VibeHost vs Vercel: letting an outside reviewer open a protected preview

You have a preview URL and a client who needs to look at it. On Vercel the question splits in two: is the deployment protected, and does the person on the other end have a Vercel account. The answer to the first decides the answer to the second.

Vercel is an application platform where the framework integration is the product. VibeHost hosts static artifacts and gates them per app. The comparison below is about the gate, because that is where the two platforms make different trade-offs.

What Vercel documents about who can open a deployment

The unprotected case is open. From Vercel's guide to sharing a preview deployment (last updated August 28, 2026):

"If you don't have deployment protection enabled, anyone with the link can view your deployment"

Turning protection on moves the cost onto the viewer:

"The collaborator does not need to have a Vercel account, but will need to create one if they wish to view a deployment that is protected, use the toolbar, or leave comments."

The same page documents the invite path, which Vercel calls the recommended one, and its ceiling on the cheap plan:

"Users on Pro and Enterprise teams can use this method to add one or more collaborators. Hobby users are limited to one collaborator at any one time."

An invited external user is not billed as a team member:

"they will not be added to your Vercel team"

And with authentication on, team membership is the default admission rule:

"If you have Authentication enabled, only team members can view your deployment, unless you have added the user individually or they have requested access, or you have enabled sharable links"

Vercel's way around the account requirement is a sharable link, with its own documented cap. From Vercel's sharable links documentation (last updated August 28, 2026):

"Shareable links allow external users to securely access your deployments through a query string parameter."

"Developers on the hobby plan can only create one shareable link in total per account."

Revoking one is a per-project dropdown rather than a per-link action:

"To revoke access for users, switch the dropdown option to Only people with access."

What the protection methods cost

From Vercel's deployment protection documentation (last updated August 28, 2026):

"Deployment Protection lets you control who can access your preview and production URLs."

Each method sits on a plan:

"Vercel Authentication: Restricts access to only Vercel users with suitable access rights. Available on all plans"

"Password Protection: Restricts access to users with the correct password. Available on the Enterprise plan, or as a paid add-on for Pro plans"

The add-on has a price and a minimum term:

"Advanced Deployment Protection features are available to Enterprise customers by default. Pro plan customers can access these features for an additional $150 per month"

"You must have used the feature for a minimum of 30 days before you can disable it."

The cheapest tier also draws a line at the production domain:

"On the Hobby plan, Vercel Authentication with Standard Protection is available. This protects your preview deployments and deployment URLs, but your production domain remains publicly accessible. To protect production domains, you need a Pro or Enterprise plan."

What Vercel documents about deploying without git

Vercel has a browser upload path. From Vercel's Drop documentation (last updated June 16, 2026):

"Vercel Drop lets you deploy a file, folder, or .zip by dragging it into your browser, with no Git, Vercel CLI, or local setup."

Two documented properties matter if you were reaching for it as the no-repository path:

"Vercel creates a new project, uploads your files, and publishes it straight to production."

"Each drop creates a new project. Vercel Drop doesn't redeploy into an existing project."

So a second version of the same artifact is a second project, and the first deploy lands in production rather than in a preview. The page also states the account requirement plainly: "You need a Vercel account and a file or folder to deploy."

Vercel's limits page bounds the upload:

"When using the CLI to deploy, the maximum size of the source files that can be uploaded is limited to 100 MB for Hobby and 1 GB for Pro."

"The maximum number of files that can be uploaded when creating a CLI Deployment is 15,000 for source files."

The same page lists 200 projects, 50 domains per project, and 100 GB of Fast Data Transfer on Hobby, against unlimited projects and 1 TB on Pro.

How VibeHost gates a deploy

Access lives on the app and is evaluated at the edge on every request. A newly created app starts private. Visibility is one of public, workspace, or private, and a private app admits a visitor by exactly one of three paths.

Share link. A minted URL whose holder needs no account and never signs in. The plaintext token is returned once at creation; the server stores a hash and a short display prefix. Optional expiry up to a 90-day ceiling, or none. The visitor's browser carries a signed cookie for 24 hours, and the gate re-reads the link's revocation state from the database on every request — so revoking one link stops that visitor's next page load, and it is one link among many rather than a single per-account slot. Share links covers the mechanics.

Email or team grant. One address gets viewer, deployer, or admin on one app. The grant is matched against the email on the account with no workspace-membership condition, so a client with read access on one app is not a workspace member and does not change the bill. If the address is not registered yet, the grant waits and takes effect the first time that person signs in.

Workspace visibility. Setting an app to workspace admits any signed-in member of the owning workspace. This is the one path that does require membership.

Password protection composes with the three above rather than being a fourth entrance. A signed-in visitor with no grant who knows the password clears the prompt and then gets a 403 page offering to request access. Password protection is a Business feature, and Free has no shared-password option at all.

There is no repository and no build. You point the CLI at a directory that contains index.html; it packs a .tar.gz and POSTs it, and the server validates the archive, deduplicates blobs against what it already holds, and assembles a release. Previews are named channels — production, pr-42, dark-mode — so a second version of the same artifact is a new deployment on the same app rather than a new project. Concepts covers the model.

Side-by-side comparison

VibeHost plan-dependent figures appear inline below so the rows read side by side. The authoritative per-plan table is on the limits page, generated from the same object the API enforces.

Plan numbers

Over the storage cap, deploys return 402 — free up space or upgrade. Usage-based overage billing is not live yet, so going over is never a charge today. Bandwidth is metered and shown on the usage card, but nothing is blocked when you go over it.

Business is priced per workspace, not per member and not per app. Adding people to a workspace does not change the bill, which is why granting one contractor read access on one app has no billing consequence.

When to pick Vercel

Pick Vercel when the thing you are shipping is an application rather than a static artifact. Server-side rendering, functions, ISR, routing middleware, cron jobs, and queues are the product, and VibeHost has none of them.

Pick Vercel when the framework integration is the reason you are there. Next.js on Vercel is a first-party path, and a static export is the only part of that story VibeHost covers today.

Pick Vercel when the release process should be git-driven. A deployment per push, with the platform doing the build, is a real thing Vercel does and VibeHost does not.

Pick Vercel when you need custom domains on a free tier. The limits page lists 50 domains per project on Hobby. VibeHost includes zero on Free.

Pick Vercel when the viewers are your own team. Team members with project access already have access, so the gate costs you nothing and nobody has to be invited.

When to pick VibeHost

Pick VibeHost when the reviewer is outside your team and should not have to create an account. A share link asks the holder for nothing, and revoking it stops their next request. On Vercel the documented account-free route is a sharable link, capped at one in total per account on Hobby.

Pick VibeHost when more than one outside person needs named access on a cheap plan. Email grants are per app and carry a role each, against one collaborator at a time on Hobby.

Pick VibeHost when you want a shared password without an add-on. It is a Business feature at $20 per month per workspace, and Free does not have it — but there is no separate protection charge and no minimum term.

Pick VibeHost when there is no repository. The artifact is the unit of deploy, and the server holds no git state. Ten coding agents and CLIs, two chat clients over MCP, and five AI canvas surfaces through a Chrome extension are documented paths to the same API, and none of them needs a git remote.

Pick VibeHost when you are iterating on one private URL. Redeploying to a channel updates that app; a browser drop on Vercel creates a new project each time and publishes to production.

What VibeHost does not do

No functions, no ISR, no middleware, no cron, no queues. The static runtime is the only generally available one; a server-rendered runtime for Next.js apps with API routes and middleware is in private beta.

No git integration at all. No repo linking, no push-to-deploy, no automatic per-pull-request preview. Channels are the substitute and they are manual — pull request previews shows the pattern when your CI does the pushing.

No builds. npm run build runs on your machine or your agent's. The server validates, deduplicates, and assembles.

No custom domains and no password protection on Free. Free apps live on *.vibehost.space with a watermark on the link preview card.

Sources

Every Vercel quote on this page comes from Vercel's own documentation:

• Vercel — Sharing a preview deployment
• Vercel — Deployment protection
• Vercel — Sharable links
• Vercel — Deploying with Vercel Drop
• Vercel — Limits

See also

• All six platforms compared — the same access questions across Netlify, Cloudflare Pages, Render, and GitHub Pages
• VibeHost vs Netlify — the other platform where previews are private by default
• One-on-one comparisons: Cloudflare Pages, Render, GitHub Pages, Replit
• Concepts — workspaces, apps, channels, grants, and why the server holds no git state
• Share links — minting, expiry, and revocation
• Limits — per-plan caps, generated from what the API enforces
• Move from Vercel to VibeHost — static-export migration today; the full walkthrough is still being written and currently points at the Netlify steps