is acknowledged, R2 is strongly consistent: read-after-write, metadata updates, deletion, and object listing are all strongly consistent globally, and clients observe the effects of a write, update, or delete immediately. Only IAM and API-key permission changes are eventually consistent, taking up to about one minute, and conditional writes such as If-Match and If-None-Match are evaluated atomically.

Durability is a design target, not a guarantee, and it is a different number from availability, so keep them apart. R2 is designed to provide 99.999999999% (eleven 9s) of annual durability, which Cloudflare illustrates this way: storing 10,000,000 objects, you should expect to lose one object once every 10,000 years on average. That durability comes from replication plus erasure coding, and writes return HTTP 200 only once data is persisted to disk.

The availability SLA is a separate 99.9%, and durability does not protect against intentional or accidental deletion, because R2 has no Object Lock to stop a delete.

You reach R2 through three interfaces: a Workers Binding, the S3-compatible API, and a REST API that powers the Cloudflare Dashboard and the Wrangler CLI. All requests route through the R2 Gateway. With a Workers binding, declared in wrangler.toml under [[r2_buckets]], your Worker gets put, get, head, list, delete, and createMultipartUpload with no credentials, no signing, and no SDK import.

With the S3 API, every bucket also exposes an endpoint at https://<account-id>.r2.cloudflarestorage.com, using AWS Signature Version 4 and the region auto.

R2 is not new. Cloudflare announced it in September 2021, put it into open beta on 11 May 2022, which is 1,640 days before this guide was written, and made it generally available on 21 September 2022, which is 1,507 days, or about 4.1 years, before this guide was written.

The open beta targeted 1,000 GET operations per second and 100 PUT operations per second per bucket. Cloudflare's launch release said more than 11,000 developers already had active accounts at general availability.

How Much Does Cloudflare R2 Cost?

Cloudflare R2 pricing charges for three things: storage, operations, and, for Infrequent Access only, retrieval. Egress is free. There are no charges for egress bandwidth for any storage class, which is the sentence the whole product is built around.

The table below is Cloudflare's published pricing, checked on 6 November 2026.

Class A operations are the ones that mutate state, and they cost more. The official list is ListBuckets, PutBucket, ListObjects, PutObject, CopyObject, CompleteMultipartUpload, CreateMultipartUpload, LifecycleStorageTierTransition, ListMultipartUploads, UploadPart, UploadPartCopy, ListParts, PutBucketEncryption, PutBucketCors, and PutBucketLifecycleConfiguration. Class B operations mostly read existing state: HeadBucket, HeadObject, GetObject, UsageSummary, GetBucketEncryption, GetBucketLocation, GetBucketCors, and GetBucketLifecycleConfiguration.

Deleting is free: DeleteObject, DeleteBucket, and AbortMultipartUpload cost nothing.

Storage is billed in GB-months, which is the average of peak storage per day over a 30-day billing period. Cloudflare's own example makes the math concrete: storing 1 GB for 5 days and then 3 GB for the remaining 25 days is charged as 1 GB times 5/30 plus 3 GB times 25/30, which is 2.66 GB-months. If you want to plan a real bucket, a storage size calculator turns your file counts and sizes into gigabytes before you multiply by the per-GB price.

Failed requests have their own rule, and it is generous in the right place. Requests that fail during authentication or authorization are not charged, including HTTP 401 and HTTP 403 from a bad signature, an expired request, or a skewed clock. Requests that pass authentication but fail for another reason are billed by class, so a PutObject that returns HTTP 412 for a failed precondition or HTTP 400 for a mismatched checksum still counts as a Class A operation.

The code block below recomputes every worked number in this guide from the published prices, so you can check the arithmetic instead of trusting it. Run it yourself and the outputs match the figures in the text.

# Cloudflare R2 worked numbers -- prices from developers.cloudflare.com/r2/pricing/
# (checked 2026-11-06) and S3 egress from aws.amazon.com/s3/pricing/
egress_saving_per_tb = 1000 * 0.09            # $90.00
r2_100gb, s3_100gb = 100 * 0.015, 100 * 0.023  # $1.50 vs $2.30
r2_1tb, s3_1tb = 1000 * 0.015, 1000 * 0.023    # $15.00 vs $23.00
storage_saving_1tb = s3_1tb - r2_1tb           # $8.00
free_tier_value = 10 * 0.015 + 1 * 4.50 + 10 * 0.36  # $8.25
portfolio_20gb = (20 - 10) * 0.015             # $0.15
std_example = (1000 - 10) * 0.015              # $14.85
ia_example = 1000 * 0.01 + 1 * 9.00 + 1 * 0.90 + 1000 * 0.01  # $29.90
ia_vs_std = round(ia_example / std_example, 2)  # 2.01x
asset_hosting = (10_000_000 * 30 - 10_000_000) / 1e6 * 0.36  # $104.40
five_tib_gb = 5 * 2**40 / 1e9                  # 5497.56 GB
print(egress_saving_per_tb, r2_100gb, s3_100gb, r2_1tb, s3_1tb,
      storage_saving_1tb, free_tier_value, portfolio_20gb, std_example,
      ia_example, ia_vs_std, asset_hosting, five_tib_gb)
# Expected output:
# 90.0 1.5 2.3 15.0 23.0 8.0 8.25 0.15 14.85 29.9 2.01 104.4 5497.55813888

Cloudflare R2 vs Amazon S3: The Honest Comparison

For files the public downloads, R2 is usually cheaper; for compliance-heavy enterprise workloads, S3 is still the safer pick. That is the honest one-sentence answer to cloudflare r2 vs s3, and the rest of this section is the evidence for it. The table compares the two on the points that change the bill or the architecture.

The egress line is where the money is. Amazon's own pricing page states that the data transfer out charge from Amazon S3 in Europe (Ireland) to the internet is $0.09 per GB, and the first 10 TB tier in US pricing is the same $0.09 per GB after a 100 GB monthly free allowance shared across the whole AWS account. Deliver 1 TB in a month and S3 charges 1,000 times $0.09, which is $90.00, while R2 charges $0.

Serve 5 TB a month and the gap is about $450.00. That is why R2's headline is egress, not storage.

Storage is a smaller but real saving too. Storing 100 GB costs 100 times $0.015, which is $1.50 a month on R2 Standard, against 100 times $0.023, which is $2.30 on S3 Standard. Storing 1 TB costs $15.00 on R2 against $23.00 on S3, a saving of $8.00 a month.

The $0.023 S3 storage figure is the US East list price as reported by independent pricing trackers that mirror AWS's published rates, and it falls to $0.022 and then $0.021 at higher volumes, so the storage gap narrows as you scale while the egress gap does not.

Keep the S3 side of the comparison fair. Transfers from S3 to CloudFront and transfers inside the same AWS region are free, so data that never leaves AWS never pays egress, and the 100 GB monthly free allowance covers small sites entirely. S3 also has the deeper feature set: Object Lock, customer-managed keys, S3 Select, inventory reports, native cross-region replication, and archive classes down to Glacier Deep Archive, which R2 has no equivalent of.

If your workload needs any of those, the egress saving does not matter, because R2 cannot do the job at all.

So the r2 vs s3 decision is a workload question, not a loyalty question. Choose R2 when large files are served to the open internet and S3 egress would dominate the bill, when your object storage sits in the same trust boundary as your Worker code, or when you are already on Cloudflare for DNS, CDN, and Workers. Choose S3 when you need compliance-grade features, when your bytes never leave AWS and flow into Athena or Redshift, or when your team's runbooks and IAM are deeply S3-shaped.

The cloudflare r2 vs aws s3 debate has no universal winner; it has a cheaper default for public downloads and a more complete platform for regulated work.

What Does the R2 Free Tier Actually Cover?

The Cloudflare R2 free tier covers 10 GB-months of Standard storage, 1 million Class A operations, and 10 million Class B operations every month, with egress free. That is enough for a small site's images, a podcast's back catalog, or a personal backup bucket, and it renews every month rather than expiring after a year. If you used every allowance to the full, it would be worth 10 times $0.015 plus 1 times $4.50 plus 10 times $0.36, which is $8.25 a month of usage for nothing.

A concrete example shows how far that stretches. A portfolio site with 20 GB of original photos stores 10 GB above the free allowance, so it pays 10 times $0.015, which is $0.15 a month, and nothing for bandwidth, however many people view the photos. That figure comes from Mecanik's image-hosting guide, and it is the reason photographers and small site owners are the classic R2 free-tier users: the storage is small, the audience is real, and the egress would have been the whole bill elsewhere.

The free tier applies to Standard storage only, and that limit matters more than it looks. Infrequent Access has no free tier: Cloudflare's own pricing page shows Free Tier as "NA" on every row of its Infrequent Access worked example, so IA bills from the first byte stored, the first operation, and the first gigabyte retrieved. Do not plan a budget that spends the free allowance on IA, because there is nothing to spend.

Zero egress does not mean a zero bill, and this is the mistake to avoid. Storage and operations are still billed, and Class B reads at $0.36 per million are the charge that grows on a popular public site. Cloudflare's own asset-hosting example proves it: 100,000 files of 100 KB each, read 10,000,000 times a day, costs $104.40 a month despite $0 egress, because 300 million reads in a month minus the 10 million free leaves 290 million billable reads.

The egress saving is real, but a busy site still pays for its reads.

Infrequent Access: When Cheaper Storage Costs More

Infrequent Access storage costs $0.01 per GB-month against $0.015 for Standard, which is 33.3% cheaper, or 66.7% of Standard's storage price. That is the whole attraction, and it is also the trap, because everything else about IA costs more: retrieval is $0.01 per GB, Class A operations are $9.00 per million instead of $4.50, Class B operations are $0.90 per million instead of $0.36, and there is a 30-day minimum storage duration. IA only wins when data is stored for a long time and read rarely.

Cloudflare's own worked example shows the trap with real numbers. Take 1,000 objects of 1 GB each, read 1,000 times each during the month. On Standard storage, 990 billable GB-months after the free tier cost $14.85, the 1,000 writes and 1 million reads fall inside the free tier, and the total is $14.85 a month.

On Infrequent Access, the same objects stored for 5 days and then deleted still bill a full 1,000 GB-months because of the 30-day minimum, which is $10.00, plus $9.00 of Class A operations, $0.90 of Class B operations, and $10.00 of retrieval, for a total of $29.90. The cheaper storage class costs 2.01 times as much for that workload.

The 30-day minimum deserves a number of its own. Delete an IA object after 5 days and you are billed for the full 30 days, which is 1.0 GB-month per gigabyte, while the same object on Standard would bill 5 days out of 30, or 0.167 GB-months. Moving an object from Standard to IA with a lifecycle rule also costs a Class A operation, so a transition is not free either.

The rule that follows from all of this is simple: use Infrequent Access for backups, archives, and logs that you almost never read and that you will keep for at least 30 days, and keep anything read often on Standard.

How to Use Cloudflare R2: Your First Bucket in 5 Steps

How to use Cloudflare R2 comes down to five steps, and the whole setup takes minutes rather than hours. There is no server to provision, no software to install, and no capacity to plan, because a bucket has unlimited storage and unlimited objects by default.

1. Create a Cloudflare account and open R2. Sign in to the Cloudflare dashboard, or create a free account, and open Storage and databases, then R2, then Overview. The first time, complete the checkout to add R2 to your account. It includes the free monthly allowance, and you are billed only for usage beyond it.
2. Create a bucket. Select Create bucket and give it a name in lowercase letters, numbers, and hyphens, such as my-site-images. The name is global to your account, and the bucket's location is chosen automatically as the closest available region to your create request.
3. Upload your first files. Upload from the dashboard, from the Wrangler CLI, or from any S3-compatible tool pointed at https://<account-id>.r2.cloudflarestorage.com with the region set to auto. Objects up to 5 GiB upload in a single part; larger files use multipart uploads. If your site runs on VPS hosting, this is the step where the images and downloads move off your server and into the bucket.
4. Connect a custom domain for production serving. In the bucket settings, connect a domain you control, such as images.example.com. The bucket then serves through Cloudflare's network with caching at the edge, and your files get clean URLs you control.
5. Set cache headers and link your files. Give immutable files a long cache lifetime, such as public, max-age=31536000, immutable, and reference them as https://images.example.com/photo.jpg. A correctly cached object costs about one Class B read per cache miss, not one per visitor.

One warning belongs here, and only here: the r2.dev URL Cloudflare gives your bucket is for testing, not production. It has a variable rate limit, returns HTTP 429 above hundreds of requests per second, and its throughput may be throttled. Ship with the custom domain from step 4, and keep the r2.dev URL for development.

For code, declare the bucket in wrangler.toml under [[r2_buckets]] with a binding and a bucket name, and your Worker can read and write it with no credentials at all.

Three Ways to Serve Files from R2

There are three ways to serve files from R2, and the right one depends on who is allowed to see the file. A public bucket on a custom domain is the simplest and cheapest: bytes flow through Cloudflare's CDN, cache headers stick, and your Worker never sees the request. The trade-off is that anyone with the URL has the object, forever, so it fits public images, downloads, and assets, and nothing private.

A Worker proxy is the pattern for anything that needs a decision before the download. The Worker reads the file through its binding, checks entitlement, for example against a database, and then streams the bytes or returns a paywall response. It adds one Class B read per range request, but it gives you full control over authentication, cache control, watermarking, and analytics.

Keep the cache headers honest: public, free content can carry public, max-age=86400, while paid or per-user content should carry private, max-age=3600 so it never sits in shared edge cache.

Presigned URLs are the third pattern, and they are ideal for direct browser-to-R2 uploads. Your server mints a short-lived URL, the browser uploads straight to R2, and your server confirms the upload with a head call. Presigned URLs support GET, HEAD, PUT, and DELETE, and they expire between 1 second and 7 days, or 604,800 seconds.

They are generated server-side with no communication with R2, using only R2 API credentials and an AWS Signature Version 4 implementation. One gap to know: POST, the native HTML form upload, is not currently supported.

R2 is not a CDN by itself, and that distinction is worth stating plainly. R2 is object storage. Fast global delivery and caching come from putting Cloudflare in front of it, through a custom domain and Cloudflare Cache, which is what a content delivery network does.

Without that front door, reads go through the R2 Gateway, and a cached object costs about one Class B read per cache miss rather than one per request. Say "R2 plus Cloudflare's network", not "R2 is a CDN".

R2 Limits You Should Know Before You Build

R2's limits are generous, and the ones that catch people are the small ones, not the big ones. The table below is Cloudflare's published limits page, checked on 6 November 2026.

Watch the units, because R2 mixes two systems. Limits use TiB and GiB, which are base-2, while pricing uses GB-month, a base-10 billing unit. A 5 TiB maximum object is 5,497,558,138,880 bytes, which is 5,497.56 GB, or about 5.5 TB, not 5 TB.

Keep the units as documented and the numbers stay honest.

Multipart uploads deserve a paragraph because they are how big files actually move. They are recommended for anything over about 100 MB, with parts of 5 MiB to 5 GiB each, uploaded in parallel, and a final complete step that assembles them atomically. Every part except the last must be at least 5 MiB.

Aborted or stuck uploads keep costing storage until they are reaped, so wire an abort into your failure paths, and remember that buckets carry a default lifecycle rule that expires incomplete multipart uploads 7 days after they start.

Where Does Your Data Live? Regions, Hints, and Jurisdictions

By default, R2 picks the closest available region to your create-bucket request, and you do not choose a region the way you do on S3. That automatic placement is the recommended setting for most buckets, and it is a performance choice, not a promise about where your bytes sit. Buckets are global with regional hints, not region-pinned like S3, and only Jurisdictional Restrictions guarantee where data lives.

Location Hints are the optional middle ground. You can hint wnam for Western North America, enam for Eastern North America, weur for Western Europe, eeur for Eastern Europe, apac for Asia-Pacific, or oc for Oceania. Hints are best-effort and for performance only, not residency, and they are honored only the first time a bucket with a given name is created.

Delete a bucket and recreate the same name, and the original location is reused.

Jurisdictional Restrictions are the guarantee. The available jurisdictions are eu for the European Union, fedramp for FedRAMP, and us for the United States, and the jurisdiction endpoint takes the form https://<ACCOUNT_ID>.<JURISDICTION>.r2.cloudflarestorage.com. Once a bucket is created, its jurisdiction cannot be changed, so choose it before the first upload if residency rules apply to your data.

One limitation to note: Logpush does not interact with jurisdiction buckets, and the workaround is a Logpush job through the S3-compatible endpoint.

Event Notifications and Lifecycle Rules: Automating R2

R2 can tell your code when files change, and it can clean up after itself. Event notifications send a message to a Cloudflare Queue whenever data in a bucket changes, and you consume those messages with a consumer Worker or pull them over HTTP from outside Workers. The two event types are object-create, triggered by PutObject, CopyObject, and CompleteMultipartUpload, and object-delete, triggered by DeleteObject and lifecycle deletion.

You can set up to 100 event notification rules per bucket, filtered by object prefix or suffix, and each queue handles 5,000 messages per second, which is 432,000,000 messages a day. Event notifications entered open beta on 3 April 2024 and became generally available on 26 September 2024, which is 771 days before this guide was written.

Lifecycle rules handle retention and cost. They can expire and delete objects, transition objects from Standard to Infrequent Access, and abort incomplete multipart uploads, with up to 1,000 rules per bucket matched by object-key prefix. Objects are typically removed within 24 hours of their expiry value, transitions typically complete within 24 hours but can take longer for many objects, and if a rule specifies both a storage-class transition and an expiry within a 24-hour period, the expiry takes precedence.

Transitioning Standard to IA costs a Class A operation, and buckets already carry a default rule that expires multipart uploads 7 days after initiation. You can manage rules from the dashboard or with Wrangler, for example wrangler r2 bucket lifecycle add <BUCKET> with --expire-days or --ia-transition-days.

When R2 Is the Wrong Choice

R2 is the wrong choice when you need features it does not have, or when your data never leaves AWS. "S3-compatible" does not mean 100% S3, and Cloudflare documents the gaps openly, so check them before you migrate a workload that depends on one. The missing pieces are Object Lock and legal hold, customer-managed encryption keys, bucket policies and ACLs, S3 Select for querying objects in place, inventory reports, native cross-region replication, and POST form uploads for presigned URLs.

R2 also has only two storage classes against S3's seven or eight, and no deep-archive tier at all.

Those gaps draw a clear line. Keep compliance workloads on S3 when the law or your auditor wants Object Lock, customer-managed keys, and deep audit logs. Keep analytics pipelines on S3 when the bytes flow from S3 into Athena or Redshift without ever leaving AWS, because the egress saving vanishes the moment the data stays inside one cloud.

Keep a team on S3 when its runbooks, IAM roles, and incident playbooks are deeply S3-shaped, because retraining a team costs more than any egress bill. R2 wins the public-download case; it does not win the regulated case, and pretending otherwise is how migrations get rolled back.

One newer piece is worth a mention because it changes what R2 can be used for. Cloudflare Basin, the former Cloudflare Data Platform, became generally available on 1 October 2026, which is 36 days before this guide was written. Basin bundles ingestion Pipelines, a managed Apache Iceberg catalog built directly into R2 buckets, and Basin SQL, so a bucket can become a data warehouse or lakehouse queryable by engines like Spark, Snowflake, and Basin SQL.

It is charged separately from storage and operations, and its pricing is a separate question from the storage prices in this guide.

CodexFuse does not offer a Cloudflare R2 tool, and this guide is the explainer, not a console. The closest tools on this site are the storage calculators and converters linked above, which help you size a bucket and prepare its files. If a dedicated R2 tool ever lands here, this guide will link to it first.

Sources

1. Cloudflare R2 docs, "Overview" — https://developers.cloudflare.com/r2/ — fetched 2026-11-06.
2. Cloudflare R2 docs, "How R2 works" — https://developers.cloudflare.com/r2/how-r2-works/ — fetched 2026-11-06, page updated 2026-10-19.
3. Cloudflare R2 docs, "Pricing" — https://developers.cloudflare.com/r2/pricing/ — fetched 2026-11-06, page updated 2026-10-30.
4. Cloudflare R2 docs, "Limits" — https://developers.cloudflare.com/r2/platform/limits/ — fetched 2026-11-06, page updated 2026-10-30.
5. Cloudflare R2 docs, "Data location" — https://developers.cloudflare.com/r2/reference/data-location/ — fetched 2026-11-06, page updated 2026-08-19.
6. Cloudflare R2 docs, "Consistency model" — https://developers.cloudflare.com/r2/reference/consistency/ — fetched 2026-11-06, page updated 2026-10-14.
7. Cloudflare R2 docs, "Durability" — https://developers.cloudflare.com/r2/reference/durability/ — fetched 2026-11-06, page updated 2026-04-21.
8. Cloudflare R2 docs, "Event notifications" — https://developers.cloudflare.com/r2/buckets/event-notifications/ — fetched 2026-11-06, page updated 2026-04-21.
9. Cloudflare R2 docs, "Object lifecycles" — https://developers.cloudflare.com/r2/buckets/object-lifecycles/ — fetched 2026-11-06, page updated 2026-10-26.
10. Cloudflare R2 docs, "Presigned URLs" — https://developers.cloudflare.com/r2/api/s3/presigned-urls/ — fetched 2026-11-06.
11. Cloudflare R2 docs, "S3 API compatibility" — https://developers.cloudflare.com/r2/api/s3/api/ — fetched 2026-11-06.
12. Amazon Web Services, "S3 Pricing" — https://aws.amazon.com/s3/pricing/ — fetched 2026-11-06.
13. Simple App Shipper, "R2: Object Storage Without the Egress Tax" — https://www.simpleappshipper.com/tutorials/cloudflare/r2-object-storage — fetched 2026-11-06.
14. Mecanik, "Cloudflare R2 Image Hosting: Costs and Setup (2026)" — https://mecanik.dev/en/posts/cloudflare-r2-for-image-hosting-zero-egress-image-cdn/ — fetched 2026-11-06, published 2026-06-28.
15. Cloudflare Blog, "A New Hope for Object Storage: R2 enters open beta" — https://blog.cloudflare.com/r2-open-beta/ — fetched 2026-11-06, published 2022-05-11.
16. Cloudflare Blog, "R2 adds event notifications, support for migrations from Google Cloud Storage, and an infrequent access storage tier" — https://blog.cloudflare.com/r2-events-gcs-migration-infrequent-access/ — fetched 2026-11-06, published 2024-04-03.

Frequently Asked Questions

Is Cloudflare R2 really free?

No, but the free tier is generous. Every month you get 10 GB-months of Standard storage, 1 million Class A operations, and 10 million Class B operations free, and egress is always free. Beyond those allowances you pay $0.015 per GB-month of Standard storage, $4.50 per million Class A operations, and $0.36 per million Class B operations.

Infrequent Access has no free tier, so it bills from the first byte.

Is R2 better than S3?

It depends on the workload. R2 is cheaper for files the public downloads, because egress is $0 against S3's $0.09 per GB, and storage is $0.015 against $0.023 per GB-month. S3 is better for compliance workloads that need Object Lock, customer-managed encryption keys, S3 Select, inventory reports, or a deep-archive tier, none of which R2 offers.

R2 is S3-compatible, not 100% S3, so check the feature gaps before migrating.

Can I use R2 for my website's images?

Yes, and it is one of the best uses for it. Create a bucket, upload your images, connect a custom domain such as images.example.com, set a long cache lifetime on files that never change, and link them from your pages. Use the custom domain for production, not the testing URL Cloudflare assigns your bucket, because that URL is rate-limited and throttled and is not meant for real traffic.

What is the difference between R2 Standard and Infrequent Access?

Standard storage costs $0.015 per GB-month with no retrieval fee and no minimum duration. Infrequent Access costs $0.01 per GB-month, which is 33.3% cheaper, but it charges $0.01 per GB every time data is read, doubles the operation prices to $9.00 and $0.90 per million, and bills a 30-day minimum even if you delete the data early. Cloudflare's own example shows a heavy-read workload costing $29.90 on IA against $14.85 on Standard, so use IA only for data you rarely read and keep for at least 30 days.

Can I move my files from S3 to R2?

Yes. Cloudflare's Super Slurper migration tool is free to use: you pay only the Class A operations it makes to your R2 bucket, with objects under 100 MiB uploaded in a single operation and larger objects moved with multipart uploads. Sippy is the alternative for gradual migration: it copies an object from the source bucket on the first request for it, then serves it from R2 afterwards.

Your source bucket may still charge its own egress on the way out, so check that side of the bill too.