Hacker ApprovedDepartments

Brotli

Ranked 2 of 14 compression tools by recommenders

Google-maintained compression library whose built-in dictionary suits HTML, CSS, JS and JSON, often beating gzip on size. Critics say it is slower than zstd and has had security problems.

Google-maintained compression library whose built-in dictionary suits HTML, CSS, JS and JSON, often beating gzip on size. Critics say it is slower than zstd and has had security problems.

42 people gave an opinion

recommend it
24
criticize it
18
approval share
57%
Each figure is one person. RecommendsCriticizes

Recommended in 7 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: not recommended
  5. March 2026: recommended
  6. April 2026: not recommended
  7. May 2026: not recommended
  8. June 2026: recommended
  9. July 2026: not recommended
  10. August 2026: not recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Why it doesn’t carry the badge

  • 24 people recommend itNeeds 10 or more, met.
  • 1.3 recommenders for every criticNeeds 2 to 1 or better, not met.
  • Recommended in 7 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Better compression ratio than gzip and zstd

    “Modern browsers support brotli or zstd, which is a lot better in terms of compression.”

    Comment from 16 Nov 2025 in “Messing with scraper bots”

    “sometimes Brotli has a small edge when it comes to compression ratio”

    Comment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal”

    “pleased with brotli numbers compared to gzip”

    Comment from 19 Jun 2026 in “Letting Cloudflare serve Brotli-compressed data with Nginx”
  • Strong on HTML, CSS, JS and JSON

    “Brotli was designed for html compression so despite/while being a relatively inferior algorithm, its stock dictionary is all html/css/js-trained/optimized.”

    Comment from 31 Dec 2025 in “A super fast website using Cloudflare workers”

    “Brotli also benefits out-of-the-box in fresh compression windows with some common JSON patterns always in the Brotli static dictionary.”

    Comment from 2 Dec 2025 in “Why I stopped using JSON for my APIs”
  • Fast decompression, plenty for many uses

    “Brotli decompresses 3-5x faster than LZMA2 and is within 0.6 % of the compression density”

    Comment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal”

    “brotli decompression is already plenty fast”

    Comment from 23 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
  • Good for small data and fonts

    “Brotli compression is very much recommended, specifically for bevy and font stuff, where it shines compared to zip”

    Comment from 22 Dec 2025 in “Show HN: Rust/WASM lighting data toolkit – parses legacy formats, generates SVGs”

    “brotli at the same speed as zstd gives better results for small data”

    Comment from 24 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

What people warn about

Each mark is one comment

  • Slower than zstd at compressing and decompressing

    “Brotli compresses my files way better, but it's doing it way slower.”

    Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

    “It's slower, though. Too high a price to pay for safety it seems.”

    Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

    “brotli slower again but still much faster than xz”

    Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”
  • Security bugs and slow patching

    “passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those”

    Comment from 25 Oct 2026 in “Bye Bye Brotli? Google's Compression Library Is a Security Mess”

    “why it took Google almost 8 months to release a new version of a common dependency”

    Comment from 26 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

    “despite the fact that it also increases the attack surface”

    Comment from 25 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”
  • Complex C codebase, not in Rust

    “Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?”

    Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

    “Brotli is much more complicated than the gzip/deflate it replaces.”

    Comment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

    “they're really not encouraging independent implementations”

    Comment from 24 Oct 2026 in “Evolving Threat: http2shell is an RCE in Node, Python, and more”
  • Dictionary and compatibility concerns

    “I have no objection to adding Brotli, but I hope they take the compatability more seriously.”

    Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

    “It seems they're using the standard dictionary, which is utterly bizzare.”

    Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

    “Brotli w/o a custom dictionary is a weird choice to begin with.”

    Comment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

Other compression tools people recommend

The four most recommended other compression tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

Brotli compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
Zstandard (zstd)1111489%12—Approved
BrotliThis page241857%7——
gzip231364%8——
tar191359%11——
NNCP150100%11—Approved
See all 14 compression tools, ranked

What people said

40 of the 52 comments that mention it, newest first. Each links to the original comment.

“why it took Google almost 8 months to release a new version of a common dependency”

CriticizesComment from 26 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those”

CriticizesComment from 25 Oct 2026 in “Bye Bye Brotli? Google's Compression Library Is a Security Mess”

“Security is always context dependent. For many use case it works.”

MixedComment from 25 Oct 2026 in “Bye Bye Brotli? Google's Compression Library Is a Security Mess”

“despite the fact that it also increases the attack surface”

CriticizesComment from 25 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“Dropbox switched to it a decade ago, so it's probably quite product-ready.”

RecommendsComment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“It's slower, though. Too high a price to pay for safety it seems.”

MixedComment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“Brotli is much more complicated than the gzip/deflate it replaces.”

CriticizesComment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“Why the hell is a lib like brotli that processes public general internet traffic, and maintained by google, not in rust?”

CriticizesComment from 24 Oct 2026 in “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”

“they're really not encouraging independent implementations”

CriticizesComment from 24 Oct 2026 in “Evolving Threat: http2shell is an RCE in Node, Python, and more”

“I'd love to use more brotli and zstd”

MixedComment from 11 Oct 2026 in “Compression and Concatenation on the Web”

“Amazing how concise the code is!”

RecommendsComment from 14 Sep 2026 in “Ask HN: What are you working on? (September 2026)”

“Otherwise, if zstd is easy to add, IMO I would always prefer, zstd, lz4 or brotli.”

RecommendsComment from 7 Sep 2026 in “bzip3”

“occasionally lz4 or bz2 or brotli”

MixedComment from 2 Sep 2026 in “We could save petabytes of cache storage with Zstandard and Pingora”

“Far better, just like anything else based on arithmetic coding.”

RecommendsComment from 27 Jun 2026 in “Hellishly Slow Level 13 Deflate Compression”

“pleased with brotli numbers compared to gzip”

RecommendsComment from 19 Jun 2026 in “Letting Cloudflare serve Brotli-compressed data with Nginx”

“I found brotli a clear winner when comparing space and time”

RecommendsComment from 14 Mar 2026 in “An Ode to Bzip”

“DEFLATE and modern algos (Zstd, Brotli) are the production standard”

RecommendsComment from 29 Jan 2026 in “Show HN: I made a new compression algorithm”

“brotli at the same speed as zstd gives better results for small data”

RecommendsComment from 24 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“brotli decompression is already plenty fast”

RecommendsComment from 23 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“brotli achieves slightly better compression, at the cost of a little over half the decompression speed”

MixedComment from 23 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“Still, Brotli has a slight edge.”

RecommendsComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“I have no objection to adding Brotli, but I hope they take the compatability more seriously.”

MixedComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“Brotli compresses my files way better, but it's doing it way slower.”

MixedComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“It seems they're using the standard dictionary, which is utterly bizzare.”

CriticizesComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“brotli slower again but still much faster than xz”

MixedComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“both brotli and zstd are pretty widely available these days and should be fairly easy to vendor”

RecommendsComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“Brotli also ended up better than ZSTD”

RecommendsComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“brotli is clearly better than the rest here”

RecommendsComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“zstd is Pareto better than brotli - compresses better and faster”

CriticizesComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“it compresses somewhat more than zstd”

RecommendsComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“Brotli w/o a custom dictionary is a weird choice to begin with.”

CriticizesComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“All this for brotli… on a read-many format like pdf zstd's decompression speed is a much better fit.”

CriticizesComment from 22 Jan 2026 in “ISO PDF spec is getting Brotli – ~20 % smaller documents with no quality loss”

“Brotli was designed for html compression so despite/while being a relatively inferior algorithm, its stock dictionary is all html/css/js-trained/optimized.”

RecommendsComment from 31 Dec 2025 in “A super fast website using Cloudflare workers”

“Brotli compression is very much recommended, specifically for bevy and font stuff, where it shines compared to zip”

RecommendsComment from 22 Dec 2025 in “Show HN: Rust/WASM lighting data toolkit – parses legacy formats, generates SVGs”

“Brotli also benefits out-of-the-box in fresh compression windows with some common JSON patterns always in the Brotli static dictionary.”

RecommendsComment from 2 Dec 2025 in “Why I stopped using JSON for my APIs”

“where the compression window can be used for the duration of the connection”

RecommendsComment from 2 Dec 2025 in “Why I stopped using JSON for my APIs”

“Brotli decompresses 3-5x faster than LZMA2 and is within 0.6 % of the compression density”

RecommendsComment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal”

“sometimes Brotli has a small edge when it comes to compression ratio”

MixedComment from 24 Nov 2025 in “Google Revisits JPEG XL in Chromium After Earlier Removal”

“Modern browsers support brotli or zstd, which is a lot better in terms of compression.”

RecommendsComment from 16 Nov 2025 in “Messing with scraper bots”

“Brotli can compress more because of context modeling, about 5% more without the static dictionary”

RecommendsComment from 10 Nov 2025 in “JPEG XL will be adopted as a new image format in PDFs”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.