jsDelivr is a free, open source CDN that serves any file from npm or GitHub with no setup. The jsDelivr homepage says it has operated since 2012 and handled 150 billion requests, over 5,000 TB, in the past month. Traffic runs over four CDN and three DNS providers with more than 540 points of presence, and the sponsor list includes Cloudflare, Fastly, G-Core Labs, bunny.net and IBM NS1 Connect. It works, and it is not going anywhere.
People look for a second option for other reasons: a fallback when one host has a bad day, ES modules with dependencies already resolved for the browser, or a security policy that bans third-party script hosts. That last worry is real. After the polyfill.io domain changed owners, Cloudflare published a cdnjs mirror in February 2024 and told sites to swap their links.
The first five picks are public library CDNs like jsDelivr. The last one is the self-hosted route.
Prices below are as of November 6, 2026. Our method is on How we review tools.
Quick comparison
| Tool | Best for | Price | Platforms |
|---|---|---|---|
| cdnjs | Curated popular libraries | Free | Any site, HTTPS URL |
| esm.sh | Browser-ready ES modules from npm, JSR, GitHub | Free, MIT, self-hostable | Modern browsers, Deno |
| unpkg | Raw files from any npm package | Free | Any site, HTTPS URL |
| JSPM | Import maps for npm packages | No public price | Browsers with import maps, SystemJS |
| Google Hosted Libraries | jQuery, three.js and D3 from Google | Free | Any site, HTTPS URL |
| Cloudflare Workers static assets | Self-hosting library files on your domain | Free asset requests; paid plan $5 a month | Cloudflare network |
cdnjs
cdnjs is the oldest rival and the closest match. Cloudflare provides the network and helps maintain the project, and the site claims more than 250 billion requests a month and use on 12.5% of all websites. URLs point at fixed versions of named libraries, so a script tag copied from the cdnjs site keeps working for years.
The catalogue is curated rather than a full npm mirror. Once a library is in, automation picks up each new version from npm or GitHub without anyone filing a request. Funding comes from sponsors plus GitHub Sponsors, Open Collective and Patreon.
Best for: Sites loading well-known libraries such as charting, animation or UI kits by plain script tag.
Pricing:
- Free to use
- Donations accepted through GitHub Sponsors, Open Collective and Patreon
Watch out for:
- A package you need may be missing. The cdnjs about page says it only serves libraries the community has added, which means a pull request with a JSON file to the cdnjs/packages repo.
Official site: cdnjs.
esm.sh
esm.sh solves a problem jsDelivr only partly covers: turning npm packages into ES modules the browser can import directly, with dependencies rewritten to matching URLs. It also reads from JSR, GitHub and pkg.pr.new, and it can transform .ts, .tsx, .vue and .svelte files on the fly.
The esm.sh homepage reports over 11 billion modules served a month, runs on Cloudflare, and lists deno.land and val.town among its sponsors. The code is MIT-licensed, and you can run your own esm.sh server to serve private npm packages, which the public CDN does not support.
Best for: Buildless prototypes and Deno projects that import npm code by URL.
Pricing:
- Free public CDN
- Self-hosted server is open source under MIT
Watch out for:
- Subresource Integrity is not supported yet. The site says a CLI tool for it is in progress, so you cannot lock a URL to a hash today.
- The first import of a large module can time out while it builds. The site's advice is to retry after the build finishes.
Official site: esm.sh.
unpkg
unpkg mirrors every npm package with a predictable URL: unpkg.com/:package@:version/:file. Adding ?meta returns the package's file list as JSON, which is handy for tools. Browser-ready ES modules live on a separate host, esm.unpkg.com.
It runs on Cloudflare Workers and caches each file by its permanent URL, so the homepage tells you to pin the full version in production. The same ?meta output gives SRI integrity hashes for script tags. UNPKG Shield, aimed at production traffic that needs supply-chain protection, is in beta.
Best for: Quick demos and tools that need any file from any npm package.
Pricing:
- Free to use
- UNPKG Shield in beta, price not published
Watch out for:
- It has had bad days. A Bubble forum thread from March 14, 2025 describes an unpkg outage that left apps hanging, with one builder reporting a median page load of 57 seconds against a normal 5.
Official site: unpkg.
JSPM
JSPM is built around import maps rather than script tags. Its CDN at ga.jspm.io serves npm packages as ES modules, each built with Rollup and shipped with source maps, at exact URLs such as ga.jspm.io/npm:pkg@x.y.z/. The JSPM Generator then writes the import map that ties bare names like react to those URLs.
Every file gets far-future cache headers. For browsers without import maps, a SystemJS copy of each module sits on ga.system.jspm.io under the same URL scheme.
Best for: Buildless apps that want npm-style bare imports in the browser.
Pricing:
- No public price or paid plan listed
- The project takes sponsorships
Watch out for:
- There is no SLA. The 99.99% uptime on the JSPM CDN page is a historical figure, and the older jspm.dev host has been deprecated, so check which host your old code uses.
Official site: JSPM.
Google Hosted Libraries
Google's library CDN is narrow and steady. It carries 23 projects, including jQuery up to 3.7.1, jQuery UI, three.js, D3.js, Shaka Player, Model-Viewer and Web Font Loader, and Google says it adds new releases as they come out.
If you load jQuery from jsDelivr today, the Hosted Libraries page gives you a drop-in URL under ajax.googleapis.com. Use the full version number in the path, because Google stopped updating its automatic version aliases such as /jqueryui/1/.
Best for: Legacy and CMS sites that only need jQuery or another big-name library.
Pricing:
- Free
- No account or key needed
Watch out for:
- The list is closed at 23 libraries. Anything else on npm, including your own packages, has to come from somewhere else.
- Some versions are skipped on purpose. jQuery 3.3.0, 2.1.2, 1.2.5 and 1.2.4 are not hosted.
Official site: Google Hosted Libraries.
Cloudflare Workers static assets
The safest replacement for any public CDN is your own copy. Install the package with npm, copy or bundle its dist files, and deploy them as static assets to Cloudflare. Requests for static assets on Workers are free and unlimited, so the files sit on a global network under your domain with no third-party host in the chain.
Scripts are where billing starts. The Free plan covers 100,000 Worker requests a day, and the Paid plan has a $5 monthly minimum with 10 million requests included, then $0.30 per million, per the Workers pricing docs. Comparing other static hosts? Our Netlify alternatives guide covers Pages, Vercel and GitHub Pages.
Best for: Production sites with a strict content security policy or a no-third-party-scripts rule.
Pricing:
- Static asset requests free and unlimited
- Workers Free: 100,000 requests per day
- Workers Paid: $5 per month minimum, 10 million requests, then $0.30 per million
Watch out for:
- You become the CDN operator. Version bumps, cache headers and integrity hashes are your job now, not jsDelivr's.
- Cloudflare Pages caps a project at 20,000 files on the Free plan, with 25 MiB per file, which matters if you copy whole node_modules folders.
Official site: Cloudflare Workers static assets.
How to choose
| If you need | Pick |
|---|---|
| A script tag for a well-known library | cdnjs |
| Import npm packages as ES modules with no build | esm.sh |
| Any file from any npm package for a demo | unpkg |
| Bare imports in the browser through an import map | JSPM |
| Only jQuery, three.js or D3 | Google Hosted Libraries |
| No third-party script host at all | Cloudflare Workers static assets |
When to stay with jsDelivr
Stay with jsDelivr when you need any npm or GitHub file in one URL with no setup. No other public option here combines a full npm mirror, GitHub files and four separate CDN providers. Pin exact versions, and keep a self-hosted fallback for the scripts your checkout or login pages depend on.
Frequently asked questions
What is the difference between jsDelivr and unpkg?
Both serve files from any npm package by URL. jsDelivr also serves GitHub repos and spreads traffic over four CDN providers. unpkg runs on Cloudflare Workers and puts ES modules on a separate host, esm.unpkg.com.
Is Skypack still working?
The Skypack site still loads and still says it is free forever, but it is not a safe choice for new code. In 2023 the Octokit team replaced its Skypack links with esm.sh, noting that the Skypack CDN is no longer maintained.
Should I use a public CDN or self-host JavaScript libraries?
For prototypes and docs, a public CDN is fine. For production pages that take payments or logins, self-host or at least pin exact versions with integrity hashes. The polyfill.io ownership change in 2024 showed what happens when a script host you trust changes hands.
Is cdnjs better than jsDelivr?
Not better, just different. cdnjs reports more monthly requests, 250 billion against jsDelivr's 150 billion, but it is curated, so many npm packages are missing. jsDelivr mirrors all of npm and GitHub, which makes it the more flexible of the two.
