More than a polished URL shortener
Dub starts with short links, but that description undersells the product. The application connects a link to click analytics, conversion events, customers, and affiliate programs. A marketing team can create branded links, see which campaigns produce leads or sales, and manage partners without stitching together a basic redirector, an analytics database, and a separate referral tool. The README says Dub handles more than 100 million clicks and two million links monthly on its hosted platform. Those are company claims, but they explain why the repository is engineered like a substantial SaaS product rather than a weekend utility.
The scope is the reason to choose Dub. A team that only wants go.example.com/sale can find smaller software. Dub earns its complexity when a link must carry business meaning after the click. Conversion attribution and affiliate management sit next to the link dashboard, and the monorepo includes a CLI, email templates, embeds, Prisma code, Stripe integration, Tinybird definitions, shared UI, and the web application. That breadth can replace several narrower tools for a SaaS company with a real acquisition program.
The hosted architecture comes with the code
Dub publishes almost all of its core under AGPLv3, with enterprise directories covered by a separate commercial license. That is genuine access to a serious product, but it is not infrastructure-neutral software. The documented stack uses Next.js, Prisma, Upstash, Tinybird, PlanetScale, NextAuth, Stripe, Resend, and Vercel. The self-hosting guide lists accounts for Tinybird, Upstash, PlanetScale, Vercel, and either Cloudflare or AWS as prerequisites, plus GitHub and a custom domain.
Each dependency has a clear job. Tinybird stores time-series click events. Redis caches link metadata so redirects avoid a MySQL query. QStash handles queues and callbacks. MySQL holds users and link records. Object storage keeps avatars, logos, and social cards. Vercel hosts the application and supplies the edge behavior used for redirects and domains. The design makes sense for Dub's workload, but copying the repository does not give you a self-contained installation.
That distinction matters when evaluating the word self-hosted. You control the code, branding, database accounts, and deployment, yet the official route remains a coordinated set of managed services. The guide explicitly says production Docker is unsupported and Vercel is currently required. A local Compose file only starts MySQL, a PlanetScale simulator, and MailHog, and warns against production use. Teams with a Kubernetes standard, an offline environment, or a policy against several SaaS dependencies should treat this as a porting project.
Setup is documented, not simple
The self-hosting guide is unusually candid and useful. It walks through cloning, environment variables, Tinybird deployment, Redis and QStash, MySQL, GitHub OAuth, Cloudflare R2, optional Resend and Unsplash, then Vercel deployment. It also explains the AGPL requirement for making modified network software available. Local-development documentation describes the monorepo and provides a database simulator path.
Still, the first successful redirect sits at the end of a long credential chain. Operators must generate application secrets, configure several data services, change the Prisma DefaultDomains model for their short domain, create database tables, register OAuth callbacks, configure storage access, attach domains, and deploy twice after obtaining the Vercel project ID. Testing background jobs can require Ngrok because QStash needs to call the local application. This is good documentation for a demanding installation, not an easy installation disguised by good prose.
The version recommendations are also specific: Node 23.11.0 and pnpm 9.15.9. The README's troubleshooting advice says mismatched versions can cause build trouble and suggests clearing installed modules and build caches. Pin those versions in development and CI rather than assuming a current long-term-support Node release will behave identically.
Rough edges affect redirects and sign-in
Two current issues deserve attention because they touch core behavior. Issue #4267 documents that deleting a link or changing its key can leave the old redirect active for roughly five seconds. Redis and Vercel caches are invalidated, but an in-process LRU entry can survive until its short time-to-live expires. Five seconds is minor for most campaign management, but it is meaningful when a bad or unsafe destination must be disabled immediately.
Issue #4272 covers a different boundary: repeated magic-link requests can hit the mail rate limit while the interface still says the email was sent. The report traces the problem through NextAuth response handling and notes that local development and continuous integration disable the relevant limit. A self-hosted operator should test production authentication behavior, not stop after a local sign-in succeeds.
Neither issue makes Dub unfit for normal use. Both are concrete reminders that a high-traffic link platform has caching and authentication failure modes that simpler tools avoid. Add redirect invalidation checks, login rate-limit tests, and monitoring around queued jobs before moving critical domains.
Health and the final choice
The repository was pushed on August 14, 2026, the day of this review. GitHub reported 155 open issues and pull requests combined, and a separate search showed 41 open issues and 114 open pull requests. The project does not publish GitHub Releases, so there is no latest release tag to use as a stability signal. Current commits, same-month issue updates, and a large pull-request queue provide much better evidence of active work.
Dub is a mature product with an active company and community behind it. It is also opinionated software whose cloud architecture, open-core licensing, and operational surface arrive together. Choose it when attribution, conversions, and affiliate programs are worth owning that stack. For plain shortening, its strongest features become unnecessary costs.