You must select at least 2 products to compare!
Sonar Logo
8,118 views|5,651 comparisons
Sonar Logo
58,263 views|46,097 comparisons
Comparison Buyer's Guide
Executive Summary
Updated on Mar 20, 2023

We performed a comparison between SonarCloud and SonarQube based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Based on the reviews, both SonarCloud and SonarQube appear to have relatively straightforward deployment processes, although some minor issues were reported with the initial setup of each platform.
  • Features: SonarCloud is best for startups and mid-size companies, discovering vulnerabilities, security weak points, and feedback on feature branches. SonarQube detects code quality during development, code standard rules, and covers top OWASP vulnerabilities, with easy DevOps pipeline configuration. Its dynamic testing and automation could be improved.
  • Pricing: SonarCloud pricing is based on the number of users, services, and lines of code. SonarQube offers a free open source version and a yearly subscription for the enterprise version.
  • Service and Support: SonarCloud has community support, but not technical support. SonarQube offers online resources and support at an additional cost.

Comparison Result: Based on the parameters we compared, SonarQube comes out ahead of SonarCloud. Although both products have valuable features and can be estimated as high-end solutions, our reviewers found that SonarCloud lacks technical support.

To learn more, read our detailed SonarCloud vs. SonarQube Report (Updated: September 2023).
734,678 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
"The most valuable feature of SonarCloud is its overall performance.""The reports from SonarCloud are very good.""The solution can be installed locally.""I'm not implementing the solutions. However, I've talked to the people who deploy the tools, and they are happy with how easy setting up SonarCloud is.""The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false positives and we can customize the rules.""The most valuable features of SonarCloud are the ability to discover vulnerabilities, security weak points, security hotspots, and all the feedback that comes into the feature branch. You can deploy the code with the security, you can eliminate the problem at the developer level rather than identifying the problem in the productions."

More SonarCloud Pros →

"Using SonarQube benefits us because we are able to avoid the inclusion of malware in our applications.""My focus is mainly on the DevOps pipeline side of things, and from my perspective, the ease of use and configuration is valuable. It is pretty straightforward to take a deployment pipeline or CI/CD pipeline and integrate SonarQube into it.""One of the most valuable features of SonarQube is its ability to detect code quality during development. There are rules that define various technologies—Java, C#, Python, everything—and these rules declare the coding standards and code quality. With SonarQube, everything is detectable during the time of development and continuous integration, which is an advantage. SonarQube also has a Quality Gate, where the code should reach 85%. Below that, the code cannot be promoted to a further environment, it should be in a development environment only. So the checks are there, and SonarQube will provide that increase. It also provides suggestions on how the code can be fixed and methods of going about this, without allowing hackers to exploit the code. Another valuable feature is that it is tightly integrated with third-party tools. For example, we can see the SonarQube metrics in Bitbucket, the code repository. Once I raise the full request, the developer, team lead, or even the delivery lead can see the code quality metrics of the deliverable so that they can make a decision. SonarQube will also cover all of the top OWASP vulnerabilities, however it doesn't have penetration testing or hacker testing. We use other tools, like Checkmarx, to do penetration testing from the outside.""This solution has the capability to analyze source code in almost all the languages in the market.""We've configured it to run on each commit, providing feedback on our software quality. ]""We consider it a handy tool that helps to resolve our issues immediately.""Can tweak rules and feed them into our build pipelines.""The most valuable feature of SonarQube I have found to be the configuration that has allowed us to can make adjusts to the demands of the code review. It gives a specified classification regarding the skill, prioritization, and it is easy for me to review and make my code."

More SonarQube Pros →

"We had some issues with the scanner.""The reports could improve by providing more information. We are not able to use the reports in our operation until they are improved. Additionally, if the vendor provided more customization capabilities it would be a benefit.""It would be helpful if notifications could go out to an extra person.""CI/CD pipeline is part of a whole chain of design, development, and production, and it's becoming increasingly crucial to optimize the various tools across different stages. However, it's still a silo approach because the full integration is missing. This isn't just an issue with SonarCloud. It's a general problem with tooling.""SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird. We then need to manually go and mark the false positive.""The solution needs to improve its customization and flexibility."

More SonarCloud Cons →

"SonarQube is not development-centric like Snyk.""There needs to be a shareable reporting piece or something we can click and generate easily.""There is no automation. You need to put the code there and test. You then pull the results and put them back in the development environment. There is no integration with the development environment. We would like it to be integrated with our development environment, which is basically the CI/CD pipeline or the IDE that we have.""SonarQube can improve by scanning the internal library which currently it does not do. We are looking for a solution for this.""The product's pricing could be lower.""Lacks sufficient visibility and documentation.""It should be user-friendly.""SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan. For example, when the developer writes the code and does the corresponding unit test, he can cover functional and non-functional. So the SonarQube could be improved by helping to execute unit tests and test dynamically, using various parameters, and to help detect any vulnerabilities. Currently, it'll just give the test case and say whether it passes or fails—it won't give you any other input or dynamic testing. They could use artificial intelligence to build a feature that would help developers identify and fix issues in the early stages, which would help us deliver the product and reduce costs. Another area with room for improvement is in regard to automating things, since the process currently needs to be done manually."

More SonarQube Cons →

Pricing and Cost Advice
  • "The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable."
  • "The price of SonarCloud is not expensive, it goes by the lines of code. 1 million lines per code are approximately 4,000 USD per year. If you need 2 million lines of code you would double the annual cost."
  • "I am using the free version of the solution."
  • More SonarCloud Pricing and Cost Advice →

  • "On the pricing side, it's 3,000 Euros for 1 million lines of code."
  • "My guess is that we have a yearly subscription. We use it quite extensively, so a monthly license wouldn't make sense. Yearly subscriptions are usually cheaper. In addition to the standard licensing fee, there is just the cost of running the hardware where it is hosted."
  • "Compared to similar solutions, SonarQube was more accessible to us and had more benefits, with regards to size of the code base and supported languages. Apart from the Enterprise licensing fee, there are no additional costs."
  • "SonarQube enterprise, I am not sure of the price but from what I understand they are charging a fee. It's is not clear if it is an annual fee or a one-off."
  • "The free version of SonarQube does everything that we need it to."
  • "We're using an older version because it is the open-source flavor of it and we can continue using it at no cost. We're not paying any licensing at all, which was another factor in choosing this route so that we can learn and grow with it and not be committed to licenses and other similar things. If we choose to get something else, we have to relearn, but we don't have to relicense. Basically, we're paying no license costs."
  • "We are using the Developer Edition and the cost is based on the amount of code that is being processed."
  • "As a user and a consumer of this solution, it can be pricey for my company to support and use, even though there are many benefits. For this reason, we use the free version. In the future, as our product cycles develop and evolve at a more steady pace, we hope to invest in the licensing for this tool."
  • More SonarQube Pricing and Cost Advice →

    Use our free recommendation engine to learn which Application Security Testing (AST) solutions are best for your needs.
    734,678 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false… more »
    Top Answer:The solution needs to improve its customization and flexibility.
    Top Answer:I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have  a look… more »
    Top Answer:SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use… more »
    Top Answer:We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing… more »
    Average Words per Review
    Average Words per Review
    Also Known As
    Learn More
    Video Not Available

    SonarCloud is the leading online service to catch Bugs and Security Vulnerabilities in your Pull Requests and throughout your code repositories. Totally free for open-source projects (paid plan for private projects), SonarCloud pairs with existing cloud-based CI/CD workflows, and provides clear resolution guidance for any Code Quality or Code Security issue it detects. With more than 1 billion lines of code analyzed every week, SonarCloud empowers development teams of all sizes to write cleaner and safer code, across 24 programming languages.

    SonarQube is the leading tool for continuously inspecting Code Quality and Code Security, and guiding development teams during code reviews. SonarQube provides clear remediation guidance for 27 languages so developers can understand and fix issues, and so teams can deliver better and safer software. SonarQube integrates into your workflow to provide the right feedback at the right time: in-IDE with SonarLint, in pull requests, and in SonarQube itself. With over 225,000 deployments helping small development teams and global organizations, SonarQube provides the means for teams and companies around the world to own and impact their Code Quality and Code Security.

    Learn more about SonarCloud
    Learn more about SonarQube
    Sample Customers
    Microsoft, Apache, Wikimedia foundation, Brave
    Bank of America, Siemens, Cognizant, Thales, Cisco, eBay
    Top Industries
    Computer Software Company19%
    Financial Services Firm9%
    Manufacturing Company8%
    Healthcare Company5%
    Computer Software Company30%
    Financial Services Firm21%
    Comms Service Provider8%
    Insurance Company6%
    Financial Services Firm18%
    Computer Software Company15%
    Manufacturing Company10%
    Company Size
    Small Business23%
    Midsize Enterprise19%
    Large Enterprise58%
    Small Business25%
    Midsize Enterprise17%
    Large Enterprise58%
    Small Business16%
    Midsize Enterprise12%
    Large Enterprise71%
    Buyer's Guide
    SonarCloud vs. SonarQube
    September 2023
    Find out what your peers are saying about SonarCloud vs. SonarQube and other solutions. Updated: September 2023.
    734,678 professionals have used our research since 2012.

    SonarCloud is ranked 10th in Application Security Testing (AST) with 6 reviews while SonarQube is ranked 1st in Application Security Testing (AST) with 30 reviews. SonarCloud is rated 8.4, while SonarQube is rated 8.2. The top reviewer of SonarCloud writes "It helps us detect vulnerabilities, but the integration with other tools in the CI/CD pipeline could be better". On the other hand, the top reviewer of SonarQube writes "Open-source, stable, and finds the problems for you and tells you where they are". SonarCloud is most compared with Veracode, Checkmarx, OWASP Zap, GitLab and Fortify on Demand, whereas SonarQube is most compared with Checkmarx, Coverity, Veracode, Snyk and Sonatype Nexus Lifecycle. See our SonarCloud vs. SonarQube report.

    See our list of best Application Security Testing (AST) vendors.

    We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.