JumpServer privileged access management — real list pricing
JumpServer is an open-source PAM platform and bastion host in one: a single audited gateway in front of your servers, network devices, databases, Kubernetes clusters and internal web applications. The Community Edition is free under GPL v3.0; the Enterprise Edition adds the X-Pack module and vendor support. Both are supplied, deployed and operated by Brocent as an authorised reseller.
Quick answer
JumpServer Community Edition is free for up to 5,000 assets. Enterprise Edition is a commercial annual subscription priced by asset tier — 50, 500, 5,000 or unlimited — each including the X-Pack module and 8×5 vendor email support. Buy Enterprise for SSO, ticket approval, enterprise databases and an SLA, not for capacity. The vendor does not publish list prices, so ask Brocent for a quote against your real asset count.
The vendor
What JumpServer is, and who is behind it
JumpServer is the open-source PAM project initiated by FIT2CLOUD, published under GPL v3.0 with its source on GitHub. It combines the two things most organisations buy separately: a bastion host — one entry point, protocol support for SSH, RDP, VNC, Telnet, Kubernetes, databases and published web applications, with full session recording — and privileged access governance: least-privilege roles, just-in-time approval, command filtering, and centralised account and credential management. It is Linux-native and containerised, deployed with a single Docker Compose command rather than a Windows cluster, which is what keeps the infrastructure cost of a PAM rollout small.
Project scale
30,000+
GitHub stars
500,000+
deployments worldwide
100+
contributors
Vendor-published figures from JumpServer's April 2026 product briefing (star count stated as of May 2026). Brocent has not independently audited them.
What both editions include
These are not upsells. Everything below ships in the free Community Edition as well as in every Enterprise tier.
- ▸ Core 4A — account, authentication, authorisation and audit
- ▸ SSH, RDP, Telnet, SFTP and Kubernetes access through one gateway
- ▸ Full session recording and video replay
- ▸ Real-time session monitoring and intervention
- ▸ Command execution blacklist and command-level history
- ▸ Session watermarking and SFTP file-transfer logging
- ▸ One-command Docker deployment on your own infrastructure
- ▸ Unlimited users on both editions
Community Edition vs Enterprise Edition
The rows that actually decide the purchase, taken from the vendor's own feature reference. Anything marked X-Pack is Enterprise-only — that module is what the subscription buys.
| Capability | Community Edition (free) | Enterprise Edition |
|---|---|---|
| Licence & cost | GNU GPL v3.0 — free, self-hosted | Commercial annual subscription, priced by asset tier |
| Asset ceiling | 5,000 | Set by the tier you buy — unlimited on Ultimate |
| Enterprise databases | MySQL, MariaDB, PostgreSQL, MongoDB, Redis | Adds Oracle, SQL Server, DB2, Dameng, ClickHouse (X-Pack) |
| Native client connections | Browser-based RDP/VNC and web database consoles; native SSH/SFTP only | Native MSTSC RDP, VNC and database clients via the Razor / Magnus / Nec proxies (X-Pack) |
| Single sign-on | Local password, SSH key, LDAP, LDAP HA, CAS | Adds OIDC, SAML2, OAuth2, RADIUS, Passkey and WeCom / DingTalk / Feishu / Lark / Slack (X-Pack) |
| Multi-factor authentication | TOTP and email | Adds SMS, RADIUS MFA and facial recognition (X-Pack) |
| Access control | User-login ACL, command filter, data masking rules | Adds login-asset ACL, connect-method ACL, ticket review and face verification (X-Pack) |
| Account & credential automation | Account discovery, secret rotation, risk detection, email backup | Adds account push, SFTP/object-storage backup, post-session secret rotation and an external vault (X-Pack) |
| Multi-tenancy | Not included | Multiple organisations with isolated resources and org-level roles (X-Pack) |
| Operations & integrations | Ansible playbooks, zones & gateways, email notifications | Adds cloud asset sync, Windows AD directory service, ticket workflow, custom UI theme and SMS notifications (X-Pack) |
| Support | Community forum and public documentation | SLA-backed vendor support — 8×5 email on the subscriptions priced here |
Enterprise Edition pricing
Licensed per year, per deployment — not per user. Every tier includes the X-Pack module and 8×5 vendor email support, and is quoted for your asset count.
Enterprise Edition — Basic
Quote on request
Includes X-Pack module · 8×5 email support
- Capacity
- Up to 50 assets
- Deployment
- Standalone
- SKU
- SW-JS-EE-BAS-50-A
The entry Enterprise subscription. Full X-Pack module and 8×5 email support on a single-node deployment — sized for a server room or a single site rather than a fleet.
Get a quoteEnterprise Edition — Standard
Most chosenQuote on request
Includes X-Pack module · 8×5 email support
- Capacity
- Up to 500 assets
- Deployment
- Standalone or active-standby
- SKU
- SW-JS-EE-STD-500-A
The tier most multi-site businesses land on: enough asset headroom for a few hundred servers, network devices and databases, and the first tier that supports an active-standby pair so a controller outage doesn't lock admins out.
Get a quoteEnterprise Edition — Professional
Quote on request
Includes X-Pack module · 8×5 email support
- Capacity
- Up to 5,000 assets
- Deployment
- Standalone or active-standby
- SKU
- SW-JS-EE-PRO-5000-A
Data-centre scale. The same asset ceiling as the free Community Edition, bought for the X-Pack feature set and vendor support rather than for capacity alone.
Get a quoteEnterprise Edition — Ultimate
Quote on request
Includes X-Pack module · 8×5 email support
- Capacity
- Unlimited assets
- Deployment
- Standalone, active-standby or high availability
- SKU
- SW-JS-EE-ULT-U-A
No asset ceiling and the only tier cleared for a full high-availability cluster — the shape a multi-region operations team needs when the bastion host itself has to be treated as production infrastructure.
Get a quoteAnnual subscription, per deployment. JumpServer does not publish list prices, so each tier is quoted for your asset count — Brocent is an authorised reseller and confirms current pricing, licensing terms and regional availability.
Asset expansion packs
Capacity add-ons for an existing subscription — often cheaper than moving up a whole tier when you are just over a band.
Asset Expansion Pack — 50 assets
Quote on request
Adds 50 assets to an existing Basic or higher subscription — a Basic licence plus one pack manages up to 100 assets.
SW-JS-EE-AEP-50-A
Asset Expansion Pack — 500 assets
Quote on request
Adds 500 assets, designed for Standard and Professional subscriptions — a Standard licence plus one pack manages up to 1,000 assets.
SW-JS-EE-AEP-500-A
Pricing & availability notice
JumpServer does not publish Enterprise Edition list prices, and neither does this page. Pricing is quoted per deployment against your asset count, before tax. Invoicing currency, licensing terms and product availability vary by country and are set by the vendor or by Brocent's reseller agreement. Subscriptions are annual and per deployment. Talk to a consultant for a quote and to confirm regional licensing and compliance requirements.
Which edition and tier fits
Evaluating, or under 5,000 assets with no compliance deadline
Start on the free Community Edition. It is the same product, GPLv3-licensed, with session recording, command filtering and the core 4A model already included — Brocent can deploy and operate it for you without any licence spend at all.
You need SSO, ticket approval or enterprise databases
This is the real reason to buy Enterprise Edition, not the asset count. SAML2/OIDC sign-on, just-in-time ticket approval, Oracle and SQL Server access, Windows AD and native RDP clients are all X-Pack, so the Basic or Standard subscription is the entry point.
The bastion host itself is production infrastructure
If losing privileged access would stop an incident response, you need redundancy, not just features. Standard and Professional support an active-standby pair; Ultimate is the only tier cleared for a full high-availability cluster across regions.
What Brocent delivers around the licence
A PAM licence on its own changes nothing — the value is in what gets onboarded into it and who keeps it running. Brocent is an authorised JumpServer reseller, appointed by LXware — a FIT2CLOUD subsidiary and the vendor behind JumpServer — and the licence is normally bought as part of a delivered deployment:
- ▸ Tier sizing against your real asset inventory, so you are not paying for a band you don't use
- ▸ Container deployment on your own infrastructure, or on a managed cloud VM we provision
- ▸ Integration with LDAP / Active Directory or your existing SSO provider
- ▸ Asset and privileged-account onboarding, command filters and approval rules
- ▸ Patching, backup and monitoring of the JumpServer platform itself under a Managed IT plan
- ▸ First-line support in your timezone and language, on top of the vendor SLA
JumpServer pricing FAQ
Is JumpServer really free?
The Community Edition is, genuinely — GPL v3.0, source on GitHub, no user limit, up to 5,000 assets, and it includes session recording, command filtering, credential rotation and the full core 4A model. Enterprise Edition is a paid annual subscription that adds the X-Pack module and vendor support on top; the prices on this page are for that.
Why does Enterprise Basic allow only 50 assets when the free edition allows 5,000?
Because the Enterprise tiers are priced by asset band, while 5,000 is the Community Edition's fixed product ceiling. Buying Enterprise is a decision about features and support — SSO, ticket approval, enterprise databases, native clients, multi-tenancy, an SLA — not about raising a capacity limit. If you need more than 5,000 assets as well, that is the Ultimate tier.
What counts as one 'asset'?
Each managed target registered in JumpServer — a Linux or Windows host, a Unix/macOS machine, a switch, router or firewall, a database instance, a Kubernetes cluster, a cloud or directory endpoint, or a published web application. Users are not counted: both editions allow unlimited users. If a tier's band is slightly too small, an Asset Expansion Pack is cheaper than moving up a tier.
Can we trial Enterprise Edition before committing to a year?
Yes. A 14-day Enterprise Edition evaluation licence can be arranged through Brocent, and the Community Edition can be run indefinitely at no cost in parallel. We normally deploy Community Edition first, load your real assets into it, and only convert to an Enterprise licence once you have confirmed which X-Pack features you actually need.
Where does JumpServer run, and who holds the session data?
It is self-hosted, not SaaS. JumpServer is a Linux-native, containerised application deployed with a single Docker Compose command onto infrastructure you control — on-premises, a colocation rack, or a cloud VM in whichever region you choose. Session recordings, credentials and audit logs stay in your own database and storage, which is usually what makes it workable for data-residency requirements that rule out a hosted PAM.
Does this replace our VPN, MFA or endpoint protection?
No, and it shouldn't be sold as though it does. JumpServer governs administrative sessions — who may open a privileged connection to which system, what they may run in it, and what was recorded. Network access, user identity and endpoint protection are separate layers; see our Network Security, Identity & Access and Endpoint Security categories for those.
What does Brocent do beyond supplying the licence?
Deployment and operation. We size the tier against your real asset inventory, deploy the containers on your infrastructure or on a managed cloud VM, connect it to LDAP/AD or your SSO provider, onboard assets and accounts, set the command filters and approval rules, and keep it patched and backed up under a Managed IT plan. The vendor SLA covers the product; we cover the first line, in your timezone and language.
Related categories
Talk to a consultant about privileged access
Tell us how many servers, network devices and databases your admins reach today, and we will tell you whether the free Community Edition covers it or which Enterprise tier you actually need — plus what it costs to have us run it.
