Why Everyone Uses Supabase, and What the Default Costs Later

Supabase is an open source backend platform built on Postgres. Everyone uses it because one project gives you a managed Postgres database, authentication, file storage, Realtime, vector search, and an API generated from your schema, and because the database stays ordinary Postgres, so you can move it or self-host it. It became the default in AI-built apps because that bundle removes the backend setup work nobody wanted to do. Five apps in AxonBuild’s fixed 26-app June-July 2026 research cohort used Supabase.

The tradeoff is responsibility at the data boundary. A browser can call the generated API directly, so Postgres grants and row-level security determine which rows a public or signed-in client can reach. Backups, schema history, and direct database connections remain separate operating decisions.

Why is Supabase so popular? It bundles the backend stack

Supabase is popular because picking it settles several backend decisions together: ordinary Postgres, authentication, file storage, Realtime, and an API generated from the database schema. Checked on 2 August 2026, the Free plan includes 500 MB of database storage, 50,000 monthly active users, 5 GB of egress, 1 GB of file storage, and two active projects.

Those numbers come from Supabase’s pricing page, and the Postgres is real Postgres, so the schema you write is the schema any developer you later hire already knows.

The scale is not small. Announcing its Series F in June 2026, Supabase said nearly 10 million developers build on the platform and that database launches had grown 600% over the year.

The alternatives make different tradeoffs. Firebase’s common database options are NoSQL and come with its broader application platform. Managed Postgres hosts such as Neon, Railway, and Render give you the database without necessarily bundling authentication, storage, Realtime, and a generated browser-facing API. Self-hosted Postgres gives you more operating control and more infrastructure to own. Supabase combines those pieces behind one project and one client library.

Which companies use Supabase in production?

Supabase publishes customer stories for Lovable, Resend, Mobbin, Udio, Chatbase, Firecrawl, Deriv, Brevo, and others. That list proves those companies run on the platform. It does not prove the platform fits your workload. Your own decision still turns on data access, recovery, and operating requirements.

Is Supabase open source, and does that mean no lock-in?

Yes to open source, mostly to no lock-in. Supabase’s architecture guide says the platform is assembled from existing open source tools, and lists the license for each piece: Postgres under the PostgreSQL License, GoTrue (Auth) and PostgREST under MIT, and Studio, Realtime, the Storage API, and Supavisor under Apache 2.0. Supabase also publishes a self-hosting guide for running the stack on your own computer, server, or cloud infrastructure.

The portability that matters most is duller than the license. Your data sits in ordinary Postgres, so a pg_dump moves your schema and rows to any Postgres host. There is no proprietary query language to rewrite, and the SQL a new developer reads on day one is the SQL that is actually running.

The limits are worth saying out loud. Self-hosting means you own the operations: upgrades, backups, monitoring, and whoever gets woken up at 3am. Storage objects live outside the database, so they move separately from the dump. And the hosted platform’s conveniences, the dashboard, the pooler endpoints, the log retention, are not what you get when you run the stack yourself. Open source here means you have an exit, not that the exit is free.

What is Supabase used for?

Supabase is used as the backend of a web or mobile app: the database, the login system, the file uploads, and the live updates. Teams use the whole platform, or only the database and the services they need. These are the six pieces Supabase itself names.

Postgres database

A managed Postgres instance, not a wrapper over one. You get SQL, joins, constraints, triggers, views, and extensions, and the schema moves to any other Postgres host.

Authentication

Supabase Auth (the GoTrue service) covers email and password, magic links and one-time passwords, social OAuth providers, phone sign-in, and SAML single sign-on. Supabase’s Auth guide says it uses JSON Web Tokens for authentication and integrates with row-level security so policies can scope database access row by row.

File storage

An S3 compatible object store with its metadata kept in Postgres, used for avatars, uploads, and documents. Storage files are not part of the database backup, which is the detail founders miss most often.

Edge Functions

Server-side functions for work that must not run in the browser: webhook handlers, payment callbacks, anything that needs a secret key. Supabase’s Edge Functions guide describes a Deno compatible, TypeScript-first runtime.

Realtime

A WebSocket service for presence, broadcast messages, and streaming database changes to connected clients. A chat screen or a live dashboard does not need polling.

Realtime being slow or silent is its own diagnosis, separate from ordinary query speed. The table has to sit in the supabase_realtime publication before anything streams, and Supabase’s Postgres Changes guide says every event is authorized against each subscriber, so one change to a table with 100 subscribed users runs 100 authorization checks.

Vector search with pgvector

Supabase’s vector columns guide says vectors are enabled through pgvector, a Postgres extension for storing and querying vectors, and that it can be used to store embeddings. It ships distance operators for Euclidean distance, negative inner product, and cosine distance. That is why an AI app can keep its embeddings in the same database as its users and its billing rows instead of paying for a separate vector store.

For frontend apps, the usual path is a browser calling Supabase’s PostgREST-based Data API with a publishable key. Supabase describes this as a two-tier architecture; you can also put your own API or Edge Function between the client and database. The direct browser path is safe only when grants and row-level security enforce the intended boundary.

Is Supabase better than Firebase?

For an app with users, accounts, and relationships between them, Supabase is usually the better fit, because that data is relational and Postgres is built for it; Firestore fits genuinely document-shaped data or a team that wants Google’s wider platform around it. The two differ in data model, query language, authorization, self-hosting and exit path, and the full Supabase vs Firebase comparison takes those apart column by column.

Either choice leaves the authorization work in place and only changes the language you write it in: SQL policies on one side, a rules file on the other, and a wrong rule leaks the same data either way. Supabase alternatives goes through the rest of the field, including the managed Postgres hosts that do less than Supabase on purpose.

Why AI coding tools often choose Supabase

AI builders often surface Supabase as a native backend option. Lovable’s integration connects a Supabase project and can propose database changes from a plain-language request. Bolt.new documents Supabase support for Vite projects. In its June 2026 funding announcement, Supabase said more than 60% of new databases were launched by an AI tool.

That integration can make Supabase the project’s backend before the person building the app has evaluated grants, RLS policies, backups, or migrations. The publishable key belongs in the browser; Supabase explicitly treats it as non-secret. The protection comes from least-privilege grants and RLS, while secret and service-role keys must remain server-side.

For most of these founders, the builder picked Supabase before they had an opinion to pick with.

Not every tool works this way. Base44 ships its own managed data layer and also documents a read-only Supabase connector that can browse schemas, read tables, and view project status. That connector does not make Supabase the app’s native managed backend. Where a tool has no backend of its own, Cursor and Claude Code among them, the model may reach for Supabase. When Supabase is the chosen backend, the result is a Postgres database, a public API key in the browser, and an authorization model the owner still has to verify.

Is Supabase 100% free? What the free tier actually carries

To start, yes: the Free plan carries two active projects with documented allowances, and the paid step is Pro at $25 per month. What each Supabase plan includes, when the spend cap stops usage, and which meters can incur overages is a page of its own. What stays true on every tier is that the recovery plan deserves more attention than the sticker price.

Paid plans close the backup gap less cleanly than founders assume. Pro’s rolling seven-day window only ever holds seven days, Storage files are not in the database backup at all, and deleting the project deletes the backups with it. What a Supabase backup actually covers, plan by plan takes that apart properly.

The Pro figures in that picture, checked 5 August 2026: 8 GB of disk per project, 100,000 monthly active users, 250 GB of egress, 100 GB of file storage, seven days of daily backups, and metered overage above each included amount. The Free figures were checked 2 August 2026.

What are the disadvantages of Supabase? Four that bite after launch

The main tradeoffs follow from the same design: a generated Data API needs explicit authorization, managed schema changes still need migration history, direct Postgres clients still consume finite connections, and the client library is a REST client rather than an ORM. Free projects also need a separate backup routine.

1. SQL-created tables need RLS enabled explicitly

Supabase enables RLS by default for tables created with the Table Editor. A table created in the SQL Editor, a migration, or another tool needs RLS enabled explicitly. Supabase’s Data API security guide also separates two controls: grants decide which roles can reach an object, and RLS policies decide which rows those roles can access. For projects created after 30 May 2026, new tables require explicit Data API grants. Supabase’s grant-default rollout schedules that opt-in default for existing projects on 30 October 2026; existing tables retain their grants.

-- created by a migration or SQL tool
create table public.notifications (
  id uuid primary key default gen_random_uuid(),
  user_id uuid references auth.users,
  body text
);

-- enable RLS before exposing the table through the Data API
alter table public.notifications enable row level security;

-- the switch blocks everything; a policy is what lets the owner back in
create policy "Users read their own notifications"
on public.notifications
for select
to authenticated
using ( (select auth.uid()) = user_id );

That gap appeared in AxonBuild’s fixed June-July 2026 cohort: 9 of 21 third-party apps had a confirmed RLS gap, and 7 of 21 let a signed-in user reach another customer’s data. The findings were verified against the code, and the corpus methodology and limitations keep the historical denominator separate from later audits.

Two Supabase-backed apps reached exposure from opposite directions. A food-delivery app had a notifications table with no RLS, while a trigger copied each order’s customer name, phone, address, and GPS coordinates into it. A public Q&A app enabled RLS on every table but added a second profiles policy with using (true). One missed the switch; the other had a permissive policy. That distinction is central to whether Supabase is safe for a given app. Switching RLS on settles less than founders expect: whether RLS by itself is enough, and the policy practices that keep row-level security holding once it is on, are each their own subject.

2. Your schema can live in a dashboard instead of your repo

One Supabase-backed golf analytics app kept every table, constraint, and RLS policy only in the hosted dashboard, with no committed migrations in the repository. The visible schema worked, but the repository could not reproduce or review it. A dashboard change would leave no code diff, and setting up a staging environment on Supabase from the repository alone was impossible. That is the same recovery problem examined in deleting production data with no way back.

3. Direct database clients need the right pooler

Supabase’s browser-facing Data API uses an internal connection pool, so ordinary supabase-js requests do not open one direct Postgres connection per visitor. The limit matters when a backend, ORM, worker, or serverless function uses a Postgres connection string. Supabase’s connection guide recommends a direct connection for a persistent backend that can reach IPv6, Supavisor session mode for a persistent IPv4-only backend, and transaction mode for serverless or short-lived tasks. Why a Supabase app gets slow covers query behavior separately, and the same unbounded queries turn up later as a Supabase egress limit nobody priced.

4. The client is thinner than an ORM

supabase-js is a REST client over the generated Data API, not an ORM, and the difference shows up on the second week of real work rather than the first. This is the complaint experienced developers make about the platform, and it is a fair one.

• No client-side transactions. The JS client sends one request per call, so two writes that must both succeed or both fail cannot be grouped from JavaScript. Multi-step writes move into a Postgres function called with rpc(). Supabase’s database functions guide notes that raising an exception inside a function ends it and reverts the transaction, which is how you get all-or-nothing behavior back.
• Types are generated, not live. You regenerate after every schema change, and Supabase’s type generation guide warns that generated types are sometimes not what you expect, giving a view column typed as nullable when you expect not null as the example.
• Edge Functions run on Deno, not Node. Node-only packages and Node build tooling do not transfer unchanged, which surprises anyone moving server code across from an Express app.

Expect business logic to gravitate into SQL functions over time, and keep those functions in migrations rather than in the dashboard.

So is Supabase really worth it? Yes, and here is the bill

Supabase is a strong default when a project benefits from Postgres, Auth, Storage, Realtime, and a generated API together. Supabase alternatives make sense when a different data model, hosting boundary, or operating model matters more. Three checks turn an inherited default into a deliberate choice:

1. 01 Sign in as a second account and try to read the first account’s data, changing nothing but an id. If it comes back, row-level security is not holding, whatever the dashboard shows.
2. 02 List every table created after your original launch and check RLS on each one by name. Those are the tables the first setup never covered.
3. 03 Try rebuilding your schema into a fresh project from your repo alone. If you cannot, your authorization rules exist in one place and have never been backed up.

Once those checks pass, whether someone can steal data from your Supabase app is grounded in a two-account test and a reproducible schema rather than a dashboard toggle. Whether an AI-built app is ready to launch includes authorization alongside reliability, payments, recovery, and operations.

The open question for any dashboard-managed project is whether the repository can rebuild what production currently depends on.

Common questions about Supabase

What is Supabase, in one paragraph?

Supabase is an open source backend platform built on Postgres. One project gives you a managed Postgres database, authentication, file storage, Realtime, Edge Functions, and a REST API generated from your database schema that a browser can call with a publishable key. Its architecture guide names the open source component behind each of those pieces and the license it carries, and the database underneath is ordinary Postgres, so a pg_dump moves your schema and rows to any other Postgres host. Vector search runs on pgvector, a Postgres extension, inside that same database rather than as a separate service.

Is Supabase really worth it?

It is a strong fit when you want managed Postgres, Auth, Storage, Realtime, and a generated API in one project. The fit weakens when you need a different data model or do not want browser-facing data access governed by Postgres grants and RLS. In AxonBuild’s fixed June-July 2026 cohort, 9 of 21 third-party apps had a confirmed RLS gap.

Is Supabase open source?

Yes. Supabase’s architecture guide lists the license for each component: Postgres under the PostgreSQL License, GoTrue (Auth) and PostgREST under MIT, and Studio, Realtime, the Storage API, and Supavisor under Apache 2.0. Supabase documents self-hosting the stack on your own server or cloud. The hosted platform is the paid product; the software underneath it is not locked away.

Is Supabase owned by Google?

No. Supabase was independently founded by Paul Copplestone and Ant Wilson and joined Y Combinator’s Summer 2020 batch. Its June 2026 Series F announcement describes a $500 million round led by GIC. The previous $100 million Series E was announced in October 2025 and led by Accel and Peak XV.

Is Supabase used by big companies?

Yes. Supabase publishes customer stories for Lovable, Resend, Mobbin, Udio, Chatbase, Firecrawl, Deriv, Brevo, and other production users, and said in its June 2026 funding announcement that nearly 10 million developers build on the platform. A vendor case-study list establishes that those named customers use the platform; it does not establish that every workload or architecture fits. Your own decision still depends on data access, recovery, and operating requirements.

Is Supabase 100% free?

Supabase has a $0 hosted plan and is open source, but hosted Supabase is not unlimited. The Free plan includes 500 MB of database storage, 50,000 monthly active users, 5 GB of egress, 1 GB of file storage, and two active projects, per Supabase’s current billing documentation. It has no user-accessible automatic-backup entitlement. Supabase may pause a Free project after low database activity over a seven-day period, with a warning email before the pause.

Do apps outgrow Supabase?

Rarely at the data layer, often at the plan and the access pattern. The database is ordinary Postgres, so growing does not mean rebuilding your schema or rewriting your queries. What teams actually outgrow is the included quotas, the direct-connection limits that need the right pooler mode, and the browser-to-Data-API pattern, which many teams eventually put a server-side API in front of. Each of those is a change you make inside Supabase, not a migration off it.

Is Supabase good for beginners?

Yes for getting an app running, with one caveat that costs people real money. The dashboard, the generated API, and the one-call authentication mean a beginner can ship a working product fast. The caveat is that authorization is not automatic: a table created in the SQL Editor or by an AI builder needs row-level security enabled and a policy written, or signed-in users can read each other’s rows. In AxonBuild’s fixed June-July 2026 cohort, 9 of 21 third-party apps had a confirmed RLS gap.

Why do developers stop using Supabase?

Reasons vary by workload. Some teams need a different data model or hosting boundary; others outgrow included quotas or need more control over direct database connections. What each Supabase alternative provides is the useful comparison. For a browser-to-Data-API app, the immediate responsibility is keeping grants and RLS policies aligned with the product’s ownership rules.