Migrate to/from Hetzner Object Storage (EU S3)

What is Hetzner Object Storage?

Hetzner Object Storage is the S3-compatible object store from Hetzner Online, the Nuremberg-based operator founded in 1997 that runs hundreds of thousands of servers across its own European data centres. It is offered in three locations — Falkenstein (fsn1) and Nuremberg (nbg1) in Germany, Helsinki (hel1) in Finland — and exposes a standard S3 API with no Hetzner-specific extensions, so the AWS CLI, the AWS SDKs, rclone and backup tools such as Synology Hyper Backup talk to it unchanged. Each uploaded object is split into chunks and spread across the cluster with erasure coding that tolerates the loss of up to three storage servers. The feature set covers what backup and media workloads need: object versioning, lifecycle expiry, object lock in governance and compliance modes (enabled at bucket creation), pre-signed URLs and optional server-side encryption. Two things it deliberately leaves out: there is a single storage tier — no infrequent-access or archive class — and no built-in cross-location replication. Quotas are generous for a European provider: up to 100 buckets per account, 100 TB and 50 million objects per bucket, 5 TB per object, and the base bundle includes 1 TB of storage and 1 TB of egress every month, with ingress, S3 API calls and traffic inside the eu-central network zone free.

Hetzner's own answer to replication is 'none built in', and its pricing page is explicit that unused quota does not carry over — which is exactly the gap a scheduled cross-provider copy fills. The typical Hetzner customer already runs cloud servers or a Storage Box there and wants the S3 bucket to hold backups, media or exports that originate somewhere else: an AWS S3 bucket that costs $0.09 per GB to read out, a Google Drive full of client deliverables, a Wasabi archive that should have an EU twin. CloudsLinker copies between Hetzner Object Storage and 140+ other clouds on its own servers, using multipart upload for anything above 100 MB, so a 2 TB migration into fsn1 does not depend on a laptop staying online.

Key features of Hetzner Object Storage

Three EU locations, EU-only

Falkenstein (fsn1) and Nuremberg (nbg1) in Germany, Helsinki (hel1) in Finland. There is no US or Asian region, which is a feature for GDPR residency and a constraint for global latency.

1 TB storage + 1 TB egress in the base bundle

The base price is billed per hour while at least one bucket exists, capped at a monthly amount, and includes 1 TB of storage (744 TB-hours) and 1 TB of outgoing traffic. Overage is pay-as-you-go per TB-hour and per TB, in 100 MB increments; unused quota expires monthly.

100 TB and 50 million objects per bucket

Up to 100 buckets per account, each holding 100 TB or 50,000,000 objects. Buckets cannot be moved between projects afterwards, so pick the project and location before the first upload.

One storage tier, no archive class

Everything is stored at the same price and access speed. Cold data that would sit in S3 Glacier or B2 elsewhere costs the same as hot data here — simpler, but worth pricing before moving a multi-TB archive.

Object lock for ransomware-proof backups

Object lock must be switched on when the bucket is created and then offers legal hold plus governance and compliance retention modes, so a locked backup cannot be deleted or overwritten during its retention window.

Project-scoped S3 keys

A key pair generated under Security → S3 Credentials is valid for every bucket in that project by default. Per-bucket restriction is possible through S3 bucket policies, not through the key itself, and the secret is shown only once.

64 KB minimum billable object

Objects smaller than 64 KB are billed as 64 KB. Millions of tiny files — thumbnails, log lines, IoT records — cost more than their byte count suggests; bundle them before uploading.

Why connect Hetzner Object Storage to CloudsLinker

CloudsLinker connects to Hetzner Object Storage through its own Add Cloud tile: pick the location endpoint (hel1, fsn1 or nbg1.your-objectstorage.com), paste the project's Access Key and Secret Key, and the region is derived from the endpoint automatically. Objects above 100 MB are uploaded in 5 MB–5 GB parts, staying under Hetzner's 750 requests-per-second bucket limit. Copy buckets in from AWS S3, Backblaze B2, Wasabi or Cloudflare R2, out to Google Drive, OneDrive or SharePoint for people who want folders, or mirror one Hetzner bucket to another location as a substitute for the replication Hetzner does not offer.

What you can do with Hetzner Object Storage on CloudsLinker

In and out of Hetzner over the S3 API

Copy a bucket from AWS S3, Backblaze B2, Wasabi or Cloudflare R2 into fsn1, nbg1 or hel1, or the reverse. The copy runs server-to-server; nothing routes through your machine and no egress leaves your home connection.

Fills the replication gap between locations

Hetzner offers no built-in cross-location replication. Connect two Hetzner buckets — one in Falkenstein, one in Helsinki — and schedule a nightly copy to keep an independent second copy inside the EU.

Scheduled, incremental bucket sync

Hourly, daily or weekly jobs copy only new or changed objects, so a 1 TB archive that grows by a few gigabytes a day stays inside Hetzner's included egress quota on the source side.

Prefix, size and date filters

Sync just backups/2026/, skip objects larger than 10 GB, or copy only files modified in the last 30 days — the same filters work whether the other side is S3, B2 or Google Drive.

Common Hetzner Object Storage transfer scenarios

Move an AWS S3 archive to Hetzner and stop paying egress twice

Reading a 5 TB archive out of AWS costs roughly $0.09 per GB, or about $450 one time; keeping it there costs $0.023 per GB-month. CloudsLinker copies the bucket into fsn1 with multipart upload and delta sync, after which serving the data from Hetzner uses the included 1 TB of monthly egress before any per-TB overage applies. Run the initial copy once, then a weekly incremental job until the AWS bucket can be emptied.

Second copy for Hetzner Cloud server backups (3-2-1)

Hetzner Object Storage is the natural first backup target for Hetzner Cloud servers because traffic inside the eu-central zone is free. A backup that lives in the same provider is still one provider. Schedule a nightly CloudsLinker copy from the Hetzner bucket to Backblaze B2 ($6 per TB-month) or Wasabi ($6.99 per TB-month) for an independent third copy outside Hetzner's blast radius.

Replicate between Falkenstein and Helsinki without built-in replication

Hetzner does not replicate buckets across locations. Connect one bucket in fsn1 and one in hel1 as two CloudsLinker connections and run a scheduled copy between them. Both sides sit inside the free eu-central traffic zone for Hetzner-to-Hetzner transfer, and object lock can be enabled on the destination bucket at creation so the replica is immutable.

Export Google Drive or OneDrive to an S3 bucket in Germany

Agencies and law firms that must keep client files under EU jurisdiction can drain a Google Drive or OneDrive tenant into a Hetzner bucket with versioning and lifecycle expiry switched on. CloudsLinker rebuilds the folder tree as object prefixes; a 200 GB drive fits comfortably inside the included 1 TB and costs nothing in ingress.

Consolidate Wasabi, R2 and MinIO buckets into one EU account

A team that grew buckets across Wasabi, Cloudflare R2 and a self-hosted MinIO can copy them all into a single Hetzner project — up to 100 buckets — with one credential set per project. Copy in phases, one bucket per task, and check the 50-million-object ceiling before merging very large photo or log buckets.

How to connect Hetzner Object Storage to CloudsLinker

Hetzner Object Storage uses S3 access keys — an Access Key and a Secret Key generated per project in Hetzner Console — plus the endpoint of the location where the bucket lives. There is no OAuth.

Before you start

Create the bucket in the right location. In Hetzner Console open the project, choose Object Storage → Create Bucket, and pick Falkenstein (fsn1), Nuremberg (nbg1) or Helsinki (hel1). Buckets cannot be moved between projects or locations later. Enable object lock now if the bucket will hold immutable backups — it cannot be switched on afterwards.
Generate S3 credentials. Go to Security in the left menu, open the S3 Credentials tab and click Generate credentials. Add a description such as cloudslinker, then copy the Access Key and Secret Key — Hetzner shows the secret only once. Generate a dedicated pair for CloudsLinker instead of reusing the one your backup software holds.
Optionally restrict the key. Keys are valid for every bucket in the project by default. To limit CloudsLinker to one bucket, add an S3 bucket policy that allow-lists that access key; Hetzner documents both deny-all-then-allow and allow-list patterns.

Connection steps

In CloudsLinker, click Add Cloud and select Hetzner Object Storage.
Enter a display name, then paste the Access Key and Secret Key from the console.
Pick the Endpoint from the list — fsn1.your-objectstorage.com, nbg1.your-objectstorage.com or hel1.your-objectstorage.com. The region is derived from the endpoint automatically; you do not type it.
Leave Bucket empty unless the key is restricted by a bucket policy to a single bucket, in which case enter that bucket name so CloudsLinker can skip the ListBuckets call.
Click Confirm. CloudsLinker lists the buckets available to the key and shows the connection as ready. Add a second connection for another location if you plan to copy between Hetzner buckets.

To revoke access later: Hetzner Console → Security → S3 Credentials → delete the key pair, or remove the connection from the CloudsLinker dashboard.

Hetzner Object Storage upload & download limits you should know

Hetzner publishes hard quotas rather than throttling silently, so a migration plan can be checked against them in advance:

Maximum object size: 5 TB. Single PUT up to 5 GB; larger objects require multipart upload with parts up to 5 GB and at most 10,000 parts per object.
Per-object metadata: 8 KB.
Per bucket: 100 TB and 50,000,000 objects. Up to 100 buckets per account; buckets cannot be moved between projects or locations.
S3 credentials: up to 200 key pairs across all projects; each pair is project-scoped.
Rate limits: 750 requests/s per bucket and 750 requests/s per source IP; 256 concurrent TCP sessions per source IP; 10 Gbit/s per bucket.
Included quota: 1 TB storage (744 TB-hours) and 1 TB egress per month, billed hourly while at least one bucket exists and capped at the monthly base price; unused quota does not carry over.
Free traffic: ingress, S3 API calls, and traffic within the eu-central network zone. Egress beyond the bundle is billed per TB; storage beyond it per TB-hour, both in 100 MB increments and excluding VAT.
Minimum billable object size: 64 KB.
Bucket names: 3–63 characters, lowercase letters, digits and hyphens, globally unique, not formatted like an IP address.
Storage classes: one tier only — no infrequent-access or archive class; no built-in cross-location replication.
Versioning, lifecycle expiry and object lock (governance and compliance modes, enabled at bucket creation) are available; deleted objects are not kept in a trash unless versioning is on.
Price figure: the live base price is shown on Hetzner’s pricing page and depends on your currency setting; independent comparisons in August 2026 list €6.49/month after an April 2026 adjustment (launch price €4.99). Verify on the pricing page before budgeting.

Sources: Hetzner Object Storage overview and quotas, Buckets & objects FAQ, Generating S3 keys, S3 credentials FAQ, Hetzner Object Storage pricing and billing FAQ, rclone S3 backend — Hetzner, bex.co object-storage price comparison, 2026-08-17. Checked September 2026.

Hetzner Object Storage + CloudsLinker — Frequently Asked Questions

Where is my data physically stored, and is Hetzner Object Storage GDPR-compliant?

In Hetzner's own data centres in Falkenstein or Nuremberg (Germany) or Helsinki (Finland), depending on the location you choose per bucket. Hetzner Online is headquartered in Germany and states GDPR compliance for the service; there are no non-EU locations, so data never leaves the EU unless you copy it out.

What is the largest object I can transfer into Hetzner Object Storage?

5 TB per object. A single PUT is limited to 5 GB, so anything larger goes through multipart upload with parts of up to 5 GB and at most 10,000 parts per object. CloudsLinker switches to multipart automatically for objects above 100 MB, well below the threshold.

What is included in the base price, and what costs extra?

The base bundle includes 1 TB of storage (744 TB-hours) and 1 TB of egress per month; ingress, S3 API calls and traffic within the eu-central network zone are free. Storage or egress beyond the bundle is billed pay-as-you-go per TB-hour and per TB, rounded in 100 MB steps, and objects under 64 KB are billed as 64 KB. Hetzner publishes the current base price on its pricing page; third-party comparisons in August 2026 list it at €6.49 per month after an adjustment in April 2026, up from the €4.99 launch price.

Are there rate limits that affect large migrations?

Yes: 750 requests per second per bucket and per source IP, 256 concurrent TCP sessions per source IP, and 10 Gbit/s throughput per bucket. CloudsLinker paces parallel part uploads under these ceilings; if you also run rclone or backup software against the same bucket at the same time, expect throttling rather than errors.

Can I move a bucket to another location or project later?

No. Hetzner does not move buckets between projects or locations. The practical route is a CloudsLinker copy from the old bucket to a new one created in the target location, followed by deletion of the source — which also lets you enable object lock or versioning on the new bucket at creation time.

Does CloudsLinker preserve metadata, versions and object lock?

User metadata (x-amz-meta-*, up to Hetzner's 8 KB per object) and content headers are copied. Only the current version of each object is copied by default; enable the include-versions option to migrate history. Object lock is a bucket property on the destination — enable it when creating the Hetzner bucket, then copies into it inherit the retention rules.

How do I create S3 credentials, and can I limit a key to one bucket?

In Hetzner Console open your project, go to Security → S3 Credentials → Generate credentials, add a description and copy the access key and secret key — the secret is not shown again once the dialog closes. Keys are valid for every bucket in the project by default; to restrict CloudsLinker to one bucket, attach an S3 bucket policy that allow-lists that access key.

Can CloudsLinker copy between two Hetzner buckets?

Yes. Add each bucket's location as its own connection (the same project key pair works for both), then create a task from one to the other. Hetzner-to-Hetzner traffic stays inside the eu-central zone, which Hetzner lists as free, so this is the cheapest way to get the cross-location replica Hetzner does not provide natively.

How do I revoke CloudsLinker's access?

Delete the key pair under Security → S3 Credentials in Hetzner Console, or remove the connection from your CloudsLinker dashboard. Deleting the key invalidates every tool using it, so generate a dedicated pair for CloudsLinker rather than sharing the one your backup software uses.

Is CloudsLinker an official Hetzner integration?

No. CloudsLinker is a third-party service that talks to Hetzner Object Storage through its public S3 API with credentials you create and can revoke at any time. Hetzner neither endorses nor is affiliated with it.

Conclusion

Hetzner Object Storage gives European teams S3 at a flat bundle price with no egress surprise on the first terabyte, but no archive tier and no built-in replication. CloudsLinker supplies the missing movement: scheduled copies in from AWS, B2, Wasabi or Google Drive, out to a second provider for 3-2-1, or across Hetzner locations. Connect the bucket once and let the tasks run on their own.

Start Your Free Hetzner Object Storage Transfer