MEGA Review

Plans & pricing

Prices last verified Nov 11, 2026

Free plan limits

20 GB free with limited transfer. Some Trustpilot reviewers say their free allowance was cut; MEGA replies that it depends on when the account was registered.

Free trial

No free trial

MEGA alternatives

7.8/10

Google Drive

File storage and sharing tied to Gmail, Docs and Photos, with 15 GB free

Freemium

7.4/10

Dropbox

Long-running cloud storage, strong on sync and large-file sharing

Freemium

Controversies & incidents

Issues documented by the press, regulators, courts or the vendor itself. Every item is sourced; unproven claims are labelled as allegations. Last researched: Nov 11, 2026

• Medium impactConfirmedSecurity · Jun 1, 2022

  ETH Zurich disclosed flaws in MEGA's encryption design (2022)

  In 2022 ETH Zurich researchers described five attacks on MEGA's encryption design. MEGA fixed two flaws and mitigated a third; the researchers say the underlying design issues remain.

  Read the full account

  Per BleepingComputer, the ETH Zurich team reported to MEGA on 24 March 2022 and described five attacks, each relying on a separate flaw; the prime-factor-guessing attack needs at least 512 login attempts and control of MEGA's servers. MEGA said it knew of no compromised accounts or data and traced the cause to "seemingly innocuous cryptographic design shortcuts" taken almost a decade earlier. It fixed two flaws (RSA key recovery and plaintext recovery) on all clients, mitigated a third, scheduled the other two for later updates, and said the fixes "aren't perfect countermeasures". Malwarebytes wrote that the patch blocks only the first attack and leaves key reuse and missing integrity checks, which the researchers still consider a concern, unaddressed. It also recalled MEGA's claim that it "couldn't decrypt your stored files, even if it wanted to".

  Vendor response

  MEGA said it knew of no exploitation, shipped fixes on all clients, and users did not need to change passwords or re-encrypt data (per BleepingComputer).

  Sources:BleepingComputer (2022-06-22)Malwarebytes (2022-06-22)

• Low impactConfirmedSecurity · Jul 1, 2018

  About 15,500 MEGA logins leaked through password reuse (2018)

  In 2018 ZDNet verified a file holding over 15,500 MEGA usernames, passwords and file listings. MEGA and researcher Troy Hunt attributed it to passwords reused from breaches of other sites, not a breach of MEGA's systems.

  Read the full account

  Per the Otago Daily Times and Security Affairs (July 2018), researcher Patrick Wardle found the file on VirusTotal and passed it to ZDNet, which contacted several users and confirmed the data was genuine. The file listings indicated that intruders had logged into some accounts, and some users reported suspicious logins from Eastern Europe, Russia and South America. Troy Hunt of Have I Been Pwned said about 98% of the email addresses had already appeared in earlier breaches. The case shows the limits of end-to-end encryption: it does not protect an account if someone has the right password.

  Vendor response

  MEGA chairman Stephen Hall said the file resulted from credential stuffing with logins leaked elsewhere, not a flaw in MEGA (per Security Affairs).

  Sources:Otago Daily Times (2018-07-18)Security Affairs (2018-07-19)

• Low impactConfirmedLawsuit · May 1, 2016

  NZ court ordered MEGA to hand over user details in a Kazakhstan case (2016)

  In 2016 New Zealand's High Court ordered MEGA to provide IP addresses, email addresses and account details of some users for Kazakhstan's civil case in New York. MEGA objected on privacy grounds and lost.

  Read the full account

  Kazakhstan sued 100 unnamed defendants in New York after stolen government documents were posted on MEGA. Per The Register (13 May 2016), the High Court in Auckland granted Kazakhstan's request and ordered MEGA to produce IP information and account details. Per RNZ (17 Aug 2016), MEGA tried to limit disclosure to one user but the court refused, authorising four pages on five users to be sent to the New York court. The case shows that end-to-end encryption protects file contents, but metadata such as IP and email addresses can still be compelled by a court.

  Vendor response

  MEGA chairman Stephen Hall said the company was "disappointed", was complying "under protest", and feared users could be traced through association with the material (per The Register, RNZ).

  Sources:The Register (2016-05-13)RNZ (2016-08-17)