Hosting and deploy

What is Stripe, and how much does it charge?

Stripe processes online payments for websites and apps. What it does, its US card fees checked in November 2026, how it handles security, and mistakes to avoid.

Stripe is a payments platform that lets websites and apps accept cards, wallets and other payment methods, run subscriptions and send payouts. Its standard US online card fee, checked on 9 November 2026, is 2.9 percent plus 30 cents per successful charge, with 1.5 percent extra for international cards and 1 percent for currency conversion, and no monthly fee.

Published 9 November 2026 · Last updated 9 November 2026

By Michal Měřínský. Audit methodology.

What Stripe does

Accepts payments by card, Apple Pay, Google Pay, bank debits and local methods.
Hosts a ready-made checkout page, Stripe Checkout, or provides components to build your own.
Runs subscriptions and invoices through Stripe Billing.
Handles tax calculation, fraud screening and payouts to your bank.

Fees

Stripe's US pricing page on 9 November 2026 lists standard online card payments at 2.9 percent plus 30 cents per successful transaction, plus 1.5 percent for international cards and 1 percent where currency conversion is needed. There are no setup or monthly fees on standard pricing. Rates differ by country, so check the pricing page for the country your account is registered in.

How it keeps card data off your servers

With Stripe Checkout or Stripe Elements, card numbers go straight from the visitor's browser to Stripe. Your server never sees them, which greatly reduces your compliance burden under PCI DSS. Stripe is certified as a PCI Level 1 service provider.

Keys and webhooks

Publishable key, starting pk_: used in the browser, safe to expose.
Secret key, starting sk_: server only. It can create charges and refunds.
Restricted keys: secret keys limited to specific permissions. Prefer them for integrations.
Webhooks: Stripe calls your server when payments succeed or fail. Verify every webhook's signature with your signing secret before trusting it.

Never decide that a payment succeeded because the browser returned to a success page. Confirm it from a verified webhook or the API on your server.

Common setup mistakes

Test keys left in production, or live keys used in development.
A secret key in frontend code or a public repository.
Unverified webhooks, which let anyone fake a successful payment.
No handling for failed renewals, so subscriptions continue without payment.
Checkout pages loading scripts over HTTP or from untrusted sources.

What a scan can and cannot tell you

WebAuditOS checks the page-level conditions around payments: HTTPS everywhere, no mixed content, password fields only on HTTPS pages and a Content Security Policy that controls which scripts can run on checkout pages.

It cannot see your Stripe account, keys, webhooks or payment logic.

Pay attention to third-party scripts on pages that show payment forms. Each one runs in the same page as your checkout.

Short answers

How much does Stripe charge? In the US, 2.9 percent plus 30 cents per successful card charge on standard pricing.

Does Stripe have a monthly fee? Not on standard pricing.

Is Stripe safe? Yes. Card data goes directly to Stripe, which is PCI Level 1 certified.

Can I use Stripe without a backend? Payment Links and Checkout reduce backend work, but confirming payments safely needs server-side logic or webhooks.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

sec.forms.password-over-https - Password fields only on HTTPS pages
sec.mixed-content - No mixed content on HTTPS pages
sec.https.enabled - Site is served over HTTPS
sec.headers.csp - Content-Security-Policy header

Run a free audit See a full sample report See the whole check library