Base44 is the builder for people who don't want to know what a database is. You describe an app, and it comes back with a React frontend, a hosted database, user login and backend functions, all on Base44's own platform. That's the selling point. It's also the catch, because the backend that makes it easy is the part you can't take with you. Wix bought Base44 in June 2025, and a month later Wiz Research disclosed a bug that let anyone sign up to a "private" Base44 app. This review covers what changed since, what it costs, and what leaving looks like.
TL;DR
Base44 builds and hosts a full app (React frontend, database, auth, Deno backend functions) from a prompt, and every plan now includes a security scan plus row-level and field-level security rules. The exit is half real: GitHub sync exports your frontend source on Builder and above, but the backend runs on Base44's SDK and data leaves as CSV. The weak spot is credits: Trustpilot sits at 2.8 out of 5, and the most common complaint is credits burned while the AI loops on the same bug. Our rating: 3.1 out of 5.
Our Verdict
Use with Caution| What we scored | Score | Why |
|---|---|---|
| Speed to a working app | 4/5 | Database, auth and hosting come built in, so a non-coder gets a working app with logins fast |
| Code ownership and exit | 2/5 | GitHub sync on Builder+ exports the frontend. The backend depends on @base44/sdk with no documented self-host, and data exports one CSV per table |
| Pricing predictability | 2/5 | Two credit pools per plan. Fix loops drain message credits, and some models cost more integration credits than others |
| Security defaults | 4/5 | Free security scan on every plan, RLS and field-level security on entities, private apps on paid plans. The 2025 auth bypass was fixed fast |
| Overall | 3.1/5 |
What's Good
- A security scan on every plan, including free, that checks data permissions, exposed secrets, dependencies and backend functions anyone can call
- Row-level and field-level security on every entity, with permissions set up as you build
- Login, database and hosting are built in, so there's no Supabase or Firebase project to wire up
- Two-way GitHub sync for the frontend source on Builder and above
- SOC 2 Type II and ISO 27001 certifications, per Base44's security docs
What to Watch
- The backend is Base44's: functions import
@base44/sdk, and we found no documented way to run it anywhere else - Data exports as CSV, one table at a time, and automatic backups are Elite and Enterprise only
- Credit billing is the dominant Trustpilot complaint, often tied to the AI repeating a failed fix
- Apps that act like public sites are set to Public automatically
asServiceRolein a backend function bypasses every RLS and field rule you set
How we reviewed this. We worked from Base44's pricing page, its docs and product changelog, Wiz Research's July 2025 disclosure, Wix's acquisition announcement, Security Boulevard's report on the RedAccess study, and public reviews on Trustpilot, all read on 2026-10-12. We pair this review with our Is Base44 Safe? security analysis, which covers the audit steps in more depth. We haven't run a timed hands-on build for this page, so the speed score reflects documented features and user reports, not our stopwatch. Base44 didn't sponsor or review this page.
What Base44 Actually Builds
Per Base44's project structure docs, a Base44 app is "a standard React app built with Vite", with Tailwind configured. Behind it sits Base44's own backend: entities defined with JSON Schema (including a built-in User entity), auth, file storage, and backend functions that "run on Deno".
The frontend talks to all of that through the @base44/sdk package. That matters for two sections below. It's why you never touch a database console, and it's why leaving is harder than the marketing suggests.
Recent additions include in-app AI agents, a CLI with a local dev backend, an MCP server for your app, and a React Native/Expo quickstart. The changelog shows new models landing within days of release: Claude Opus 5.5 and two GPT 6 models on September 22, 2026.
Pricing and Credits
Here's what Base44's pricing page lists as of 2026-10-12, billed annually:
| Plan | Per month (annual) | Message credits | Integration credits | Notable |
|---|---|---|---|---|
| Free | $0 | 25 | 100 | Up to 5 apps, public apps only |
| Starter | $16 | 100 | 2,000 | Custom domain |
| Builder | $40 | 250 | 10,000 | Backend functions, GitHub sync, code scanning |
| Pro | $80 | 500 | 20,000 | |
| Elite | $160 | 1,200 | 50,000 | Adjustable credits, automatic backups |
The yearly toggle says it saves 20%, and the page lists paid plans "from $20/mo" month to month. Business and Enterprise sit above Elite. As of October 1, 2026, the changelog says new workspaces need one of those for workspace SSO, SSO for apps and data residency.
The plan price isn't what you'll actually feel. Message credits are spent each time you prompt the builder. Integration credits are spent when your running app calls AI models, sends email, or uses other built-in integrations. Integration credits don't all cost the same: the same changelog notes that Gemini 3.8 Flash "now uses twice as many integration credits" from September 22, 2026.
Fix loops are what blow the budget. The pattern in Base44's one-star Trustpilot reviews is consistent: the AI fails to fix a bug, tries again, and each attempt costs a message credit. One reviewer put it as "takes so many credits, and redoes issues 50 times and is still not fixed" (September 7, 2026). When a fix fails twice, stop prompting, read the error yourself, and give the builder the exact message and file instead of "it's still broken".
The 2025 Auth Bypass, and What Changed
In July 2025, Wiz Research disclosed that two undocumented Base44 endpoints, api/apps/{app_id}/auth/register and api/apps/{app_id}/auth/verify-otp, needed no authentication. Anyone with an app's app_id could register an account on a private app and verify it by one-time code, which also got around SSO-only apps. The app_id wasn't a secret either: it appears in app URLs and in each app's public manifest file.
The response was fast. Wiz reported it on July 9, 2025, a fix was verified on July 10, and Wix confirmed it resolved on July 13, before the July 29 publication. Base44 said it had "found no evidence that any customer was impacted".
The lesson that outlives the bug: on any builder, an identifier in your URL is not a password. Base44 fixed this at the platform level, but the same mistake shows up in app code constantly. If a page or API decides who you are from an ID in the request instead of the session, that's the first thing we'd test.
Security: The Short Version
Our Is Base44 Safe? analysis walks through the audit. For a buying decision, here's what's built in, per Base44's security overview.
The good part. The security scan is "available on all plans, including the free plan". It checks data permissions, exposed secrets, dependencies, and backend functions set to "Anyone can run this function". Code vulnerability scanning starts at Builder, where you can also connect your own Wiz tenant. Entities support row-level and field-level security, and Base44 "automatically sets up data permissions as you build". Since October 4, 2026, pinning an app to your public profile requires a current scan.
The part that's yours. The same docs open with "You are responsible for your app's security settings." Three settings deserve a look before launch:
- "All Users" permissions. On an entity, that rule means "Anyone can perform this action, even without signing in." Check every entity that holds user data.
asServiceRole. A backend function that uses it "bypasses both RLS and FLS entirely". If the AI reached for it to make an error go away, your access rules no longer apply in that function.- Visibility. Apps that act like public sites are automatically set to Public, and private apps need a paid plan.
The RedAccess study reported in May 2026 found about 380,000 publicly accessible apps and other assets built on Lovable, Base44, Netlify and Replit, about 5,000 of them holding sensitive corporate data. The report doesn't break that down by platform, and Base44 and Lovable told Axios the researchers hadn't shared the URLs needed to verify the findings. Read it as a category warning, not a Base44 number.
Code Ownership and Leaving
Base44's pricing FAQ says "You own everything you build on Base44" and "Nothing is locked to the platform." That's true of the code. It isn't true of what the code runs on.
- Frontend code. Two-way GitHub sync exports the full source to your repo, on Builder and above. It syncs automatically; there's no manual push, and the default branch has to be
main. A zip export API exists but is labelled beta. - Backend. Entities, auth and functions run on Base44's platform, and the code reaches them through
@base44/sdk. The CLI can run a local Base44 backend for development, but we found no documented way to host the backend yourself. Leaving means rebuilding it on Supabase, Firebase or your own server. - Data. Exports come out as CSV, one table at a time. Automatic backups are Elite and Enterprise only, so on smaller plans an export is the only backup you've got.
What Users Say
Praised: how far a non-technical person gets without help. A September 2026 Trustpilot review calls it ideal "if you have no idea what you are doing!" A few reviewers say support resolved their issue quickly.
Complained about: credits above all. Base44's Trustpilot page shows 2.8 out of 5 from 908 reviews, split 34% five-star and 53% one-star. The one-star reviews cluster on credits spent on fix loops, charges after cancelling ("They keep billing after you cancel", September 18, 2026), refused refunds, and slow support. Base44 replies to about half of its negative reviews.
Who Base44 Is For
A good fit if you're non-technical, you want login and a database without setting up a separate backend, and you'll run the security scan and check entity permissions before real users arrive.
A poor fit if you need a predictable monthly bill, or you expect to outgrow the platform and want a backend you can move without a rebuild.
Base44 Alternatives
People most often weigh Base44 against Lovable, Replit, Bolt, and Emergent.
- Lovable and Bolt build on Supabase, so your database is a real Postgres project you control, at the cost of setting up its access rules yourself. See our Lovable review and Bolt.new review.
- Replit gives you a fuller IDE, separate dev and production databases, and standard Postgres you can
pg_dump. See our Replit review. - Emergent puts a FastAPI backend between the browser and the database. See our Emergent review.
Base44's edge in that field is how much it handles for you, security scan included. The trade is that the backend stays on Base44.
Is Base44 worth it?
It's worth it if you're non-technical and want a hosted app with a database, login and backend logic without wiring any of it together yourself, and you'll use the free security scan before launch. It's a worse deal if you need a predictable bill or a backend you can move elsewhere. Credits drain fastest when the AI loops on a bug, and that's the most common complaint on Trustpilot.
How much does Base44 cost?
Billed annually, Base44's pricing page lists Starter at $16 a month, Builder at $40, Pro at $80 and Elite at $160, plus a free plan with 25 message credits. Monthly billing costs more (Starter is $20). Backend functions and GitHub sync start at Builder, and credits are the real limit, so the plan price is a floor.
Can I export my code from Base44?
Partly. On Builder and above, two-way GitHub sync puts the full source in your own repo. But the app talks to Base44's backend through the @base44/sdk package, and we found no documented way to self-host that backend. Data comes out as CSV, one table at a time. You can take the React frontend with you; you can't take the backend.
Is Base44 safe for production apps?
Safer than its 2025 record suggests. Wiz found an auth bypass on private apps in July 2025 and Base44 fixed it within a day of the report. Today every plan gets a security scan that checks data permissions, exposed secrets and open backend functions, and entities support row-level and field-level security. Base44's own docs say you are responsible for your app's security settings, so run the scan and read its results before launch.
Who owns Base44?
Wix. It announced the acquisition on June 18, 2025, for about $80 million upfront plus earn-out payments through 2029.
Built something on Base44?
Scan the deployed URL for exposed keys, open files, missing headers, and TLS issues. No signup needed to see your first results.