Measure the code before you price the licence.
Sonar publishes one entry price for SonarQube. As of September 2026, Sonar's plans and pricing page lists SonarQube Cloud Team from US$34/month for up to 100k lines of code (LOC).
The page currently shows that figure as a discounted rate, so check it before you budget. SonarQube Server, the version you install yourself, has no published price at all.
SonarQube pricing is based on lines of code for both products, not on how often you scan. Once you know how Sonar counts those lines, you can estimate your own figure in an afternoon, and that figure is most of what a quote needs.
How is SonarQube priced?
SonarQube comes in two deployment families, according to Sonar's product page. SonarQube Cloud is the software-as-a-service version that Sonar hosts. SonarQube Server is the self-managed version you install on your own infrastructure.
For Server, the wording on Sonar's SonarQube Server pricing page is that the Developer, Enterprise and Data Center editions are "Priced per instance, per year, based on your lines of code". An instance is one installation, and "You pay per instance for a maximum number of LOC to be analyzed".
For Cloud, the Team figure above covers the first 100k-line tier only. Sonar says "Other LOC increments are available", and the Team plan comes with a 14-day trial with no credit card needed.
There is also a free route. SonarQube Cloud has a free tier to explore SonarQube with private projects up to 50k lines of code, and for public repositories under an open-source licence approved by the Open Source Initiative (OSI).
What counts as a line of code, and what does not
Two teams with the same repositories can arrive at very different numbers if they count differently. Most of Sonar's rules shrink the number you pay for.
Both products leave out the same four things:
- test code
- files you have excluded from analysis
- code in languages SonarQube does not support
- comments and blank lines
The rules are in Sonar's Server lines-of-code documentation and its SonarQube Cloud subscription documentation.
The branch rule matters most. Sonar does not add up every branch. "The LOC of a project is counted as the lines in the largest branch of the project". On Server, the documentation is precise: it uses "the most recent analysis of the largest branch or pull request".
Sonar's documentation gives its own example. Project1 has 500 lines on its main branch and 400 on a long-lived branch, so it counts as 500. Project2 has nothing on main and 200 on a branch, so it counts as 200. "The total LOC for the organization is 500 + 200 = 700".
Scan frequency does not change the count. On Cloud, Sonar's example is blunt: "If your private project has 6K LOCs and you analyze it 100 times in the month, this will be counted as 6K for the billing". The Server documentation says the same thing in its own words: you cannot use up your licence by re-analysing the same code.
Public repositories are where the two products part ways. Cloud's rule is "Only LOCs from your private projects are counted toward your maximum number of LOCs".
Sonar's Server pricing text makes no public or private exception. It sums "the LOC of each project analyzed" on your instance.
Worked example: estimating your own count before you ask for a quote
Here is how we would size a typical team. The company and numbers below are made up for illustration: a logistics software team in Shah Alam with three repositories.
- order-api (private). The main branch holds 142,000 lines of source. A long-lived release branch holds 151,000. Only the largest branch counts, so this project is 151,000.
- customer-portal (private). 64,000 lines of source on main, plus 22,000 lines of test code. Neither product counts test code, so this project is 64,000.
- tracking-sdk (public, open source). 18,000 lines on main.
Now add it up for each deployment.
- On SonarQube Cloud: 151,000 + 64,000 = 215,000 lines. The public SDK does not count, because Cloud bills private projects only.
- On SonarQube Server: 151,000 + 64,000 + 18,000 = 233,000 lines, because Server counts every project analysed on the instance.
On Cloud, 215,000 lines is above the 100k tier that the public US$34 figure covers, so the team needs a larger LOC increment that fits 215,000 lines plus growth.
On Server, Sonar recommends the Developer edition for "100K+ lines of code" and the Enterprise edition for "1M+ lines of code". Those are Sonar's recommendations, not hard limits. At 233,000 lines, Developer is the starting conversation, and the features you need decide the rest.
A practical method to get your own numbers:
- List every repository you intend to analyse, and mark each one private or public.
- For each repository, find its largest branch. Usually that is main or a long-lived release branch. On Server, a large pull request can also be the largest.
- Count source lines only. Leave out tests, comments, blank lines, languages SonarQube does not support, and files you exclude from analysis (for example generated code, if you configure it as excluded). A generic line counter gives you an estimate; treat it as one.
- Add 12 to 24 months of growth. A team shipping weekly rarely has a smaller codebase next year. This step is our own planning advice.
- Confirm with a trial. Both products offer a free trial with no payment. On Server, open Administration, then Configuration, then License Manager after the first analysis to see how many lines are in use. That is Sonar's own count, which is the one that matters.
SonarQube Cloud vs Server: two different ways to pay
The choice between Cloud and Server starts with who runs it: Sonar, or you. If your organisation, or a client you build for, restricts where source code may be sent outside Malaysia or Singapore, settle that first, because the pricing follows from it.
- SonarQube Cloud Team. Sonar hosts it and you sign up yourself. It is the one plan with a public entry price, and it is aimed at teams under 50 developers. Billing counts private projects only.
- SonarQube Cloud Enterprise. Sonar hosts it. It is for teams over 50 developers and is custom-priced through sales. It adds single sign-on (SSO) with SCIM user provisioning, portfolios, and reporting against the OWASP and MISRA standards.
- SonarQube Server. You host it, on the Developer, Enterprise or Data Center edition, priced per instance per year by lines of code.
As of September 2026, Sonar lists AI CodeFix and MISRA C++:2023 compliance in the Server Enterprise edition, and "Autoscaling based on demand" in Data Center. According to Sonar's AI CodeFix documentation, AI CodeFix "uses a large language model (LLM) to automatically generate AI-driven code fixes for the issues discovered by SonarQube Server".
If you already know roughly how many lines you have but are not sure which Server edition fits, our guide to choosing between SonarQube Community, Developer and Enterprise walks through the decision.
On the self-managed side, the free Community Build "Analyzes only the main branch", according to Sonar's edition comparison, and does not analyse feature branches or pull requests. Paid editions analyse feature branches and pull requests, and show code health status in pull request comments.
What happens when you hit your line limit
Both products hold the line at your licence limit. On Cloud, "You cannot exceed your LOC limit in SonarQube Cloud", and an analysis that would go over it is not performed. Free and Team organisations get a warning first: "you will be notified to either upgrade your plan or reduce the number of LOCs in your projects".
On Server, the instance "will reject any new analysis whose total lines of code exceed the limit defined by your license". Basic functions such as saving configuration changes keep working, but any new analysis over the limit is rejected. Near the limit, Sonar's documentation says "you may need to purchase additional lines of code". Check your count in License Manager before a release week.
Why SonarQube Server has no public price
Sonar publishes the Server editions and their LOC recommendations, but no prices. If you want a SonarQube Server licence cost, its pricing page sends you to sales: "Get in touch with sales for pricing specific to your needs".
The pricing model explains why a single number would mislead. A Server quote moves with edition, instance count and LOC tier together. A team of 20 on one instance with 233,000 lines and a group running separate instances for two business units are not buying the same thing, even if their total code is similar.
So we do not publish Server prices either. A Server figure given without your line count is a guess. The honest answer to the question of what SonarQube Server costs is a question back: how many lines, on how many instances, on which edition?
How to get a SonarQube quote in Malaysia or Singapore
We are a Sonar reseller partner. We supply SonarQube licences in Malaysia and Singapore, and we can set SonarQube up in your CI/CD pipeline and train your developers on it.
In Singapore, GovTech's SHIP-HATS developer platform already offers SonarQube to its users as a managed code quality and security analysis tool. If your team builds on SHIP-HATS, check what it already provides before you buy a separate licence.
To quote quickly, we need four things:
- Your estimated lines of code, counted with the method above, and whether any repositories are public.
- Cloud or Server, or "not sure yet".
- Team size, which decides the Cloud plan.
- Any compliance reporting you need, such as OWASP or MISRA, which can point to the Cloud Enterprise plan or the Server Enterprise edition.
Malaysian teams can find editions and training on our SonarQube Malaysia page. Singapore teams can use our SonarQube Singapore page.
Free consultation
Get a SonarQube quote
Send us your line count and team size, and tell us whether you lean towards Cloud or Server. We will come back with a quotation and a recommended edition.