Dify vs Flowise after the archive: what ended, what still runs, what it costs

Dify and Flowise are no longer two live open-source projects being compared on features: Dify is shipping — release 1.17.1 on September 10, 2026, last push September 18, 2026 — while the FlowiseAI/Flowise repository is archived, last pushed August 13, 2026, and its maintainers set End of Life at August 31, 2026. For a new build that decides it. For an existing Flowise deployment it does not, because the part that ended is the open-source repository, not the hosted service.

That distinction is the whole reason this page exists, and almost every comparison written before July 2026 gets it wrong in one direction or the other. The sunset timeline has exactly one column describing consequences, and its header reads "Impact on OSS Repository". Nothing in it mentions Flowise Cloud. On September 19, 2026 the marketing site carried the banner "We're sunsetting Flowise" and was still selling Starter and Pro, with a first-month-free call to action on the Starter card. So: the code is archived and at end of life; the hosted service has no announced end and is still on sale. Both halves are true at once.

What actually ended, and what did not

Sources, all checked September 19, 2026: the Flowise repository and Dify repository through the GitHub API, the maintainers' announcement, the npm registry, Docker Hub, and Workday's acquisition release. Two details deserve their own sentence. The two published timelines disagree about the archival date — the sunset page schedules it for August 10, 2026 and the maintainers' own discussion post for August 13, 2026 — and GitHub settles it: the repository page, and those of the docs and embed repositories, each read "archived by the owner on Aug 13, 2026". And the announcement's statement that packages and images "will be marked deprecated" has not happened: at that check neither the npm package nor the Docker repository carried a deprecation flag. That is a stated intention, not a fact about the packages.

The security picture deserves its own paragraph, and it is worse than the archive notice suggests. Flowise stopped accepting new vulnerability reports on August 3, 2026 — its SECURITY.md says so in one line — a day before twenty-six advisories were published against it, ten of them critical. All twenty-six carry a patched version — twenty-five say 3.1.3 and one says 3.1.4 — so none of them leaves the final release exposed. Five published in the following week do: CVE-2026-67620, CVE-2026-67621, CVE-2026-67622, CVE-2026-70636 and CVE-2026-71962 each describe Flowise through 3.1.4 as affected, and each lists its patched version as unknown (GitHub advisories, checked September 19, 2026; that enumeration stopped at the 100 records the listing returned, so five is a floor rather than a total). An unpatched authentication bypass and an unauthenticated file-download path are in that set. Anyone staying on 3.1.4 is carrying them.

One more piece of care, because search results mix them: flowise.io is an unrelated work-management company and flowise.co.za is an unrelated South African software agency. Neither has anything to do with this product, and neither's pricing belongs on this page.

Which one should you pick

The execution models also differ in a way the feature lists flatten. Flowise's cloud plans meter predictions per month — 100, 10,000, 50,000 by tier — plus storage. Dify's meter message credits against bundled model usage, after which, in the pricing page's own words, you can switch to your own API key. Whether a Flowise prediction run on your own API key still draws down that quota is not stated on the pricing section and was not tested here; if you are near a tier boundary, verify it in your own account before you budget.

Published plans and prices

Read from the Pricing section of the Flowise homepage on September 19, 2026, which is the only public price source for this product — flowiseai.com/pricing redirects to a login form and shows no prices at all. The self-hosted licence carve-out comes from the repository's LICENSE.md, which matters because the sunset page's "the Apache 2.0 licensed code is yours" is true but partial: the enterprise authentication and role layer is not covered by it.

Read from dify.ai/pricing on September 19, 2026. Three caveats carried from that page. It states "Prices exclude applicable taxes, which may be added at checkout". The annual figures are what the page renders by default; the monthly figures come from the page's own monthly toggle and were not confirmed at a checkout. And the pricing page calls the allowance "message credits" while the documentation calls it "AI credits" — one quota, two names, not two allowances. The per-model credit rate is not published on the page fetched here, so credits cannot be converted into tokens on this page.

The connection boundary, field by field

Both products are bring-your-own-key, and both take an OpenAI-compatible base URL. The differences that bite are narrower than the marketing pages suggest.

Field names and behaviour read on September 19, 2026 from the compatible provider schema, the Anthropic provider schema, ChatOpenAICustom.ts, ChatAnthropic.ts and httpSecurity.ts, with the dropdown behaviour from modelLoader.ts and the frozen models.json it fetches. For Kunavo those fields take https://api.kunavo.com/v1 on the OpenAI-compatible route — see the chat endpoint reference and authentication — and the separate origin-form value documented under the Anthropic base URL for Dify's Anthropic plugin. Kunavo publishes those as configuration references and has not runtime-tested either product against them, so treat the first call as the test.

Two capability notes that cause runtime surprises rather than setup errors. Dify's compatible plugin makes you declare context size, tool-call style and the vision, audio, video and document flags by hand; a wrong value fails later as a request error, not as a configuration error. It also validates a new model by issuing a real one-word request to your endpoint, so an endpoint that cannot complete a tiny call will not save — the error reference is the right place to start if that step fails. On Dify Cloud, spreading requests across several keys for the same model is badged Professional and Team in the documentation; whether that feature exists on the self-hosted Community edition is not stated on its documentation page and is unverified here.

One boundary that applies to both, and to Kunavo specifically: Kunavo does not serve embedding, speech-to-text or text-to-speech models. Both builders have slots for them — Dify's compatible plugin covers five model types, and every knowledge base needs an embedding step — so those slots point at a different provider or at something you run locally. Only the chat-model slots are what a Kunavo key fills. That also sidesteps an unresolved question in Dify's own material, where the plugin README and its current source disagree about whether a version path is appended for non-chat model types.

Migration cost, honestly

Both products export, and neither exports into the other. Dify exports an app as DSL in YAML, carrying app configuration, workflow orchestration and node settings, model parameters and prompt templates, and knowledge-base connections but not the knowledge data itself; third-party API keys are deliberately excluded, as are usage logs (app management docs, September 19, 2026). Flowise Cloud exports selected data as JSON and, in its own words, excludes credentials, which must be recreated (migration docs — note this is the older Cloud V1 to V2 guide and predates the sunset, so it is not a sunset migration path).

No converter between the two formats was found. That is the absence of a search result rather than proof that none exists, but plan on rebuilding each flow node by node and re-entering every credential. For a team with a handful of flows this is an afternoon; for a library of fifty it is the dominant cost of the decision and it dwarfs the subscription difference. Forking is what the maintainers themselves suggest, on both the sunset page and the announcement — which means inheriting the unpatched advisories above along with the code.

A worked model-cost estimate

This is illustrative token arithmetic, not a measured task cost and not a bill ceiling. Assume one knowledge-assisted workflow run sends 18,000 uncached input tokens — system prompt, retrieved chunks and a short history — and returns 700 output tokens, and that you run 1,000 of them in a month. Rates are live Kunavo catalog prices per million tokens.

Read it against the platform line rather than instead of it. Under these assumptions the spread between the cheapest and the most expensive model in this lane is $34.40 a month — larger than the $35-versus-$59 platform difference in either direction, which is why model choice, not builder choice, is usually where the money is. Retrieved-context size is the other lever: these runs are input-dominated, so trimming chunks moves the total more than trimming answers does. AI cost optimization covers that method, and RAG implementation covers where the retrieval step belongs.

Kunavo's catalog amount is a billing floor rather than a cap: when the upstream reports its charge, the bill is the greater of catalog cost and upstream cost times the applicable markup. Cache charges, embeddings and external tools sit outside this example. The minimum top-up is $10 in prepaid credit, a funding minimum rather than a task fee or a subscription — see billing details and usage for what the account records per call.

Where to go from here

If you are choosing the builder, the short version is: new work goes to Dify, an existing Flowise deployment can keep running but is now carrying advisories nobody will patch, and the protocol you need decides the rest. If you are choosing what sits behind it, the agent API directory records the connection boundary for both — Flowise is listed in its archived section — and the OpenAI-compatible API guide covers the mechanism both use. LiteLLM alternatives is worth a look if you are comparing gateways rather than builders. Create a Kunavo account when you want a key to put in either tool, then run one bounded flow and read the charge your account recorded for it before you scale.

FAQ

Repository status, releases, package registries, pricing pages, plugin schemas and node source for both products were fetched and read on September 19, 2026; the specific checks are listed inline beside each claim. Kunavo has run no compatibility test against Dify or Flowise — everything about either product here is transcribed from its own documentation, source and public APIs. Kunavo token rates come from the live catalog, and every dollar example on this page is illustrative token arithmetic.