dart.dev's custom package repositories page lists six providers for hosting private Dart/Flutter packages and doesn't say a word about how they differ. Here's an honest breakdown, including whether you need one of these at all.
At a glance
| Provider | Free tier | Cheapest paid plan | Billing model |
|---|---|---|---|
| Cloudsmith | 500MB data / 1GB delivery | $149/mo (Pro) | Usage-based (storage + delivery) |
| Inedo ProGet | Unlimited feeds & users (self-hosted) | $2,395/yr (Basic) | Flat, per-server license |
| JFrog Artifactory | Free trial only | $150/mo (Pro) | Usage-based (consumption) + tier |
| OnePub | 2 members / 25 packages | $1-$15/member/mo | Per-seat |
| GLPub.dev | 1 package | 10 EUR/mo (Pro) | Flat, per-org |
| Publy | 1 member / 5 packages | $19.99/mo (Starter) | Flat, per-org |
GLPub.dev prices in EUR, everyone else above in USD. Figures verified directly against each provider's own pricing page as of August 2026 — see the sections below for what each tier actually includes.
Is a registry even worth it over git dependencies?
Dart 3.9 added tag_pattern to git dependencies, which is a genuine fix, not a workaround. Tag your commits with real version numbers and the solver treats a git dep almost like a hosted one — a non-breaking bump no longer cascades through every consumer.
What it doesn't fix: pub identifies a git dependency by its URL, so a teammate pulling over SSH and another pulling the same repo over HTTPS are two different packages to the solver. There's no publish-time validation, so a mismatched tag just sits there until a consumer fails to resolve. Tags are mutable by default, so force-moving one silently changes what a "version" means for everyone who already resolved it. And every dev machine and CI job needs git access to every package repo individually, instead of one scoped, revocable token.
None of that is unsolvable — SSH-only conventions, protected tags, a shared CI service account — but it's all internal policy your team has to set up and keep alive. If you have a handful of git dependencies in their own repos, tag_pattern probably closes the gap enough that a registry is overkill. Past a pile of interdependent packages across monorepos, it stops scaling.
Cloudsmith
Cloud-hosted, general-purpose artifact registry (not Dart-specific — it also handles npm, Maven, Docker, and a long list of other formats). It was the first third-party Dart repository, launched back in 2020. The free Core plan gives 500MB of artifact storage and 1GB of package delivery; Pro is $149/month for 5GB storage and 25GB delivery, plus $1.50/GB beyond that. Ultra and Enterprise are custom-priced. Comes with governance features (blocking versions, requiring metadata, quarantining packages) aimed at larger orgs already managing multiple package ecosystems.
Inedo ProGet
Self-hosted (or their managed Cloud Edition from $4,895/yr), also general-purpose across many package/container formats. Pub support is recent — it landed in ProGet 2024.11 — and inherits a real limitation of the pub API itself: no search, and no README/license metadata without extra caching work. The Free edition supports unlimited feeds and users; paid self-hosted licenses run $2,395/yr (Basic) up to $11,995/yr (Enterprise Essentials) and from $29,995/yr (Enterprise Complete), licensed per server, not per user — every edition supports unlimited users. Self-hosting means you own uptime and patching unless you pay for the managed option.
JFrog Artifactory
The enterprise option. Supports dozens of package formats beyond Dart through local, remote, and virtual repository types, self-hosted or cloud. The Pro tier is $150/month for 25GB of base consumption; Enterprise X starts at $950/month for 125GB plus SSO and artifact federation; Enterprise+ is custom-priced. No free tier for private packages beyond a trial. Makes sense if your org already standardized on Artifactory for other languages and just wants to add a pub feed to it — a lot of surface area to take on if Dart packages are the only thing you need it for.
OnePub
Dart/Flutter-only, hosted, and the longest-running dedicated option in this list. Explicitly billed "USD, per member, per month" on every tier: Free is 2 members / 25 packages, Pro is $1/member (5 members), Team is $10/member (20 members, their most popular), Enterprise is $15/member (unlimited members). A 20-person team on the Team plan is $200/month before storage or download overages — the cost scales with headcount (and typically a CI service account counts as a member too), not with actual usage.
GLPub.dev
Dart/Flutter-only, hosted, and signs in with GitLab, GitHub, or Google — not GitLab-exclusive despite the name, though it reuses whichever provider's project permissions natively. Flat per-org pricing, not per-seat: Free is 1 package with 10 versions/month, Pro is 10 EUR/month for up to 10 packages with unlimited versions, Business is 50 EUR/month for unlimited packages plus priority support. The smallest and newest-feeling option here, but the pricing model is closer to Publy's than to OnePub's.
Publy
Dart/Flutter-only and hosted, priced in flat tiers instead of per seat like OnePub: Free is 1 member / 5 packages / 250MB storage, Starter is $19.99/month flat for 10 members / 50 packages / 5GB (the same 10-member team costs $100/month on OnePub's per-seat Team plan), Team is $39.99/month flat for unlimited members and packages with storage capped at 25GB. Adding a teammate never changes the bill within a tier. Speaks the real pub hosted-repo protocol (the spec dart-lang publishes) directly, not a wrapper around git or a custom CLI, so dart pub publish and dart pub get work exactly like they do against pub.dev.
How to actually pick one
Already running Artifactory or ProGet for other package types at your org? Add a pub feed to what you have instead of standing up something new. Just a couple of small packages and comfortable with GitLab/GitHub-native permissions? GLPub.dev's free or 10 EUR tier probably covers it. Team size small and stable, with only a handful of internal packages? tag_pattern on plain git dependencies might be all you need — skip a registry entirely. Want something Dart-specific and hosted without per-seat pricing creeping up as you hire, or need dozens of interdependent packages across monorepos to just work? That's the gap we built Publy for.
Pricing and feature details above were checked directly against each provider's own pricing page as of the date at the top of this post — registries change their plans, check each provider's own site before deciding.
FAQ
Does pub.dev support private packages?
No — pub.dev only hosts public packages. dart pub itself supports any hosted-repo-protocol-compliant server via publish_to and a custom hosted URL, which is exactly what the providers on this page (or self-hosting the spec yourself) give you.
Is there a free private Dart/Flutter package registry?
Yes. Cloudsmith's Core plan, Inedo ProGet self-hosted, OnePub's Free tier, GLPub.dev's Free tier, and Publy's Free tier all have a $0 option — see the table above for what each actually includes before you rely on it.
What is the pub hosted-repo protocol?
It's the REST API spec dart-lang publishes (the Hosted Pub Repository Specification, currently v2) that dart pub publish and dart pub get talk to — upload finalize with a Location header, a version-listing endpoint, archive downloads. Any server that implements it correctly works as a drop-in publish_to target; that's what distinguishes an actual registry from a wrapper around git or a custom CLI.
Do I need a registry if I only have one or two internal packages?
Probably not. Dart 3.9's tag_pattern lets plain git dependencies resolve against real version tags, which covers small, stable setups fine — see the section above on what it does and doesn't fix.
What happens to already-downloaded packages if I switch providers or stop paying?
Depends on the provider — check before you commit. Publy, for example, keeps downloads unmetered for a full month after a missed payment, and packages your build already fetched keep whatever got cached; only new dart pub get / dart pub publish calls are affected after that grace period.
Can I use more than one of these at once?
Yes — pub supports multiple hosted repositories at the same time, declared per-dependency in pubspec.yaml. Some teams do split package sources this way (self-hosted ProGet for one set of internal tools, a hosted registry for another), at the cost of juggling more than one set of credentials.
Originally published on the Publy blog, where it's kept up to date.
Top comments (0)