Let's Encrypt revenue was USD 9,563,960 in 2024, and also USD 10,297,220

Quick answer (September 2026). The Internet Security Research Group, the non-profit that runs Let's Encrypt, reported total revenue of USD 9,563,960 in 2024, against USD 5,156,001 in 2023, USD 8,080,768 in 2022, USD 6,560,425 in 2021 and USD 5,724,044 in 2020. That is on the Form 990 basis. On the basis of its own audited financial statements the 2024 figure is USD 10,297,220, and the 2023 figure is USD 5,884,332. Both numbers are correct, they are 733,260 apart, and the choice between them changes the 2024 growth rate from 75.0% to 85.5%. The published series runs back to USD 100,400 in 2014, so 2024 revenue is 95 times its first reported year. Every figure here comes from ISRG's own filings and reports.

Now the part that is not anywhere else.

Let's Encrypt has issued certificates since 2015 and secures a large fraction of the web. Its parent files a full Form 990 every year and publishes an annual report every year. That is eleven tax filings and seven annual reports. As of September 8, 2026, the first page of Google results for the obvious queries carries no revenue figure later than a projection written in September 2016, and the aggregator that most sites read stops at 2023.

I read the 2023 and 2024 returns as filed XML, took 2014 to 2022 from the structured extraction of the earlier returns, pulled all seven annual reports, put the revenue line in one table, and then audited the arithmetic. The filings are clean. Every revenue and expense column in the 2023 and 2024 returns foots exactly to the printed total. Every year that appears twice, once as a current-year column and again as a prior-year comparative in the next filing, agrees with itself: 19 out of 19 checkable lines, to the dollar. Both five-year support tables foot exactly. All sixteen executive compensation rows foot exactly. That deserves saying before anything else, because it is the thing that makes everything below trustworthy.

What the exercise did surface is a revenue collapse and a record rebound that nobody has reported, one question with two correct answers, a funding base that got more concentrated as it grew, and a self-published report that mislabels itself on 31 pages.

ISRG revenue, 2014 to 2024

The Internet Security Research Group is a California public benefit corporation, recognised by the IRS as tax exempt under section 501(c)(3), employer identification number 46-3344200. It runs three programmes: Let's Encrypt, Divvi Up and Prossimo. It had 23 employees and no volunteers in 2024. Its financial statements are independently audited, and its 2019 annual report notes it has "received successful audits each year from an independent auditing firm".

All figures in US dollars. 2014 is a Form 990-EZ; 2015 onward are full Form 990 returns.

Two things stand out. Revenue fell 36.2% in 2023, from 8,080,768 to 5,156,001, while expenses rose to 7,807,889. That produced a deficit of 2,651,888, the only material loss in the organisation's history and roughly a third of a year's spending. Then 2024 came back to 9,563,960, an 85.5% increase and the highest revenue on record.

Neither year has been written about. The reason is mechanical, and it is worth understanding.

Why nobody has this number

Nearly every site that quotes a non-profit's revenue reads it from ProPublica's Nonprofit Explorer, which extracts figures from IRS filings into a structured database. ISRG's page there lists eleven filings. It carries extracted financial data for ten of them, 2014 through 2023. For the 2024 return it carries a link to the document and no extracted data at all.

So the aggregator layer stops at 2023, which is the collapse year. Anyone who looks up ISRG's revenue today finds either the worst year in its history presented as the current position, or nothing.

The 2024 return itself is not hidden. It was signed on July 7, 2025 and it is public. It just is not anywhere that reads easily: it exists as an XML document inside a 143 MB archive on the IRS bulk-download service, indexed only by an eighteen-digit object identifier. Getting the number out of it took a 143 MB download and a ZIP index lookup. That is the whole explanation for a two-year gap in the public record of an organisation that secures a large share of the web.

The question has two correct answers

Ask what ISRG's 2024 revenue was and there are two defensible numbers, both published by ISRG, in the same document.

Form 990 Schedule D exists to reconcile the tax return against the audited financial statements, and for 2024 it reads:

Both subtractions reconcile exactly, in both years. Generally accepted accounting principles recognise donated services and unrealised investment gains as revenue; the Form 990 does not. So ISRG's audited top line is 10,297,220 and its tax-return top line is 9,563,960, and the 733,260 difference is not an error in either.

This matters more than it sounds. On the audited basis 2024 revenue grew 75.0%; on the Form 990 basis it grew 85.5%. Same organisation, same year, same source document, a 10.5 percentage point spread depending on which line you read. The same is true of the loss: the 2023 deficit is 2,651,888 on the tax basis and 2,551,186 on the audited basis.

The audited figure is the one that ties to the balance sheet. Net assets went from 3,392,635 to 5,110,071 in 2024, a movement of 1,717,436, which is exactly the audited surplus and not the Form 990 surplus. I found that gap by checking whether the surplus explained the change in net assets, expected a residual, and found the filing had already reconciled it to the dollar.

If you want one number, use 9,563,960 and say it is the Form 990 figure. If you want the number that matches the audited accounts, use 10,297,220. The 2024 crossing of ten million dollars only happens on the second basis.

Where the money comes from, and how concentrated it got

ISRG has no earned revenue. Programme service revenue was zero in both 2023 and 2024. Contributions were 9,346,405 of the 9,563,960 total in 2024, with 121,550 of investment income and 96,005 of other revenue making up the rest.

Schedule A carries a five-year support table, which is the cleanest funding series ISRG publishes:

That table appears in both the 2023 and the 2024 filing, which between them publish the years 2019 through 2024. Four years, 2020 to 2023, are therefore printed twice in two separate documents. All four agree exactly.

The interesting line in Schedule A is the one nobody quotes. To count as publicly supported, a charity has to exclude the portion of any single donor's gifts that exceeds 2% of its total support. For ISRG that excluded amount over five years is 8,915,172, which is 25.6% of the 34,787,045 it received. Public support therefore comes out at 25,871,873 of 35,079,642 total support, or 73.75%.

The same 2024 filing prints the prior year's equivalent percentage at 79.12%. So ISRG's funding base became meaningfully more concentrated in 2024 even as it nearly doubled. The record year was substantially a large-donor year.

To be clear about what this is and is not: the threshold ISRG has to clear is 33.33%, and at 73.75% it clears it more than twice over. This is not a compliance problem and I am not presenting it as one. It is simply the answer to "who actually funds Let's Encrypt", and the answer moved.

The annual reports show the same drift in their own terms, and here the label changes matter as much as the numbers. The 2023 and 2024 reports split sponsorship into two tiers; the 2025 report merges them:

Percentages are ISRG's own, and every one is labelled on the source page as based on unaudited financials for January to October of that year, so they are ten-month figures and are not directly comparable to the twelve-month filings above. The 2023 and 2024 columns for the two sponsor tiers are ISRG's; the combined row is my addition.

Two observations. Sponsorship has fallen from 62% of funding to 40% in two years while individual contributions rose from 8% to 23%. And the 2025 report introduces a Divvi Up funding line at 9%, the first time any ISRG programme appears as a source of money rather than a use of it. Programme service revenue was zero in the 2024 filing, so if that 9% holds it will be a genuinely new line when the 2025 return is filed.

One arithmetic note, offered as an observation rather than a finding. The four funding percentages printed in the 2024 annual report sum to 97%. Four figures rounded to whole numbers can only lose two points to rounding, so the missing three points are not rounding. The equivalent charts in the 2023 and 2025 reports sum to exactly 100%. A category appears to be unlabelled on that one chart; I cannot tell which from the published page, and the underlying filing for that year foots exactly, so nothing in the audited record depends on it.

What the top search result actually says

Search for what Let's Encrypt costs and the first result is Let's Encrypt's own blog post from September 20, 2016, What It Costs to Run Let's Encrypt, by Josh Aas, ISRG's executive director. It is ten years old.

It deserves better than being dismissed as stale, because it turns out to be a good forecast. The post projects a 2017 operating requirement of 2.91 million dollars, broken down as staffing 2.06M, hardware and software 0.20M, hosting and auditing 0.30M, and legal and administrative 0.35M. That table foots exactly.

Actual 2017 expenses were 2,599,681. The forecast was 310,319 high, or 10.7% over what the organisation went on to spend. Revenue came in at 2,732,486, about 6.1% short of the 2.91M target, and because spending came in under budget the year still closed with a 132,805 surplus.

The same pattern holds the next time ISRG published a budget. Its 2019 annual report describes the organisation "operating on an annual budget of 3.6 million dollars". Actual 2019 expenses were 3,363,563, or 6.6% under.

So the ten-year-old answer at the top of the search results is not wrong. It is an accurate, slightly conservative 2017 projection by an organisation that has twice come in under its own budget. It is simply describing a year in which ISRG spent about a third of what it spends now.

What the money buys

Expenses barely moved between 2023 and 2024, from 7,807,889 to 7,925,896, a 1.5% increase across a year when revenue rose 85.5%. The composition moved a lot more.

Every itemised line in the return sums exactly to the printed total, in both years.

The headline here is that running a certificate authority for a large share of the web is a payroll problem, not an infrastructure problem. Cloud services, on-premise hosting and internet together came to 575,676 in 2024, which is 7.3% of total expenses. People, counting both staff and engineering contractors, came to 6,473,020, or 82%.

Staff costs rose 646,916 while headcount fell from 25 to 23, and contractor spend fell 549,714 over the same period. Total people cost was almost flat, up about 1.5%. That reads like work moving from contractors onto the permanent team, though the filing does not say so and I am not going to claim it does.

Two smaller notes. The internet line is 101,343 in both years, identical to the dollar, which is what a fixed-term transit or colocation contract looks like. And fundraising expense rose from 515,726 to 634,999, up 23.1%, which against contributions means the cost of raising a dollar fell from 10.1 cents to 6.8 cents. Programme spending held at 82.8% of the total, against 82.6% the year before.

Josh Aas received total compensation of 397,706 in 2024, down from 430,689 in 2023. The eight individuals listed on Schedule J received 1,834,512 between them, down from 1,960,248.

Where Prossimo went

ISRG's annual reports publish something the tax filing does not: how spending splits across the three programmes. The filing gives only a single total programme-service expense figure.

Again these are ISRG's own unaudited January to October percentages.

Prossimo, the memory-safety programme that funds Rust work on critical infrastructure, has gone from roughly a quarter of programme spending to under 7% in two years. Let's Encrypt and Divvi Up absorbed the difference. The 2023 report describes Prossimo picking up 1.5 million dollars from the Sovereign Tech Fund and 530,000 dollars from the OpenSSF Alpha-Omega project; the share decline since suggests that grant-funded burst has run down. The reports do not explain the reallocation, so that is an inference from the percentages and not something ISRG has stated.

Which Let's Encrypt are you actually asking about

There is one number I am not going to give you, and the reason is the honest part of this piece.

People search for "Let's Encrypt revenue", but Let's Encrypt is a programme, not a legal entity. The entity is ISRG, and it runs three programmes. Every dollar figure above is ISRG-wide.

Can Let's Encrypt's own revenue be derived? No. The Form 990 does not break out revenue by programme, and Part III reports only a combined programme-service expense total. The annual reports split expenses by programme but not income, and they do it on an unaudited ten-month basis. Multiplying ISRG's revenue by the Let's Encrypt expense share would produce a number that looks precise and means nothing, because funders give to specific programmes and grants are frequently earmarked, which is exactly why Prossimo's share swings by 17 points in two years.

For 2017 the distinction did not exist: Divvi Up and Prossimo came later, so the 2016 post's 2.91M projection and the 2017 filing describe the same thing. For 2024 they do not. If someone quotes you a Let's Encrypt-specific revenue figure for 2024, ask which document it came from.

One other exclusion. The contributions series above comes from Schedule A of the filings themselves. The aggregator-visible contributions field disagrees with it for 2019 and 2020; I have used the filings and I am not going to reconcile the difference, because the filings are primary and internally consistent across two documents and the aggregator field is not.

A note on the 2025 report

While checking the annual reports I found something small and verifiable. The 2025 ISRG Annual Report carries a page footer reading "2024 ANNUAL REPORT" on 31 of its 39 pages. The other eight pages carry no footer at all, so every footer-bearing page in the document names the wrong year. The 2024 report is clean: all of its footers say 2024.

It is a template artefact, not a financial error, and it changes nothing in the numbers. But it is the kind of thing that tells you a document was produced from last year's file, so it is worth knowing before you cite a page number from it.

Method

Every figure comes from one of three primary sources.

Form 990 returns for tax years 2014 through 2023 came from ProPublica's Nonprofit Explorer structured data. The 2024 return, which has no structured record there, came from the IRS bulk XML download service: object identifier 202501889349300640, in the archive 2025_TEOS_XML_07A.zip, signed July 7, 2025. The 2023 return XML came from the same service, object identifier 202441919349301679, signed July 9, 2024. Reading the XML directly rather than the PDF means the figures are the filed values, not the output of a text extractor.

The seven annual reports, 2019 through 2025, came from ISRG's own annual reports page. All seven downloaded successfully. Chart percentages were read positionally, pairing each figure with the label directly beneath it by horizontal coordinate rather than by reading order, because the reading order in these PDFs interleaves two separate charts and produces wrong pairings. The 2025 report is where the footer labels were checked.

The 2016 blog post was read in full from letsencrypt.org.

Three audits were run. Every revenue and expense component in the 2023 and 2024 returns was summed against its printed total: all foot. Every line printed twice across the two filings, as a current-year figure and again as a prior-year comparative, was compared: twelve Part I lines, three balance-sheet carry-forwards and four Schedule A years, 19 of 19 agree to the dollar. Both Schedule D reconciliations were recomputed from their components: both foot. Where a filing prints a subtotal, that subtotal was checked; where it does not, no check was possible and none is claimed.

Figures are as filed and are not inflation adjusted. No 2025 tax filing existed as of September 8, 2026. The two most recent returns were signed in July of the following year, in July 2024 and July 2025, so on that pattern a 2025 return would be expected around mid-2026; it had not appeared at the time of writing.

Related reading on OperatorBook: QGIS revenue and Blender revenue, two more open-source organisations that publish their own ledgers.