Lovable vs Bolt vs Replit vs v0: AI app builders compared for 2026

Lovable vs Bolt is the closest contest among the AI app builders compared here, as of 18 October 2026. Both build full-stack web apps on a Postgres backend whose data can move to your own Supabase project, and both start at $25 a month. Lovable runs a security scan every time you publish and includes single sign-on on its $50 Business plan. Bolt also builds iOS and Android apps through Expo and can start from an existing GitHub repository.

Replit suits teams that want to build and host the app in one place, with separate development and production databases and native mobile builds. v0 writes Next.js apps that deploy to Vercel, and new apps that need a database get Neon Postgres by default. Base44, which Wix bought in June 2025,¹ runs its own backend, and you can export the code but not the database or sign-in system behind it. Google stopped new sign-ups for Firebase Studio on 22 June 2026 and shuts it down on 22 March 2027.

This post compares the five vibe coding tools on what each makes best, its default backend, pricing, code export, hosting, team features and security defaults. It sets the builders’ own security controls beside three security studies from 2026, then gives a rule for choosing one and a section on when a prototype needs engineers. 9io builds and hardens products for clients, so we have a stake in that last section. We haven’t run our own tests for this post, and every figure links to its source.

Lovable vs Bolt vs Replit vs v0 at a glance

The table summarises each vendor’s pricing page and documentation as of 18 October 2026, and the sections below give the sources. Base44 is included because Reeve’s security study covers it alongside the other four.

Firebase Studio isn’t in the table. Google announced its sunset on 19 March 2026, disabled new workspaces and sign-ups on 22 June, and will shut it down on 22 March 2027, when any data left in it is deleted.² Google points users to Google AI Studio for browser-based prototyping, which now has Cloud Firestore and Firebase Authentication built in, and to Google Antigravity for code-first work. Firestore, Firebase Authentication and App Hosting keep running.

What each builder makes best

Lovable builds web applications. Its FAQ says it doesn’t generate React Native projects, uses one stack for every project and offers no choice of framework or database. New projects have used TanStack Start, which renders pages on the server, since 13 May 2026, and older ones use React and Vite. Lovable’s own iOS and Android apps are for building from a phone.³

Bolt builds websites, web apps and mobile apps. Its docs say it supports JavaScript backends only, so PHP and Python backends won’t work.⁴ Mobile apps use Expo, which targets iPhone and Android from one codebase. Bolt’s guide says a web project doesn’t easily switch to mobile, so the first prompt should ask for a mobile app. Store releases happen outside Bolt, with Expo’s EAS command-line tool and paid Apple and Google developer accounts.⁵

Replit released Agent 4 on 11 March 2026.⁶ Agent builds web apps and native iOS and Android apps with Expo and React Native, and it streams an iOS simulator or Android emulator into the preview pane. A Launch feature builds, signs and uploads iPhone apps to App Store Connect, while publishing to Google Play isn’t supported yet.⁷ On Core and Pro, Agent also makes data visualisations, slide decks and animated videos.⁸

v0 defaults to Next.js and says Next.js gives its most reliable results, though it can use other frameworks. Its full-stack work runs through Next.js server actions and API routes.⁹ Its docs cover web apps, and its iOS app is for prompting v0 from a phone.¹⁰

Base44 builds web apps that people can add to a phone’s home screen. On Builder and above it generates the files for the App Store and Google Play, and the store app runs your published web app inside a native web view.¹¹

Default backends: Lovable Cloud, Bolt Database and the rest

Lovable Cloud is on by default for every workspace. Lovable enables it, or asks first, when a feature needs a backend, such as sign-in or file storage, and its docs say it uses Supabase’s open-source foundation for the database, authentication, storage, edge functions and realtime updates. New projects can use Cloud or connect your own Supabase project instead, and a project’s region can’t be changed once Cloud is enabled.¹² To leave, you export the database, which includes user accounts and password hashes, and restore it into Supabase. Storage files, Edge Function code and secrets move separately.¹³

Bolt Database is the default for new Bolt projects on every plan. Bolt creates one when a project needs it, with sign-in, file storage and server functions. On Pro and Teams you can pick Supabase when you create a project, or claim an existing Bolt database into your own Supabase account. Connecting Supabase to a project that already has a Bolt database replaces the connection and may lose data, so Bolt’s docs point to claiming instead.¹⁴

Replit gives every app a development database and creates a separate production database when you publish. Agent can change the development database but can’t modify the production one, and schema changes reach production when you publish. Development databases run on Replit’s own infrastructure, and production databases are billed through Neon.¹⁵ For sign-in, Agent adds Clerk by default on Starter, Core and Pro, and Replit Auth, where users sign in with Replit accounts, by default on Enterprise.¹⁶

v0 has no database of its own. Since 8 June 2026, new apps that need a database and sign-in are scaffolded with Neon, the Drizzle ORM and Better Auth.¹⁷ Databases come through the Vercel Marketplace, which also offers Supabase, Upstash and Vercel Blob. Adding one creates an account with that provider and sets the project’s environment variables.⁹

Base44 runs its own backend, which its docs describe as a NoSQL data layer with built-in authentication, access control and TypeScript functions.¹⁸ On Builder and above you can export the code and backend functions to GitHub or a ZIP file, and data collections export as CSV. The docs say the managed hosting, authentication system and database infrastructure can’t be exported.¹¹

Pricing and credits as of 18 October 2026

Each builder charges for AI work from a monthly allowance. Lovable and Replit also pay for hosting and databases from the same balance, and Base44 spends integration credits when a live app uses its AI or email services. Monthly US prices before tax, as of 18 October 2026:

Sources are each vendor’s pricing page and billing docs.^1920212223 Annual billing takes two months off Lovable, 20% off Base44 and up to 10% off Replit. Bolt’s pricing page says up to 28% and its billing docs say 10%.

Lovable charges by the work a message does. Its docs give illustrative costs of 0.50 credits to recolour a button, 1.20 to add sign-in and 2.00 for a landing page with generated images, and a Plan mode message costs 1 credit. Cloud hosting and AI features in the deployed app draw on the same balance after monthly grants of 20 and 4 credits.²⁴ Pro credits work out at $0.25 each and Business credits at $0.50, which Lovable says reflects Business’s extra features. Every plan allows unlimited workspace members, priced by credits instead of seats.¹⁹

Bolt counts tokens, and most of them go on syncing the project’s files to the model, so each message costs more as a project grows.²⁵ Extra tokens can be bought only on the top monthly Pro tier or an annual Pro plan, and they don’t expire. Hosting is included up to 10 GB of bandwidth and 333,333 requests a month on Free, where a site stops serving until the next cycle, and 30 GB and 1 million requests on Pro, with pay-as-you-go above that.²⁶

Replit bills Agent by effort. Each request ends in one checkpoint priced by how much work it took, and Replit asks before paid work starts. Core and Pro also get a Free Mode allowance for everyday work.²⁷ The same credits pay for publishing and databases. Since 1 August 2026, Autoscale deployments cost $0.60 per million compute units and $0.40 per million requests, and production database storage $0.35 per GiB a month.²⁸

v0 meters tokens at per-model rates, from $0.20 per million input tokens and $1.20 per million output tokens on v0 Mini to $5 and $25 on v0 Max, and chat history and project files count as input. Plus and Business add $2 of free credits a day for each user who logs in.²² The pricing page shows Plus at $30 with $90 struck through and gives no end date. Hosting runs on your Vercel plan, and Vercel’s free Hobby plan is for non-commercial, personal use only.²⁹

Base44 has two meters. Message credits pay for building, with no fixed cost per message. Integration credits pay when the live app uses Base44’s own services, such as email, LLM calls or in-app agents, which start at about 3 credits a message. Calls to outside services with your own API key don’t use them.³⁰

Code export, GitHub sync, hosting and teams

Every builder here can put your code in a Git repository, and they differ in what else you can take with you.

Sources are the vendors’ Git, database and plan documentation.^{311332143315834223511}

When both sides change at once, Bolt keeps its own version and overwrites GitHub’s, and merging branches happens on GitHub.³² v0 publishes by merging a pull request, so branch protection and required checks still apply.³⁴ Lovable syncs on every plan, including Free, though downloading code needs a paid plan.¹⁹

Lovable says its plans don’t cap visitors or bandwidth. The exception is Free, where apps created since 13 May 2026 are limited to 1,000 server requests per project every 10 seconds.³⁶ Replit offers Autoscale, Static, Reserved VM and Scheduled deployments on Google Cloud, hosted in the United States unless an Enterprise customer asks for the EU.³⁷ v0 deploys each working branch as a preview and publishes to production on Vercel, where custom domains are set up.³⁸ A Base44 app gets a free base44.app address, with custom domains from Starter.²³

Lovable is the only one of the five that includes single sign-on below an enterprise tier, on its $50 Business plan.¹⁹ A v0 team created when you already have a Vercel Hobby team needs Vercel Pro, which costs $20 a month and adds no v0 features.³⁹

Security defaults and what 2026 research found by platform

All five builders document security checks of their own, and they differ most in when those checks run.

Sources are each vendor’s security, database and privacy documentation.^{40414243444546} A Lovable workspace can block publishing on critical findings, which is on by default only for new Enterprise workspaces, and Replit has a matching setting.⁴⁰⁴³ Bolt’s database docs warn that before you ask for sign-in, Bolt might write policies that let any visitor read, add, change and delete data.⁴² Lovable’s docs say its scans don’t replace a thorough security review, and Replit’s say a clean scan doesn’t guarantee a secure app.

Reeve’s August study is the only one of the three that splits results by builder. Between 12 and 14 August 2026 it ran nine passive checks on 30,998 live apps and grouped those on each builder’s default publish domain.

Read the columns with Reeve’s caveats. “Any finding” is driven by missing security headers that the host sets for every app, and Reeve says most of what the table compares is platform defaults. One critical finding caps an app at grade D, so the D and F column is the closest proxy for a serious hole. Base44 sends database traffic through its own backend, where an outside check can’t follow, and Reeve says a blank says nothing about how safe those apps are. Apps on custom domains, often the more finished ones, aren’t in the table, and Bolt’s 77% rests on 35 apps.

The arXiv audit by Deng, Fan and Meng, revised on 14 September 2026, studied apps built with Claude Code or Lovable and none of the other builders. It found at least one vulnerability in 182 of 200 deployed apps. The authors analysed the two groups separately and report that the main findings held in both, without a rate for each. Broken access control was the largest class, with 339 of 1,186 vulnerabilities, and backend code held 52.7% of them.

UpGuard’s study, published in September and updated on 14 October 2026, deliberately looked beyond builders’ domains to include sites made with Claude Code and Codex. It found 16,326 Supabase databases with readable tables among about 300,000 domains showing signs of Supabase, and it doesn’t split them by builder. Its point applies to any tool here that creates Supabase tables. Supabase enables RLS for tables made in its dashboard’s Table Editor, and tables created through the API, the way coding agents work, don’t get it. Lovable and Bolt say they set up RLS on the tables they create, and Bolt’s docs ask you to check any table you add yourself.⁴⁰⁴²

How this comparison was put together

• Prices come from each vendor’s pricing page, checked against Internet Archive copies captured between 9 and 18 October 2026. The copies are from 9 October for Base44, 12 October for v0, 15 October for Lovable, 16 October for Bolt and 18 October for Replit. Lovable’s plan cards load in the browser and weren’t captured, so its prices come from the tier table in its docs, archived on 13 October.
• Features come from vendor documentation. Where a page could have changed after 18 October, we compared it with an archived copy from September or October, or with the page’s own last-updated date.
• Research comes from Reeve (19 August 2026), the arXiv preprint (version 4, 14 September 2026) and UpGuard. Reeve and UpGuard sell security products, so their figures are vendor-reported, and the arXiv paper is a preprint.
• Conflicts in vendors’ own pages: Bolt’s annual discount (28% or 10%), v0’s credit rollover (one month on the pricing page, 65 days in the docs) and Replit’s Autoscale base fee ($1 or $2 a month). We give both Bolt figures, use v0’s more detailed docs and leave Replit’s base fee out.
• Not covered: build tests of our own (we ran none), speed, output quality, enterprise contract terms, Google AI Studio and Antigravity, Bolt’s waitlist-only Lite plan and v0’s Premium plan, which is closed to new users.

Lovable vs Replit, Bolt vs v0: which one for which job

Then apply three rules, whichever builder wins:

1. Decide where the data will live in a year. If it has to be a database you control, plan the exit on day one. Lovable exports the database, Bolt lets Pro and Teams claim theirs into Supabase, v0’s databases sit in your own provider account, and Replit gives you a Postgres connection string. Base44 has no equivalent for its backend.
2. Connect GitHub on the first day. Every builder here supports it, and Base44 needs the Builder plan for it.
3. Price your busiest week of building. Bolt’s docs say token use per message grows with project size, and Lovable’s say larger changes cost more credits, so size the plan for the heaviest week.

When a prototype from any of them needs engineers

The builders produce working prototypes, and their own docs leave the last checks to you. Bring in engineers when the app reaches any of these points.

• Auth. The app needs roles, customer organisations, SSO for your customers or account recovery on your own domain. Start by checking which sign-in system the builder chose. On Replit, the default Clerk setup gives each app its own user accounts, while Replit Auth signs people in with their Replit accounts.¹⁶
• Data access. Any table holding personal data needs its access rules tested from outside, the way Reeve tested them. In the arXiv audit, 55.5% of vulnerabilities came from what the authors call hidden security rules, requirements the user never stated, such as running access checks on the server. Our checklist for taking a vibe-coded app to production has the audit queries and an anonymous-client test.
• Payments. A payment flow needs signed webhooks, prices set on the server and entitlements the browser can’t change. Lovable’s deep scan and Bolt’s audit both look for prices a customer can change, and the webhook path still needs an end-to-end test.
• Scale. Bolt’s free hosting stops serving at 333,333 requests a month, Lovable Cloud runs on a database instance you resize, and Replit bills compute per use. Load tests, indexes, background jobs and per-user caps on AI spend are engineering work.
• Compliance. A vendor’s SOC 2 report covers the platform and says nothing about your app’s access rules. Check each vendor’s position on the rules you fall under. Lovable’s FAQ, for example, says it isn’t HIPAA-compliant and doesn’t sign Business Associate Agreements.³ Replit hosts published apps in the United States unless an Enterprise customer asks for the EU, and Base44 uses workspace data for model training below Enterprise.

The arXiv authors conclude that generated applications “should be treated as prototypes and not casually exposed to real users”. Taking a prototype through these points is the work of our product engineering service.

The rule we’d use: bring in an engineer before the first real user’s personal data or payment reaches the app, and before any fix that moves a rule from the browser to the server.

Frequently asked questions