shouldiuse.io

VERDICT

Should I use OneSignal?

The world's leader for mobile push notifications, web push, SMS, email and in-app messaging. Trusted by 2 million+ businesses to send 12 billion+ messages per… - onesignal.com

Worth it. Buy if you run an app or website and want one platform for push, SMS, email, and in-app messaging without upfront cost. Skip it if raw Firebase Cloud Messaging, a simple web-push tool, or your email provider already covers you.

Confidence

Medium. Based on 30+ public sources; many review snippets were truncated, limiting depth.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo clear evidence either way
  • Security posture

Pricing

$0/mo

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid (Growth)from ~$9/mo

Best for

  • Mobile apps needing push at scale
  • Growth teams running multi-channel campaigns
  • Developers wanting fast SDK setup
  • Starters on a $0 budget

Not for

  • Tiny apps where plain FCM is enough
  • Teams wanting only email — use a dedicated email tool
  • Self-hosters who need full data control
  • Enterprise martech buyers needing Braze-level depth

Gotchas - check before you buy

high

WordPress plugin users must patch promptly; CVE-2026-3155 is an auth bypass

medium

Free plan terms have changed before; recheck current limits before committing

medium

Charges based on usage; costs grow with subscriber count

Pros and cons

Pros

  • 4.7/5 rating across ~1,176 G2 reviews
  • Free tier; paid plans start around $9/month
  • One platform: mobile push, web push, SMS, email, in-app
  • ISO 27001 and ISO 27701 security certified
  • Customers report fast setup

Cons

  • Some developers have migrated away to Pushwoosh
  • Others recommend plain FCM instead
  • WordPress plugin has repeated authorization-flaw CVEs
  • Usage-based billing complicates cost forecasting

Sources & method

Analyzed 9/25/2026 - 12 sources - Core platform holds ISO 27001/27701 certifications; its WordPress plugin has a history of CVEs, including a 2026 auth bypass (CVE-2026-3155).

official x4review x5security x2news x1
  • CVE-2026-3155: WordPress plugin auth bypass, Authorization flaw in the OneSignal Web Push Notifications WordPress plugin.
  • CVE-2025-13950: missing authorization, Allowed authenticated subscriber-level post meta deletion via post ID in the WordPress plugin.
  • XSS in WordPress plugin <=1.17.7, Cross-site scripting vulnerability in an older plugin version.

Key stats

  • Value for money: 4/5

    Rating

  • $0/mo

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 4/5. Real free tier; usage costs climb at scale
  • Ease of use: 4/5. Reviewers call it easiest way into push
  • Feature depth: 4/5. Push, SMS, email, in-app in one platform
  • Support quality. No clear evidence either way
  • Security posture: 3/5. ISO certified, but plugin CVEs recur
  • 4.7/5 G2 rating ~1,176–1,231 reviews
  • $0/mo Starting price Paid plans from ~$9/mo
  • Yes Free tier Free plan with usage limits
  • $84M Total funding $50M Series C in 2022

Pricing

Free

$0/mo

  • All channels access
  • Usage limits apply

Paid (Growth)

from ~$9/mo

  • Higher limits
  • Scales with subscriber count

Security

Core platform holds ISO 27001/27701 certifications; its WordPress plugin has a history of CVEs, including a 2026 auth bypass (CVE-2026-3155).

  • CVE-2026-3155: WordPress plugin auth bypassAuthorization flaw in the OneSignal Web Push Notifications WordPress plugin.⁷
  • CVE-2025-13950: missing authorizationAllowed authenticated subscriber-level post meta deletion via post ID in the WordPress plugin.⁸
  • XSS in WordPress plugin <=1.17.7Cross-site scripting vulnerability in an older plugin version.

What users say

Most users rate OneSignal highly (4.7/5 on G2), though a vocal group of developers have left for Pushwoosh or raw FCM.

“Don't use OneSignal, use FCM”
Reddit, r/reactnative
“The best way to get into push notifications!”
YouTube review

Alternatives

Compare OneSignal with each alternative.

  • Firebase Cloud Messaging

    Free Google option many developers prefer

  • Pushwoosh

    Where some developers land after outgrowing OneSignal

    OneSignal vs Pushwoosh

  • Braze

    Enterprise-grade engagement at much higher cost

Companies that use it

  • LG
  • Kinsta11
  • THG (The Hut Group)
  • Sing Tao
  • InCrowd Sports
Full analysis

Based on 30+ public sources; many review snippets were truncated, limiting depth.

4.7/5 on G2. Generous free tier for push/SMS/email. Some devs leave for FCM or Pushwoosh; WordPress plugin has CVE history.

Methodology

Based on 30+ public sources; many review snippets were truncated, limiting depth.

Sources

  1. OneSignal Pricingonesignal.com
    official
  2. Companies Using OneSignal in 2026technologychecker.io
    review
  3. OneSignal Reviews on G2g2.com
    review
  4. OneSignal vs StatsGlitch vs PushAlert vs VWO Engagespotsaas.com
    review
  5. Why I moved from OneSignal to Pushwooshreddit.com
    review
  6. Has anyone here worked with Pushy or OneSignalreddit.com
    review
  7. CVE-2026-3155: OneSignal WordPress Auth Bypasssentinelone.com
    security
  8. CVE-2025-13950 - NIST NVDnvd.nist.gov
    security
  9. OneSignal Achieves ISO 27001 and ISO 27701onesignal.com
    official
  10. OneSignal lands $50M Series Ctechcrunch.com
    news
  11. Kinsta Case Studyonesignal.com
    official
  12. Usage & billing FAQdocumentation.onesignal.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.