Hetzner Cloud Explained: Servers, Projects, and Networking

Accounts, projects, and access

A Hetzner customer account covers two product lines that share one login: Hetzner Cloud, managed through the Cloud Console, and dedicated root servers, managed through a separate panel called Robot. This guide is about the Cloud side. The account holds the payment method and the invoice history; everything else lives inside projects.

A project is the working unit in the Cloud Console. Each project has its own servers, Volumes, Networks, Firewalls, Load Balancers, SSH keys, API tokens, and its own resource limits. One account can hold many projects, which makes a project the natural boundary between clients, environments, or teams. Other Hetzner users can be invited into a project as members with roles, so access is shared without sharing the account password. API tokens are issued per project with read or read-and-write permission; the official hcloud CLI, the Terraform provider, and community tools all authenticate with these tokens.

Account

Customer login with payment method and invoices; shared with Robot for dedicated servers

Project

Container for servers, storage, networking, keys, tokens, and limits

Member

Another Hetzner user invited into a project with a role

API token

Project-scoped credential with read or read-and-write access

Server types

Hetzner Cloud servers are grouped into families by processor and by whether vCPUs are shared or dedicated:

Each server type fixes vCPU count, memory, local NVMe disk, and a monthly traffic allowance that Hetzner publishes per type and per location. Servers can be rescaled to a larger type; growing the disk is permanent, while a CPU and memory-only rescale can be reversed. Every server gets a primary IPv6 subnet. A primary IPv4 address is optional and billed separately, so IPv6-only servers behind a Load Balancer or a proxy are a legitimate way to save money.

Servers are created from Hetzner’s distribution images (Debian, Ubuntu, Fedora, Rocky Linux, AlmaLinux, and others), from app images with software preinstalled, from your own Snapshots, or from a custom ISO you mount. Cloud-init user data runs at first boot for automated setup. A rescue system can be booted from the console when a server will not start, and a browser-based VNC console gives access without SSH.

Storage, Snapshots, and Backups

Volumes are network block storage that attach to one server at a time in the same location, can be resized upward while in use, and outlive the server they were attached to. Snapshots are manual images of a server’s disk, billed per gigabyte per month and usable to create new servers in any location. Backups are an optional per-server feature that keeps a rolling set of automatic daily images for a percentage of the server price. Both Snapshots and Backups capture the local disk only, not attached Volumes, which need their own backup approach.

Hetzner has also added S3-compatible Object Storage in selected locations, organised into buckets, and continues to offer Storage Boxes, a separate product for bulk storage over protocols such as SSH, Samba, and BorgBackup. Object Storage is the better fit for application data and static assets; Storage Boxes suit archives and off-server backups.

Locations and networking

Hetzner Cloud runs in Falkenstein and Nuremberg in Germany, Helsinki in Finland, Ashburn and Hillsboro in the United States, and Singapore. Locations are grouped into network zones (for example, the European locations share one zone), and a private Network can only span locations within the same zone. Some server families are not offered in every location, and traffic allowances differ between the European and non-European sites, so check the location page before committing.

Networking is straightforward and mostly free. A Network is a private layer 3 network with subnets that connects servers and Load Balancers in one zone; traffic inside it does not count against the allowance. Firewalls are stateful rule sets applied to servers by label or name and enforced outside the operating system, complementing a host firewall. Floating IPs are public addresses that can be moved between servers in the same location for failover. Load Balancers distribute TCP and HTTP traffic across servers, terminate TLS with managed certificates, and run health checks. Placement Groups spread servers across physical hosts so that one hardware failure does not take out every replica. Reverse DNS for your IPs is set from the console, and the DNS Console hosts public zones.

Billing, limits, and email sending

Every resource is billed by the hour up to a monthly cap, so a server that runs all month costs the listed monthly price and one deleted after a day costs a few hours. Usage is invoiced at the start of the following month, and Hetzner accepts card, PayPal, SEPA direct debit for eligible customers, and prepayment. A powered-off server still bills, because its disk and IP remain reserved; delete it to stop charges. Traffic beyond the included allowance is billed per terabyte.

Limits are set per project and cover the number of servers, the total vCPUs and memory, Volumes, Floating IPs, Networks, and other objects. New accounts start with low limits, and increases are requested from the Limits page in the Cloud Console, where Hetzner reviews the request. Listings described as “5 Server” or “10 Server” refer to this project limit and nothing else. New accounts may also be asked to verify identity before ordering, which is a normal provider control.

Outbound port 25 is blocked on Hetzner Cloud servers for new customers by default, and the provider lifts the block on request, typically only after the account has some history and a stated use case, with the decision resting with Hetzner. Any mail you send must comply with the Hetzner terms and anti-spam law; abuse complaints lead to server locks. For application email, a dedicated sending service is usually the safer route. Full details are in the Hetzner Cloud FAQ and the wider Hetzner documentation.

1. Add your SSH key at creation and disable password login; Hetzner emails a root password only when no key is supplied.
2. Apply a Firewall before the server is reachable and open only the ports you serve.
3. Watch the per-project cost estimate in the console; there is no built-in hard spending cap, so set your own alerting.
4. Keep every workload within the Hetzner terms: cryptocurrency mining, port scanning, and unsolicited email lead to locks regardless of who opened the account.

Where to go next

Account listings labelled by project server limit or by outbound port 25 status are on the Buy Hetzner Accounts product page.

Related reading in the Cloud Library:

• Cloud networking basics: VPCs, subnets, firewalls, and floating IPs
• Running Docker on a cloud VPS: setup and best practices
• A simple cloud backup strategy: snapshots, object storage, and retention
• Cloud service quotas and limits explained
• Securing a VPS: firewalls, Fail2ban, and automatic updates

Browse the full Cloud Library, or read the Hetzner vs DigitalOcean comparison.