Brotli
Ranked 2 of 14 compression tools by recommenders
Google-maintained compression library whose built-in dictionary suits HTML, CSS, JS and JSON, often beating gzip on size. Critics say it is slower than zstd and has had security problems.
Google-maintained compression library whose built-in dictionary suits HTML, CSS, JS and JSON, often beating gzip on size. Critics say it is slower than zstd and has had security problems.
42 people gave an opinion
- recommend it
- 24
- criticize it
- 18
- approval share
- 57%
Recommended in 7 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 24 people recommend itNeeds 10 or more, met.
- 1.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Better compression ratio than gzip and zstd
“Modern browsers support brotli or zstd, which is a lot better in terms of compression.”
Comment from 16 Nov 2025 in “Messing with scraper bots” “sometimes Brotli has a small edge when it comes to compression ratio”
Comment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal” “pleased with brotli numbers compared to gzip”
Comment from 19 Jun 2026 in “Letting Cloudflare serve Brotli-compressed data with Nginx” - Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
- Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
- Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
Strong on HTML, CSS, JS and JSON
“Brotli was designed for html compression so despite/while being a relatively inferior algorithm, its stock dictionary is all html/css/js-trained/optimized.”
Comment from 31 Dec 2025 in “A super fast website using Cloudflare workers” “Brotli also benefits out-of-the-box in fresh compression windows with some common JSON patterns always in the Brotli static dictionary.”
Comment from 2 Dec 2025 in “Why I stopped using JSON for my APIs” Fast decompression, plenty for many uses
“Brotli decompresses 3-5x faster than LZMA2 and is within 0.6 % of the compression density”
Comment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal” “brotli decompression is already plenty fast”
Comment from 23 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss” Good for small data and fonts
“Brotli compression is very much recommended, specifically for bevy and font stuff, where it shines compared to zip”
Comment from 22 Dec 2025 in “Show HN: Rust/WASM lighting data toolkit – parses legacy formats, generates SVGs” “brotli at the same speed as zstd gives better results for small data”
Comment from 24 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
What people warn about
Each mark is one comment
Slower than zstd at compressing and decompressing
“Brotli compresses my files way better, but it's doing it way slower.”
Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss” “It's slower, though. Too high a price to pay for safety it seems.”
Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more” “brotli slower again but still much faster than xz”
Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss” - Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
- Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
Security bugs and slow patching
“passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those”
Comment from 25 Oct 2026 in “Bye Bye Brotli? Google's Compression Library Is a Security Mess” “why it took Google almost 8 months to release a new version of a common dependency”
Comment from 26 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more” “despite the fact that it also increases the attack surface”
Comment from 25 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more” Complex C codebase, not in Rust
“Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?”
Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more” “Brotli is much more complicated than the gzip/deflate it replaces.”
Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more” “they're really not encouraging independent implementations”
Comment from 24 Oct 2026 in “Evolving Threat: http2shell is an RCE in Node, Python, and more” Dictionary and compatibility concerns
“I have no objection to adding Brotli, but I hope they take the compatability more seriously.”
Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss” “It seems they're using the standard dictionary, which is utterly bizzare.”
Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss” “Brotli w/o a custom dictionary is a weird choice to begin with.”
Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
Other compression tools people recommend
The four most recommended other compression tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Zstandard (zstd) | 111 | 14 | 89% | 12 | — | Approved |
| BrotliThis page | 24 | 18 | 57% | 7 | — | — |
| gzip | 23 | 13 | 64% | 8 | — | — |
| tar | 19 | 13 | 59% | 11 | — | — |
| NNCP | 15 | 0 | 100% | 11 | — | Approved |
What people said
40 of the 52 comments that mention it, newest first. Each links to the original comment.
“why it took Google almost 8 months to release a new version of a common dependency”
“passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those”
“Security is always context dependent. For many use case it works.”
“despite the fact that it also increases the attack surface”
“Dropbox switched to it a decade ago, so it's probably quite product-ready.”
“It's slower, though. Too high a price to pay for safety it seems.”
“Brotli is much more complicated than the gzip/deflate it replaces.”
“Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?”
“they're really not encouraging independent implementations”
“I'd love to use more brotli and zstd”
“Amazing how concise the code is!”
“Otherwise, if zstd is easy to add, IMO I would always prefer, zstd, lz4 or brotli.”
“occasionally lz4 or bz2 or brotli”
“Far better, just like anything else based on arithmetic coding.”
“pleased with brotli numbers compared to gzip”
“I found brotli a clear winner when comparing space and time”
“DEFLATE and modern algos (Zstd, Brotli) are the production standard”
“brotli at the same speed as zstd gives better results for small data”
“brotli decompression is already plenty fast”
“brotli achieves slightly better compression, at the cost of a little over half the decompression speed”
“Still, Brotli has a slight edge.”
“I have no objection to adding Brotli, but I hope they take the compatability more seriously.”
“Brotli compresses my files way better, but it's doing it way slower.”
“It seems they're using the standard dictionary, which is utterly bizzare.”
“brotli slower again but still much faster than xz”
“both brotli and zstd are pretty widely available these days and should be fairly easy to vendor”
“Brotli also ended up better than ZSTD”
“brotli is clearly better than the rest here”
“zstd is Pareto better than brotli - compresses better and faster”
“it compresses somewhat more than zstd”
“Brotli w/o a custom dictionary is a weird choice to begin with.”
“All this for brotli… on a read-many format like pdf zstd's decompression speed is a much better fit.”
“Brotli was designed for html compression so despite/while being a relatively inferior algorithm, its stock dictionary is all html/css/js-trained/optimized.”
“Brotli compression is very much recommended, specifically for bevy and font stuff, where it shines compared to zip”
“Brotli also benefits out-of-the-box in fresh compression windows with some common JSON patterns always in the Brotli static dictionary.”
“where the compression window can be used for the duration of the connection”
“Brotli decompresses 3-5x faster than LZMA2 and is within 0.6 % of the compression density”
“sometimes Brotli has a small edge when it comes to compression ratio”
“Modern browsers support brotli or zstd, which is a lot better in terms of compression.”
“Brotli can compress more because of context modeling, about 5% more without the static dictionary”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.