VibeHost vs Vercel: letting an outside reviewer open a protected preview

You have a preview URL and a client who needs to look at it. On Vercel the question splits in two: is the deployment protected, and does the person on the other end have a Vercel account. The answer to the first decides the answer to the second.

Vercel is an application platform where the framework integration is the product. VibeHost hosts static artifacts and gates them per app. The comparison below is about the gate, because that is where the two platforms make different trade-offs.

What Vercel documents about who can open a deployment

The unprotected case is open. From Vercel's guide to sharing a preview deployment (last updated August 28, 2026):

"If you don't have deployment protection enabled, anyone with the link can view your deployment"

Turning protection on moves the cost onto the viewer:

"The collaborator does not need to have a Vercel account, but will need to create one if they wish to view a deployment that is protected, use the toolbar, or leave comments."

The same page documents the invite path, which Vercel calls the recommended one, and its ceiling on the cheap plan:

"Users on Pro and Enterprise teams can use this method to add one or more collaborators. Hobby users are limited to one collaborator at any one time."

An invited external user is not billed as a team member:

"they will not be added to your Vercel team"

And with authentication on, team membership is the default admission rule:

"If you have Authentication enabled, only team members can view your deployment, unless you have added the user individually or they have requested access, or you have enabled sharable links"

Vercel's way around the account requirement is a sharable link, with its own documented cap. From Vercel's sharable links documentation (last updated August 28, 2026):

"Shareable links allow external users to securely access your deployments through a query string parameter."

"Developers on the hobby plan can only create one shareable link in total per account."

Revoking one is a per-project dropdown rather than a per-link action:

"To revoke access for users, switch the dropdown option to Only people with access."

What the protection methods cost

From Vercel's deployment protection documentation (last updated September 15, 2026):

"Deployment Protection lets you control who can access your preview and production URLs."

Two of the methods are the ones an outside reviewer meets:

"Vercel Authentication: Restricts access to only Vercel users with suitable access rights"

"Password Protection: Restricts access to users with the correct password. Available on Pro for $20 per month per protected project and included on Enterprise at the team level. Not available on Hobby"

From Vercel's Vercel Authentication documentation (last updated September 15, 2026):

"Vercel Authentication is available on all plans"

The password is billed per project. From Vercel's deployment protection pricing (last updated September 15, 2026):

"For Pro teams with project-level pricing, Vercel adds a $20 monthly charge when you enable Password Protection for a project. Each protected project is charged separately."

Pro teams that already bought the older Advanced Deployment Protection package "keep their current billing model", per the same pricing page. Vercel's deployment protection documentation prices that package at "$150 per month per team", covering every project.

What Vercel documents about deploying without git

Vercel has a browser upload path. From Vercel's Drop documentation (last updated June 16, 2026):

"Vercel Drop lets you deploy a file, folder, or .zip by dragging it into your browser, with no Git, Vercel CLI, or local setup."

Two documented properties matter if you were reaching for it as the no-repository path:

"Vercel creates a new project, uploads your files, and publishes it straight to production."

"Each drop creates a new project. Vercel Drop doesn't redeploy into an existing project."

So a second version of the same artifact is a second project, and the first deploy lands in production rather than in a preview. The page also states the account requirement plainly: "You need a Vercel account and a file or folder to deploy."

Vercel's limits page bounds the upload:

"When using the CLI to deploy, the maximum size of the source files that can be uploaded is limited to 100 MB for Hobby and 1 GB for Pro."

"The maximum number of files that can be uploaded when creating a CLI Deployment is 15,000 for source files."

The same page lists 200 projects, 50 domains per project, and 100 GB of Fast Data Transfer on Hobby, against unlimited projects and 1 TB on Pro.

How VibeHost gates a deploy

Access lives on the app and is evaluated at the edge on every request. A newly created app starts private. Visibility is one of public, workspace, or private, and a private app admits a visitor by exactly one of three paths.

Share link. A minted URL whose holder needs no account and never signs in. The plaintext token is returned once at creation; the server stores a hash and a short display prefix. Optional expiry up to a 90-day ceiling, or none. The visitor's browser carries a signed cookie for 24 hours, and the gate re-reads the link's revocation state from the database on every request. Revoking one link stops that visitor's next page load, and that link is one among many rather than a single per-account slot. Share links covers the mechanics.

Email or team grant. One address gets viewer, deployer, or admin on one app. The grant is matched against the email on the account with no workspace-membership condition, so a client with read access on one app is not a workspace member and does not change the bill. If the address is not registered yet, the grant waits and takes effect the first time that person signs in.

Workspace visibility. Setting an app to workspace admits any signed-in member of the owning workspace. This is the one path that does require membership.

Password protection composes with the three above rather than being a fourth entrance. A signed-in visitor with no grant who knows the password clears the prompt and then gets a 403 page offering to request access. Password protection is a Business feature, and Free has no shared-password option at all.

There is no repository and no build. You point the CLI at a directory that contains index.html; it packs a .tar.gz and POSTs it, and the server validates the archive, deduplicates blobs against what it already holds, and assembles a release. Previews are named channels such as production, pr-42 or dark-mode, so a second version of the same artifact is a new deployment on the same app rather than a new project. Concepts covers the model.

Side-by-side comparison

VibeHost plan-dependent figures appear inline below so the rows read side by side. The authoritative per-plan table is on the limits page, generated from the same object the API enforces.

Plan numbers

Over the storage cap, deploys return 402 until you free up space or upgrade. Usage-based overage billing is not live yet, so going over is never a charge today. Bandwidth is metered and shown on the usage card, but nothing is blocked when you go over it.

Business is priced per workspace, not per account: one subscription licences one workspace, so a second Business workspace is a second $20/month subscription rather than an add-on to the first. Business can also be billed yearly at $199/yr. That is about $16.58/mo, 17% less than twelve monthly payments. The Free plan allows 1 free workspace you own; creating another free one returns 402 PLAN_LIMIT_EXCEEDED. Creating a Business workspace is never refused. Each one starts its own subscription. Downgrading is not retroactive. Workspaces you already own are kept, and only the next one you create is refused.

Business is priced per workspace, not per member and not per app. Adding people to a workspace does not change the bill, which is why granting one contractor read access on one app has no billing consequence.

When to pick Vercel

Pick Vercel when the thing you are shipping is an application rather than a static artifact. Server-side rendering, functions, ISR, routing middleware, cron jobs, and queues are the product, and VibeHost has none of them.

Pick Vercel when the framework integration is the reason you are there. Next.js on Vercel is a first-party path, and a static export is the only part of that story VibeHost covers today.

Pick Vercel when the release process should be git-driven. A deployment per push, with the platform doing the build, is a real thing Vercel does and VibeHost does not.

Pick Vercel when you need custom domains on a free tier. The limits page lists 50 domains per project on Hobby. VibeHost includes zero on Free.

Pick Vercel when the viewers are your own team. Team members with project access already have access, so the gate costs you nothing and nobody has to be invited.

When to pick VibeHost

Pick VibeHost when the reviewer is outside your team and should not have to create an account. A share link asks the holder for nothing, and revoking it stops their next request. On Vercel the documented account-free route is a sharable link, capped at one in total per account on Hobby.

Pick VibeHost when more than one outside person needs named access on a cheap plan. Email grants are per app and carry a role each, against one collaborator at a time on Hobby.

Pick VibeHost when you want a shared password on more than one app. It is a Business feature at $20 per month per workspace, with no charge per app, and Free does not have it. On Vercel Pro each protected project adds $20 a month.

Pick VibeHost when there is no repository. The artifact is the unit of deploy, and the server holds no git state. Ten coding agents and CLIs, three chat clients over MCP, and five AI canvas surfaces through a Chrome extension are documented paths to the same API, and none of them needs a git remote.

Pick VibeHost when you are iterating on one private URL. Redeploying to a channel updates that app; a browser drop on Vercel creates a new project each time and publishes to production.

What VibeHost does not do

No functions, no ISR, no middleware, no cron, no queues. The static runtime is the only generally available one; a server-rendered runtime for Next.js apps with API routes and middleware is in private beta.

No git integration at all. No repo linking, no push-to-deploy, no automatic per-pull-request preview. Channels are the substitute, and they are manual. Pull request previews shows the pattern when your CI does the pushing.

No builds for a static app. npm run build runs on your machine or your agent's. The server validates, deduplicates, and assembles. Only the nextjs and node runtimes, both in private beta, build on our side, in a sandboxed Builder Job outside the API.

No custom domains and no password protection on Free. Free apps live on *.vibehost.space with a watermark on the link preview card.

Sources

Every Vercel quote on this page comes from Vercel's own documentation:

• Sharing a preview deployment
• Deployment protection
• Vercel Authentication
• Usage and pricing for Deployment Protection
• Sharable links
• Deploying with Vercel Drop
• Limits

See also

• All six platforms compared asks the same access questions across Netlify, Cloudflare Pages, Render, and GitHub Pages.
• VibeHost vs Netlify covers the other platform where previews are private by default.
• The one-on-one comparisons cover Cloudflare Pages, Render, GitHub Pages and Replit.
• Concepts explains workspaces, apps, channels, grants, and why the server holds no git state.
• Share links covers minting, expiry, and revocation.
• Limits lists the per-plan caps, generated from what the API enforces.
• Move from Vercel to VibeHost covers the static-export migration today. The full walkthrough is still being written and currently points at the Netlify steps.