Lovable vs Bolt vs Replit.
Lovable for a polished web app on a managed Postgres backend with the least setup. Bolt for JavaScript projects, mobile apps through Expo and a token allowance that rolls over. Replit for a full cloud workspace in any language, with separate development and production databases. All three turn a chat into a running app, and all three cost $20 to $25 a month to start building. Below is each one on stack, backend, auth, hosting, pricing, usage model, code export, collaboration and security tooling, read on the vendors’ own pages on 23 October 2026, and where each tends to break when the first real users arrive.
Fourteen questions, three app builders.
Each vendor sells more than one product. Lovable here means the Lovable editor with Lovable Cloud, Bolt means bolt.new with Bolt Cloud, and Replit means Replit Agent with Replit’s publishing and databases.
| Question | Lovable | Bolt | Replit |
|---|---|---|---|
| What it is | An AI app builder: you describe the app in chat and Lovable builds and hosts a full-stack web app on its built-in backend, Lovable Cloud. | An AI app builder from StackBlitz that turns a prompt into a web app, or a mobile app through Expo, with hosting, a database and domains in Bolt Cloud. | A cloud development platform with an AI agent. Replit Agent builds apps (and other artifacts such as slide decks and dashboards) inside a full workspace, then publishes them on Replit’s cloud. |
| Who it is built for | Founders, product managers, designers and operators who want a working web app without touching the code, and small teams building one together. | People building JavaScript web apps, sites and Expo mobile apps who may want to drop into the code now and then. Teams can bring their own design system. | Builders who want an agent and a real development environment in one place, including developers who will read and edit what the agent writes. |
| How you build | Chat. Plan Mode talks through a change before building, at 1 credit per message. The code is visible in the project’s code editor and syncs to GitHub. | Chat with one of two agents, Standard or Max (Max is paid plans only), plus Plan Mode, visual edits on the preview and a Code view where you edit files directly. | Chat with Agent in Free Mode, Power Mode or Max Mode, plus Plan Mode on Core and above, in a full editor and terminal. Pro runs up to 10 tasks in parallel. |
| Stack it generates | No choice of framework or database. Apps created from 13 May 2026 use TanStack Start, which renders pages on the server; older apps use React and Vite. Every project uses PostgreSQL. Next.js is not supported. | JavaScript only: any front-end framework that runs in the browser and Node.js on the back end. PHP and Python back ends are not supported. Mobile apps are built with Expo. | Any language the workspace runs. Its dependency scanning covers Node.js, Python, Go, Rust, PHP and Ruby, which gives a fair idea of the common stacks. Mobile apps are supported too. |
| Backend and database | Lovable Cloud, built on Supabase’s open-source foundation: Postgres database, storage, realtime and edge functions, hosted by Lovable. Or connect your own Supabase project. Moving a Supabase project onto Cloud is not supported, and leaving Cloud for your own Supabase is a manual export and restore. | Bolt Database by default, on every plan: tables, file storage, server functions and logs. On Pro or Teams you can start on Supabase instead, connect a Supabase project, or claim a Bolt database into your own Supabase account. | Managed PostgreSQL with two databases per app: development, which Agent can change, and production, which Agent cannot touch. Schema changes reach production when you publish. Files go to App Storage on Google Cloud Storage. |
| Auth | Built into Lovable Cloud: manage sign-ups and sign-in methods. Leaked-password protection checks passwords against the Have I Been Pwned database. With your own Supabase, it is Supabase Auth. | Email and Google sign-in, with email confirmation and password reset settings. Leaked-password protection is on by default for Bolt databases. Bolt adds sign-in only when you ask for it. | Two built-in options: Replit Auth, where users sign in with a Replit account on a Replit-branded page, or Clerk Auth, your own branded tenant with separate development and production environments. |
| Hosting and deploy | Publish to a lovable.app address. Lovable says hosting costs nothing for most small or new apps; beyond the included grant it draws on your credits. The free plan gets 5 lovable.app domains and invite-only publishing. | Publish to a free bolt.host address, or to Netlify. Free hosting is 10 GB bandwidth and 333,333 requests a month with a hard stop; paid plans get 30 GB and 1 million requests, then pay as you go up to a cap you set. Limits are per account. | Autoscale, Static, Reserved VM or Scheduled deployments on Google Cloud, hosted in the US (EU on request for Enterprise), each customer in its own single-tenant project. The free Starter plan gets one published app, which goes down after 30 days. |
| Custom domains | Paid plans. Pro adds custom domains, unlimited lovable.app domains and removes the Lovable badge. | Paid plans. Buy a domain inside Bolt or connect one you own; paid plans also remove the Made in Bolt badge. | Set in Publishing, and you can buy a domain inside Replit. Removing the Made with Replit badge needs Core. |
| Plans and prices | Free $0. Pro $25 a month, or $21 a month billed annually. Business $50, or $42 billed annually. Both paid prices are for 100 monthly credits. Enterprise is a platform fee with volume pricing. All in USD. | Free $0. Pro $25 a month, or $18 a month billed annually ($216 a year). Teams $30 per member a month, or $27 billed annually. Enterprise is a custom annual contract billed by consumption. All in USD, plus tax. | Starter is free. Core $20 a month, or $18 billed annually. Pro $100 a month, or $90 billed annually, with larger credit tiers above. Enterprise is custom. All in USD, plus tax where it applies. |
| Credit and usage model | One credit balance pays for building, hosting, the backend and AI features in your app. Free gets 5 build credits a day (up to 30 a month) and 20 Cloud credits a month; paid plans add their monthly credits. Build messages cost by complexity (Lovable’s examples run from 0.50 to 1.70 credits). Monthly-plan credits expire two months after issue. | Tokens, which Bolt says go mostly on syncing your project’s files to the AI, so larger projects use more per message. Free: 1M tokens a month with a 300K daily cap. Pro: 10M a month, no daily cap; unused tokens roll over for two months. Purchased token reloads do not expire. | Monthly credits ($20 on Core, from $100 on Pro) cover Agent, publishing, databases and more. Beyond them you pay as you go under Effort-Based Pricing: the longer Agent works on a request, the more it costs. Budgets act as a hard monthly cap. |
| GitHub sync and code export | Two-way GitHub sync on every plan, one branch at a time (the default branch unless you switch), to a repository that starts private. Paid plans can download the codebase. The database exports separately and leaves out stored files, edge function code and secrets. | Connect GitHub to create a private repository on main or import one. Bolt commits each working change and pulls from GitHub every 30 seconds. You can create and switch branches in Bolt; merging happens on GitHub. | The Git pane connects a GitHub repository, commits and pushes. Enterprise adds GitHub Enterprise Server, GitLab Self-Managed and Bitbucket Data Center. The code runs anywhere its language runs; Replit Auth, publishing and the managed database would need replacing. |
| Collaboration | Unlimited users on every plan; Lovable prices by credits, not seats. Pro adds roles, permissions and per-member credit limits; Business adds a team workspace, role-based access and SSO. | Invite collaborators to edit in real time and leave comments on the preview. Teams adds central billing, team access management and admin controls; SSO is listed on Enterprise. | Core allows up to 5 builders in a workspace, Pro up to 15 builders and 50 viewers with pooled credits. Enterprise adds SSO, SCIM and audit logs. |
| Security features | A Quick scan runs on every publish (database access rules, dependencies, MCP exposure); a manual Deep scan reads all the code for access control, unauthenticated endpoints, injection, leaked secrets and exposed personal data. Admins can block publishing on critical findings. Keys go in Secrets. Lovable’s docs say the scans cannot guarantee complete security. | A project security audit (paid plans, from the Publish menu, no tokens) checks data access, sign-in and sessions, misuse such as changing a price, input handling and keys; up to 30 a day. A database check on every plan runs the same checks as Supabase’s Security Advisor. | Package Firewall blocks malicious packages at install, on by default. Dependency scans are free and automatic. Agent security scans (paid plans) combine model analysis with Semgrep and HoundDog.ai. A scan runs before publishing and can block critical findings. Secrets live in the Secrets tool. |
| What breaks first with real users (our view) | Row-level security. The generated front end talks to the database with the public key, so the policies are the only thing between one user and another user’s rows. CVE-2025-48757 recorded Lovable apps whose missing or weak policies let unauthenticated visitors read and write tables; Lovable disputes it as the customer’s responsibility. | The same layer. Bolt’s own docs warn that on a site without sign-in it may write policies letting any visitor view, add, change and delete data, and flag them as “RLS Policy Always True”. Next come hosting caps on the free tier and token burn as the project grows. | Auth and data changes. Replit Auth means your customers need Replit accounts, so a branded product moves to Clerk. Schema changes land on live data at publish. In July 2025 an agent deleted a user’s production database despite instructions to freeze code; Replit then made separate development and production databases automatic. |
Read on each vendor’s own pages on 23 October 2026; the sources are listed below. Prices are in US dollars, per month unless marked, and change often, as do credit and token rules. Lovable gives no dollar value per credit, so credits cannot be compared with Bolt tokens or Replit dollars directly. The last row is our view from reviewing apps built this way. Before launch, run through our security checklist for AI-built apps.
Each is the right answer for someone.
Choose Lovable when
FitsYou want the shortest path from an idea to a hosted web app with sign-in and a Postgres database, you will rarely open the code, and a team of non-developers will build it together. Unlimited users on every plan helps there.
Watch forYou get no choice of framework, credits are hard to forecast because each build message costs by complexity, and leaving Lovable Cloud for your own Supabase is a manual move. Test your row-level security before anyone signs up.
Choose Bolt when
FitsThe project is JavaScript, you may want an Expo mobile app, you like editing files yourself between prompts, and a token allowance that rolls over suits how you work. The free security audit on the Publish menu is a good habit.
Watch forToken use grows with project size because Bolt syncs your files to the AI. Python and PHP back ends are out. Choose Supabase at the start if you want it, because switching later takes extra steps.
Choose Replit when
FitsYou want an agent inside a real development environment, any language, and a production database the agent cannot touch. It suits developers, and teams of up to 15 builders on Pro.
Watch forEffort-based pricing means a long agent run costs more, so set a budget. Replit Auth needs your users to have Replit accounts. Publishing, auth and databases are Replit’s, so moving off means replacing them.
Choose none of them when
FitsA developer will own the product from day one, it needs a stack none of them generate, or you already have a codebase. A coding assistant in your own repository may fit better; see Claude Code vs Cursor.
Watch forA coding assistant writes code; you still choose the hosting, the database, auth and the security checks yourself. That is more work and more control.
What it costs to build, to run, and to launch.
Prices checked on 23 October 2026, in US dollars. The first two cards are the vendors’ own figures; the third is the work that sits between a prototype and paying users.
The monthly plan while you build
Lovable Pro: $25 a month or $21 billed annually, for 100 monthly credits plus daily build grants. Bolt Pro: $25 a month or $18 billed annually, for 10M tokens a month that roll over for two months. Replit Core: $20 a month or $18 billed annually, with $20 of credits, then pay as you go. All three have free tiers that are fine for trying the tool and too tight for a real build.
Hosting, database and AI usage after launch
Lovable: hosting is free for most small apps, then the same credit balance pays for hosting, the backend and AI features. Bolt: paid plans include 30 GB and 1 million requests a month, then pay as you go up to your cap; a Supabase project you own is from $25 a month on Supabase Pro, and Supabase’s Free projects pause after a week of inactivity. Replit: publishing and production database usage come out of your credits, then pay as you go.
A review before real users arrive
Most prototypes, demos and side projects do not need one. When the app will hold customer data or take payments, our Prototype Production Review is $2,500 fixed over 5 business days: security (row-level security, exposed keys, auth), data model, performance and deploy, with a graded report and a fix plan. It is credited in full to a build with us started within 60 days. Fixes run on an embedded team at $3,000–$7,500 per engineer per month. What the review checks.
Where each fact came from.
All read on 23 October 2026.
Do not pick the builder on the demo. Pick it on where your data will live, who will own the code, and how you will leave if you have to, then check row-level security and keys before launch whichever one you choose. If the app will hold customer data, our Prototype Production Review ($2,500 fixed, 5 business days) tells you what stands between it and real users; if it is a prototype or a side project, you probably do not need it. We are not a partner of Lovable, StackBlitz or Replit and earn nothing on their plans.
Lovable vs Bolt vs Replit
Replit vs Lovable: which is better?
For a non-developer who wants a hosted web app with sign-in and a database, Lovable is usually quicker: chat, publish, done, on a Postgres backend built on Supabase. For someone who wants a full development environment, any language and a production database the agent cannot change, Replit fits better. On 23 October 2026 Lovable Pro was $25 a month and Replit Core $20, both less when billed annually.
Lovable vs Bolt: what is the difference?
Lovable builds web apps on TanStack Start (React and Vite for apps created before 13 May 2026) with Lovable Cloud as the backend, and bills in credits. Bolt builds JavaScript web apps and Expo mobile apps, defaults to Bolt Database with Supabase as an option on paid plans, lets you edit files directly in Code view, and bills in tokens that roll over. Both Pro plans were $25 a month on 23 October 2026.
How much does Lovable cost?
Checked on lovable.dev/pricing on 23 October 2026, in US dollars: Free $0 with 5 build credits a day up to 30 a month; Pro $25 a month or $21 billed annually; Business $50 or $42 billed annually. Both paid prices are for 100 monthly credits. Enterprise is a platform fee with volume pricing. The same credits pay for building, hosting, the backend and AI features, and Lovable does not price seats.
Replit vs Bolt: which is cheaper?
On list price, Replit Core is $20 a month ($18 billed annually) and Bolt Pro is $25 ($18 billed annually), checked 23 October 2026. They measure usage differently: Bolt gives 10M tokens a month that roll over, while Replit includes $20 of credits and then charges pay as you go by how long Agent works. A large project can cost more on either, so set Replit’s budget cap and watch Bolt’s token use.
Do Lovable, Bolt and Replit use Supabase?
Lovable Cloud is built on Supabase’s open-source foundation, and you can connect your own Supabase project instead. Bolt uses its own Bolt Database by default and offers Supabase on Pro and Teams. Replit uses its own managed PostgreSQL, with separate development and production databases. Where Supabase is involved, row-level security on every table is what keeps one user out of another’s data.
Can I export my code and leave?
Yes, with different amounts of work. Lovable syncs to GitHub on every plan and lets paid plans download the codebase; the database exports separately, without stored files, edge function code or secrets. Bolt commits every working change to a GitHub repository. Replit’s Git pane pushes to GitHub, but an app using Replit Auth or Replit’s databases needs those replaced elsewhere.
Are apps built with Lovable, Bolt or Replit secure?
They can be, and all three now scan for problems: Lovable on every publish, Bolt through a security audit and a database check, Replit through dependency scans and Agent security scans. Each vendor says a clean scan is not a guarantee. The common failure is access control, usually row-level security that is off or too broad. Our [checklist](/insights/ai-built-app-security-checklist/) gives a ten-minute test for each item.
When does an AI-built app need a professional review?
When it will hold other people’s data, take payments, face a customer’s security review or an investor’s diligence. A prototype for feedback does not. Our Prototype Production Review is $2,500 fixed over 5 business days, covering security (including row-level security, exposed keys and auth), the data model, performance and deploy, and is credited in full to a build with us started within 60 days.
Where to go next.
AI-built app security checklist
Row-level security, exposed keys, auth, rate limits and cost caps, each with a ten-minute test.
AI-built app security checklistClaude Code vs Cursor
The two coding assistants side by side, for when a developer will own the code.
Claude Code vs CursorPrototype to Production
A $2,500 fixed review of an AI-built app with a graded report and a fix plan, credited to the build.
Prototype to Production
Built it? Find out if it survives users.
Tell us what you built and what it runs on. In 5 business days you get a graded report and a fix plan for $2,500 fixed, credited in full to a build with us within 60 days.