fota.systems
Independent · fact-checked August 2026

Compare firmware OTA platforms

Shipping firmware to devices you cannot reach is the part of embedded work that goes wrong expensively. This is an independent comparison of the platforms that do it — for embedded Linux and for microcontrollers, hosted and self-hosted.

10Platforms
9With free tier
10Open source
5Guides
PlatformTypeTargetsDeploymentPricing*Free tier
MMender Linux OTA Embedded Linux SaaS + self-hosted OSS free; hosted from $34/mo Yes
Bbalena Container fleet Embedded Linux SaaS + self-hosted (openBalena) First 10 devices free; from $159/mo Yes
MMemfault MCU observability + OTA MCU + embedded Linux SaaS Free to 10 dev devices; from $3,495/mo Yes
GGolioth MCU cloud MCU (Zephyr-first) SaaS $50 free credits; $0.25/device/mo + $0.0095/MB Yes
EEclipse hawkBit OSS update server Any (device-agnostic) Self-hosted Free Yes
SSWUpdate OSS Linux updater Embedded Linux On-device (no server) Free Yes
FFoundries.io Managed Linux platform Linux + Zephyr SaaS (FoundriesFactory) Subscription, tiered by devices No
TTorizon Vendor platform Embedded Linux (Toradex SoMs) SaaS (Torizon Cloud) OS free; Cloud subscription Yes
AAWS IoT Device Management Cloud service Any (device-agnostic) SaaS (AWS) Pay per use, no minimum Yes
EESP RainMaker Vendor platform ESP32 family SaaS (Espressif) or self-hosted on AWS Free for development; commercial by agreement Yes

* Published list pricing at August 2026 (vendor pricing pages, August 2026). Enterprise agreements are negotiated separately.

How to choose

Embedded Linux?

Mender for A/B safety, balena if your team ships containers.

Microcontrollers?

Golioth for predictable cost, Memfault when you need crash data.

Refuse per-device fees?

hawkBit plus SWUpdate — free, and you operate both halves.

Do not want to maintain a distro?

Foundries.io, or Torizon if the hardware is Toradex.

What actually matters when evaluating

What happens when the update is bad

Not if — when. Every fleet eventually ships a build that does not boot. The platform’s value is concentrated almost entirely in whether the device notices and reverts on its own, and that lives in the bootloader, not the dashboard. Evaluate the rollback model before anything else.

Your target decides the shortlist

Embedded Linux and microcontrollers are different problems wearing the same word. Two copies of a root filesystem is a reasonable cost on Linux and impossible on a part with 512 KB of flash. Any tool claiming to serve both equally well is serving one of them badly — the split explained.

Who runs the server in year three

Self-hosting removes per-device fees and keeps artifacts in your infrastructure. It also gives you uptime, backups, key rotation and an on-call rota. That trade is genuinely worth it at scale and genuinely regretted by small teams who chose it to save a few hundred a month and then quietly stopped patching the server.

Bandwidth is a real cost on cellular

A 40 MB image to 10,000 devices over cellular is a line item somebody notices. Delta updates cut it by an order of magnitude but add build complexity and require knowing exactly what each device runs. Worth it on large or metered fleets; pure overhead on ten devices over wifi.

Signing keys are where this meets PKI

The device must verify a signature before writing anything, which means a signing key exists, lives somewhere, and one day needs rotating. Teams solve updates first and discover key management second, usually during an audit. If that is where you are, private PKI options are the adjacent question.

Want a second opinion on the shortlist?

Tell us the target hardware, roughly how many devices, and what happens commercially if one bricks. You get back a shortlist and the reasoning. No vendor is given your details.

Popular head-to-head comparisons

Mender vs balenaMemfault vs GoliothMender vs SWUpdateEclipse hawkBit vs MenderFoundries.io vs TorizonGolioth vs ESP RainMaker

Guides

Best platformMender alternativesMCU vs LinuxRollbackWhat is FOTA

Frequently asked questions

What does FOTA actually mean?
Firmware over-the-air: replacing the software on a device already in someone’s hands, without touching it. The term is used most in embedded and IoT, where the thing being replaced is firmware rather than an app. OTA is the broader word; FOTA is specifically about firmware.
What is the single biggest risk?
Bricking a device with no physical access. An update that fails halfway, or boots into something broken, turns a product into scrap unless the device can detect the failure and return to what worked. This is why the rollback mechanism, not the feature list, is the first thing to evaluate.
What is an A/B update?
The device carries two copies of the system. The update is written to the inactive copy while the active one keeps running, then the bootloader switches over. If the new copy fails to boot or fails to confirm itself, the bootloader reverts. It costs roughly double the storage and buys near-certain recoverability — usually a good trade.
Do MCUs and Linux devices need different platforms?
In practice yes. Embedded Linux updates whole filesystems or containers and has room for two copies. A microcontroller with a few hundred kilobytes of flash needs a small bootloader, a compact image and careful power-loss handling. Mender and balena live on the Linux side; Golioth and Memfault on the MCU side; hawkBit and AWS sit above both.

See all FAQs →