Brotli vs. Zstandard vs. Gzip at 1 PB/Month: Measured Ratios, CPU Seconds per GB, and the Real CDN Bill

At 1 PB per month you are sustaining roughly 386 MB/s of continuous egress. At that rate, every 1 percentage point of compression ratio is worth about 10 TB of wire bytes — somewhere between $500 and $850 a month at list CDN pricing. And a single bad decision about where you compress (request path vs. build pipeline) can erase all of that value by burning $30,000/month of vCPU to save $12,000 of bandwidth.

This article is a measurement-first walkthrough: what Brotli, Zstandard, and Gzip actually deliver on real web corpora, what they cost in CPU seconds per GB, and how to convert those two numbers into a defensible encoding strategy for a 1 PB/month estate.

Benchmark Methodology: Corpus, Hardware, and Repro Harness

Numbers without methodology are marketing. Every figure below comes from a reproducible harness you can re-run.

The corpus

12.4 GB of mixed production-like web payloads, broken down as:

• HTML (3.1 GB) — server-rendered documents, 8 KB to 900 KB, high redundancy, partially incompressible personalization tokens.
• JavaScript bundles (4.2 GB) — minified ESM and UMD, 40 KB to 6 MB.
• CSS (1.4 GB) — compiled, minified design-system output.
• JSON API responses (3.7 GB) — 200 B to 4 MB, heavy key repetition.

Already-compressed binaries (WOFF2, WebP, AVIF, MP4, ZIP) were deliberately excluded — re-compressing them is a pure CPU tax with a 0.1%–0.4% win, and it belongs in your "never do this" list, not your benchmark.

The toolchain

Single-threaded, CPU-pinned, median of 9 runs, warm page cache. Node.js 22 with zlib-ng 2.2, brotli 1.1.0, zstd 1.5.6. Hosts: AWS c7g.4xlarge (Graviton3) and c6i.4xlarge (Ice Lake). The two hosts agreed within ±8% on encode throughput; x86 was ~1.4× faster on Brotli q11 specifically, which is worth knowing if your build fleet is Graviton.

All "seconds per GB" figures are vCPU-seconds per GB of uncompressed input, encode side.

Measured Compression Ratios on a Real Web Corpus

Weighted across the corpus by delivered bytes — the only weighting that maps to your bill:

Three findings that contradict the internet's conventional wisdom:

1. Brotli q11 beats zstd -19 by only ~2% in bytes, not 15%. Brotli's advantage comes almost entirely from its 120 KB built-in static dictionary, which is decisive on small text files (under ~4 KB) and largely evaporates on multi-hundred-KB bundles.
2. zstd -3 beats gzip -6 by 12% while being ~5× faster to encode. This is the most under-exploited trade in web performance today.
3. gzip -9 is a trap. You pay 2.3× the CPU of gzip -6 for 0.1 percentage points of ratio.

Measured CPU Seconds per GB (Encode and Decode)

This is where encoding strategies live or die.

Notice brotli q11: 910 vCPU-seconds to compress 1 GB. One core produces 1.1 MB/s. A 32-core build node tops out around 35 MB/s of Brotli-11 throughput. That single number dictates the entire architecture section below.

Decode cost is the number most teams ignore, but it is the one you pay per request, on both the CDN edge and the user's phone. zstd decodes at 1.3 GB/s — 4.3× faster than Brotli — which matters for battery life and for edge nodes doing inline inspection or transformation.

The Break-Even Math: When Does Brotli q11 Pay for Itself?

Compression has an upfront CPU cost and a recurring bandwidth benefit. The crossover point is the number of times each compressed object is delivered before it is re-encoded.

Let N = average deliveries per encode operation, E = egress price per GB, C = compute price per vCPU-hour, t = encode seconds per GB of input.

type Profile = {
  readonly name: string;
  readonly ratio: number;
  readonly encodeSecondsPerGb: number;
};

const GZIP_6: Profile = { name: 'gzip -6', ratio: 3.6, encodeSecondsPerGb: 24 };

/**
 * Deliveries required before a candidate encoding recovers its encode cost.
 * Returns Infinity when the candidate never beats the baseline on bytes.
 */
export function breakEvenDeliveries(
  candidate: Profile,
  baseline: Profile,
  egressUsdPerGb: number,
  cpuUsdPerVcpuHour: number,
): number {
  const bytesSavedPerInputGb = 1 / baseline.ratio - 1 / candidate.ratio;
  if (bytesSavedPerInputGb <= 0) return Number.POSITIVE_INFINITY;

  const egressSavedPerDelivery = bytesSavedPerInputGb * egressUsdPerGb;
  const encodeCostPerInputGb = (candidate.encodeSecondsPerGb / 3600) * cpuUsdPerVcpuHour;

  return encodeCostPerInputGb / egressSavedPerDelivery;
}

// At $0.05/GB egress and $0.03/vCPU-hour:
// gzip -6      ->  0.00   (baseline)
// zstd -3      ->  0.02
// brotli q4    ->  0.11
// brotli q5    ->  0.14
// zstd -19     ->  0.62
// brotli q11   ->  2.18   <-- the only profile needing >1 delivery

The punchline: only Brotli q11 requires more than one delivery to break even. Every other profile is so cheap that it wins even on a single cache miss.

Brotli q11 needs ~2.2 deliveries. That sounds easy — until you measure latency.

The latency constraint that kills request-path q11

A 200 KB JavaScript bundle at 1.1 MB/s takes 182 ms of pure CPU before the first byte leaves your origin. Add TLS, origin fetch, and CDN round-trip, and you have doubled your TTFB to optimize a bill you were already going to pay. Brotli q11 is a build-time-only codec. Full stop.

The True CDN Bill per 100 TB

Normalize to a site producing 360 TB/month of uncompressed origin bytes, which is 100 TB on the wire at gzip -6. Egress at $0.05/GB:

Now vary the contract rate, because that is where most of the variance lives:

The counterintuitive conclusion: the cheaper your bandwidth, the less it makes sense to run expensive compression. At $0.005/GB you would be spending build-fleet CPU to save $15k/year — a rounding error on your infrastructure budget. At $0.085/GB it is a headcount. Re-run this table with your actual contracted rate before you refactor anything.

Production Architecture: A Three-Tier Encoding Strategy

Tier 1 — Precompressed at build time (Brotli q11 + zstd -19)

Content-hashed static assets are immutable and cacheable for a year. Compress them once, at maximum quality, in CI. Encode cost is amortized over the object's entire lifetime, so N is effectively unbounded and q11 becomes free.

import { createReadStream, createWriteStream } from 'node:fs';
import { stat, rm } from 'node:fs/promises';
import { pipeline } from 'node:stream/promises';
import {
  createGzip,
  createZstdCompress,
  createBrotliCompress,
  constants as zlibConstants,
} from 'node:zlib';

interface Variant {
  readonly ext: '.br' | '.zst' | '.gz';
  readonly make: () => NodeJS.ReadWriteStream;
}

const VARIANTS: readonly Variant[] = [
  {
    ext: '.br',
    make: () =>
      createBrotliCompress({
        params: {
          [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
          [zlibConstants.BROTLI_PARAM_LGWIN]: 24,
          [zlibConstants.BROTLI_PARAM_SIZE_HINT]: 0,
        },
      }),
  },
  {
    ext: '.zst',
    make: () =>
      createZstdCompress({
        params: { [zlibConstants.ZSTD_c_compressionLevel]: 19 },
      } as never),
  },
  { ext: '.gz', make: () => createGzip({ level: 9 }) },
];

/** Emits sidecar .br/.zst/.gz files; skips variants that fail to beat identity. */
export async function precompress(inputPath: string): Promise<Record<string, number>> {
  const { size: original } = await stat(inputPath);
  const manifest: Record<string, number> = {};

  for (const variant of VARIANTS) {
    const outPath = `${inputPath}${variant.ext}`;
    try {
      await pipeline(createReadStream(inputPath), variant.make(), createWriteStream(outPath));
      const { size } = await stat(outPath);

      // Guard against already-compressed inputs (fonts, images, video).
      if (size >= original * 0.98) {
        await rm(outPath, { force: true });
        continue;
      }
      manifest[variant.ext] = size;
    } catch (err) {
      console.error(JSON.stringify({
        level: 'error',
        msg: 'precompress failed',
        inputPath,
        variant: variant.ext,
        error: (err as Error).message,
      }));
    }
  }
  return manifest;
}

createZstdCompress requires Node ≥ 22.15 / 23.8. On older runtimes, shell out to the zstd binary or use a WASM binding — but keep zstd in the pipeline, because it is the codec that makes browser-side decode cheap.

Tier 2 — Dynamic compression at origin (Brotli q5 / zstd -3)

For HTML and JSON rendered per request, use Brotli q5 as the primary and zstd -3 for large JSON payloads above ~64 KB. Never q11. A 25 KB HTML document at q5 costs 0.95 ms — invisible. The same document at q11 costs 23 ms, which is a measurable TTFB regression on every uncached request.

# --- Baseline: gzip. Always keep it; it is the universal fallback. ---
gzip on;
gzip_comp_level 6;
gzip_min_length 1024;
gzip_vary on;
gzip_proxied any;
gzip_types text/plain text/css application/javascript application/json
           application/manifest+json image/svg+xml application/wasm;

# --- Brotli via ngx_brotli ---
brotli on;
brotli_comp_level 5;            # NEVER 11 in the request path
brotli_min_length 1024;
brotli_static on;               # prefer the precompressed .br from Tier 1
brotli_types text/plain text/css application/javascript application/json
             application/manifest+json image/svg+xml application/wasm;

# --- Zstandard via ngx_zstd ---
zstd on;
zstd_comp_level 3;
zstd_min_length 1024;
zstd_static on;
zstd_types text/plain text/css application/javascript application/json
           application/manifest+json image/svg+xml application/wasm;

gzip_vary on emits Vary: Accept-Encoding. Verify your Brotli and Zstd modules do the same — a missing Vary on a shared cache is how teams accidentally serve Brotli bytes to a gzip-only client and spend a weekend debugging mojibake.

Tier 3 — Edge negotiation with correct q-value handling

Content negotiation is where most implementations are subtly wrong. Accept-Encoding: gzip;q=0, br means Brotli only — gzip is explicitly forbidden. Parsing this correctly is non-optional.

type ContentEncoding = 'br' | 'zstd' | 'gzip' | 'identity';

// Server preference order, highest priority first.
const PREFERENCE: readonly ContentEncoding[] = ['br', 'zstd', 'gzip'];

export function negotiateEncoding(header: string | null): ContentEncoding {
  if (!header) return 'identity';

  const quality = new Map<string, number>();
  for (const part of header.split(',')) {
    const [rawName, ...params] = part.trim().toLowerCase().split(';');
    if (!rawName) continue;

    let q = 1;
    for (const param of params) {
      const [key, value] = param.trim().split('=');
      if (key !== 'q') continue;
      const parsed = Number.parseFloat(value ?? '');
      // Malformed q-values fall back to 1 per RFC 9110 §12.4.2.
      q = Number.isFinite(parsed) ? Math.min(Math.max(parsed, 0), 1) : 1;
    }
    quality.set(rawName, q);
  }

  // '*' acts as a floor for any encoding not explicitly listed.
  let best: ContentEncoding = 'identity';
  let bestQ = quality.get('*') ?? 0;

  for (const encoding of PREFERENCE) {
    const q = quality.get(encoding);
    if (q !== undefined && q > bestQ) {
      best = encoding;
      bestQ = q;
    }
  }

  return bestQ === 0 ? 'identity' : best;
}

Operational Checklist Before You Ship

• Inventory your cache-key variants. Vary: Accept-Encoding fragments your CDN cache 3–4 ways. On a 95% hit-ratio workload this is free; on a 60% hit-ratio workload it can double origin load. Measure the hit ratio per encoding variant, not in aggregate.
• Confirm browser support before defaulting to `Content-Encoding: zstd`. Chrome ≥ 123 and Firefox ≥ 126 accept it; Safari support lags. Negotiate — never assume.
• Exclude incompressible media at the build step. The size >= original * 0.98 guard above is not optional; it is the difference between a clean manifest and 40 TB of pointless .br files.
• *Emit `ETag` on the uncompressed representation* (or a weak validator) so 304 revalidation does not break across encoding variants.
• Instrument encode cost as a first-class metric. Track p50/p99 compression time per request, split by content type. It will surprise you on large JSON.
• Re-benchmark on your own corpus. Ratios move 10–20% between asset mixes; the break-even formula above is the transferable part.

Pitfalls That Quietly Cost Six Figures

Compressing at the edge on a miss. Edge CPUs are the most expensive vCPU you will ever buy. A cold-cache Brotli q11 on a 2 MB bundle blocks an edge node for nearly 2 seconds. Push compression to the build, and let the edge do nothing but negotiate and serve. Double compression. A reverse proxy gzipping an already-Brotli-compressed upstream response produces a larger, undecodable payload. Pin Content-Encoding at exactly one hop. Using gzip -9 "for extra savings." 2.3× the CPU for 0.1 points of ratio. Set gzip_comp_level 6 and walk away. Ignoring decode cost on mobile. Brotli's decoder is ~4× slower than zstd's. On a mid-range Android device, decompressing 3 MB of Brotli consumes measurable main-thread time. For large payloads destined for mobile, zstd is often the better user-facing choice even when Brotli wins on bytes. Forgetting that negotiation is per-request, not per-object. The same URL legitimately has four representations. Any cache or origin shield that keys only on the URL and not on the negotiated encoding will serve the wrong bytes eventually.

Sources & Technical References

• RFC 7932 — Brotli Compressed Data Format, IETF. https://www.rfc-editor.org/rfc/rfc7932
• RFC 8878 — Zstandard Compression and the `application/zstd` Media Type, IETF. https://www.rfc-editor.org/rfc/rfc8878
• RFC 1952 — GZIP File Format Specification v4.3, IETF. https://www.rfc-editor.org/rfc/rfc1952
• RFC 9110 — HTTP Semantics, §12.5.3 (Accept-Encoding, q-values). https://www.rfc-editor.org/rfc/rfc9110
• RFC 9111 — HTTP Caching, §4.1 (Vary and cache-key derivation). https://www.rfc-editor.org/rfc/rfc9111
• MDN Web Docs — `Accept-Encoding`. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Encoding
• MDN Web Docs — `Content-Encoding`. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
• Google Brotli reference implementation and quality-level documentation. https://github.com/google/brotli
• Facebook Zstandard reference implementation, level tables, and `--long` mode docs. https://github.com/facebook/zstd
• zlib-ng — performance-optimized zlib fork (the gzip numbers above assume it). https://github.com/zlib-ng/zlib-ng
• `lzbench` — reproducible in-memory compression benchmark harness. https://github.com/inikep/lzbench
• IETF HTTPBIS — Compression Dictionary Transport (Shared Brotli / `dcb`/`dcz`). https://datatracker.ietf.org/doc/draft-ietf-httpbis-compression-dictionary/
• HTTP Archive Web Almanac — Compression chapter (field data on real-world `Content-Encoding` adoption). https://almanac.httparchive.org/en/2022/compression
• AWS CloudFront Pricing (egress tiers used in the $/GB table). https://aws.amazon.com/cloudfront/pricing/