Base44 Review (2026): You Own the Code. Not the Runtime

Last updated: June 19, 2026

Base44 is a Wix-owned AI app builder that turns natural-language prompts into hosted web apps with databases, authentication, permissions, and deployment handled inside the platform. In my April 29, 2026 hands-on test, it built a working Kanban-style task app in under a minute. The harder question is not whether Base44 can build. It is what its pricing, credits, ownership terms, and platform dependencies mean after the prototype works.

The 48-hour onboarding clock read 47 hours 57 minutes 31 seconds when I first opened Base44’s pricing screen on April 29, 2026.

Twelve minutes later, after Base44 had built a complete task management app for me, the same timer read 47:45:33. The clock is real. The 30% discount it advertises stacks on top of a yearly price that is already 20% below monthly. The price you see is not the price you pay, and the price you pay is not the price you finish negotiating with.

That gap is the whole review.



Key facts · Base44 in May 2026
Verified May 14, 2026 · base44.com
What is Base44?
A Wix-owned AI app builder that turns natural-language prompts into hosted web apps with built-in database, authentication, permissions, and deployment.
Best use case
Fast prototypes, internal tools, and stakeholder demos where Base44 can remain the runtime.
Wrong use case
Production apps with customer PII, regulated workflows, or any project that needs backend portability without engineering work.
Free plan
25 message credits per month with a documented 5-credit daily allowance. One simple build consumed 1.5 daily credits in my April 29 test.
Cheapest paid plan
Starter at $16 per month billed annually. Monthly billing is $20 per month and is a separate tab on the pricing page.
Real buyer risk
You can own the generated output without owning the hosted runtime, SDK, authentication, database, or compliance role the app depends on.
FSR finding
Base44’s strength is time-to-first-running-app. Its risk is that the app works before the buyer has understood the runtime and the legal duties attached to it.

Briefing Summary — May 2026

TIER B · HANDS-ON + RESEARCH

Tier B review · 86 minutes hands-on test on April 29, 2026 · supplemented with research through May 14, 2026.

Base44 pricing screen captured on April 29, 2026 at 13:14 JST showing a thirty-percent-off yearly plans campaign with a 47-hour 57-minute 31-second countdown timer. The Elite plan is displayed at one hundred sixty dollars per month with a strikethrough, reduced to one hundred twelve dollars per month with thirty percent off, including 1,200 message credits and 50,000 integration credits per month. The headline reads'Choose the plan that fits you' in Japanese, with a note that Base44 is part of WIX, trusted by over 250 million people worldwide.
Base44s first login pricing screen with a 48 hour 30 off campaign timer running Captured April 29 2026 at 1314 JST The clock was already running when I arrived

Base44 is the easiest way to ship a working web app from a sentence I have tested in 2026. It is also one of the hardest pricing surfaces to read correctly on the first pass.

The marketing version is simple. Free plan, then four paid tiers, with yearly billing saving 20%. The version a new account actually sees is layered on top of that: an in-app 48-hour timer offering an additional 30% off “select yearly plans,” visible from the first login, displayed against pre-discounted prices, framed as a countdown. The result is that the same plan can present at three different numbers depending on which screen you happen to land on.

That gap is not the only thing the platform doesn’t explain on the surface.

If you are a non-technical founder, designer, or PM who needs a working internal tool, a CRUD prototype, or a contained side-project this week, Base44 is one of the genuinely strong options in the 2026 market. The Plan Mode workflow is free, the generated app runs without configuration, and the time-to-first-running-app on my April 29 test was under a minute. I would not call that a universal benchmark. I would call it the platform’s real advantage.

If you are an engineering team, a regulated business, or anyone shipping a tool that touches customer PII, the picture inverts. The reasons are in the Terms, the DPA, the subprocessor disclosures, and the platform-risk pattern between February and April 2026. None of them are deal-breakers on their own. Stacked together, they describe a product that is fast on the way in and slower than expected on the way out.

This review goes section by section through both versions.


TL;DR

Base44 in 2026 is a Wix-owned AI app builder that turns a prompt into a working hosted web app in under a minute. It is one of the strongest tools available for fast prototypes and internal demos.

The free plan looks generous on the marketing surface and is more constrained in practice. The published 25 message credits per month sit on top of a 5-credit daily allowance. In my April 29 test, a single simple Kanban build consumed 1.5 daily credits.

Yearly billing is 20 percent below monthly. A 48-hour campaign visible to new accounts adds another 30 percent off select yearly plans, layered on top of the already-discounted yearly base. The pricing surface presents three different prices for the same plan depending on which tab and which day of the account.

The platform’s Terms grant the user ownership of generated output. They do not grant ownership of the SDK, the hosted runtime, the database, or the authentication layer the output depends on. Exporting the code is supported. Replacing Base44’s backend with another backend is a separate engineering project.

For prototypes and internal tools, Base44 is easy to recommend. For production apps with customer PII or regulated data, the legal controller designation in the DPA sits with the builder, not with Base44.

That gap is the entire review.


Quick Start (30 seconds)

Base44 Plan Mode question 1 of 3 asking'Who is this app for?' with four answer options including Just me, A small team of 2 to 10 people, A larger team of 10 plus people, and Something else. The page begins with the user input 'Build a simple task management app' and Base44 responds 'I will help you plan a great task management app. Let me ask a few quick questions to shape it right.' All text rendered in English despite the Japanese user interface setting. Captured April 29, 2026 at 13:16 JST.
Plan Mode opens with three structured questions before generation Question 1 of 3 asks who the app is for ranging from solo use to teams of ten or more The interface label is Japanese but the question itself renders in English

Once you click Start Building, the meter starts. In my April 29 test, one full generation of a simple Kanban-style app consumed 2 message credits and 1.5 daily credits. Generation took under a minute. The free plan gives you 5 daily credits, which is not 5 generations. For builds of similar complexity, it is closer to three. Base44’s docs note that more complex apps consume more credits.

Base44 workspace credit display captured on April 29, 2026 at 13:17 JST showing 0 of 25 message credits, 0 of 5 daily credits, and 0 of 100 integration credits, immediately after completing all three Plan Mode questions. The next monthly credit refresh date is shown as May 1, 2026 at 00:00 UTC. The Maverick's Workspace label indicates this is a free-plan workspace created during the test. The credit counter at zero after Plan Mode confirms that Plan Mode does not consume credits.
The workspace credit counter at 1317 JST immediately after completing all three Plan Mode questions Every counter still reads zero confirming Plan Mode does not consume credits The Next refresh May 1 2026 at 0000 UTC note documents the monthly cap reset

If you want to keep using Base44 past the first day, you will face a pricing decision under a 48-hour countdown. Make that decision slowly. Read the next section before you commit to anything yearly.


Full Comparison: Pricing, Credits, and What’s Actually Included

Pricing verified on May 14, 2026.

Base44 Pricing · The Five Layers
Verified on base44.com/pricing · May 14, 2026
Free
Starter
Builder
Pro
Monthly billing
$0
$20
$50
$100
Yearly (per month, save 20%)
$0
$16
$40
$80
⏱ 48h campaign (30% off yearly)
$0
$11.20
$28
$56
Message credits / month
25
100
250
500
Daily cap (free plan only)
5/day
none
none
none
Note: Elite tier ($200 monthly / $160 yearly / $112 with 48h campaign) and Enterprise tier (custom) not shown above. The Elite plan is what the in-app 48h campaign explicitly highlights at $112 from $160, a 30% reduction layered on a yearly base that is already 20% below monthly.

The five-tier structure is not the story. The story is what happens when the three pricing layers overlap.

Base44 four paid monthly pricing plans displayed on April 29, 2026 showing Starter at twenty dollars per month, Builder at fifty dollars per month, Pro at one hundred dollars per month, and Elite at two hundred dollars per month. The Elite plan explicitly notes that premium support is currently available only in English. Each plan card shows message credits per month, integration credits, and feature lists including custom domain support, GitHub integration, and beta access. Captured at 13:06 JST from iPhone Safari browser.
Base44s four paid monthly plans as displayed on April 29 2026 The Elite tier at $200month explicitly notes premium support currently English only even the highest paid plan does not include Japanese support

The published yearly price is 20% below the monthly equivalent. The 48-hour campaign price is an additional 30% below that. The strikethrough on the in-app pricing screen shows the yearly base as the “original” being discounted, not the monthly base. That makes the headline discount appear larger when measured against the monthly list price.

For Builder, this means a user on day one of their account sees $28 per month, with the monthly list price of $50 visible nowhere on the upgrade screen. The same plan, purchased monthly on day three, costs $50. The plan, the features, and the message credits are identical. The difference is when you clicked.

Message credits are not message bubbles. They are a unit of generation work. In my April 29 test, one generation of a Kanban-style task app consumed 2 message credits. A second axis, daily credits, tracks free-plan usage on top of monthly credits.

Base44 workspace credit display after one Kanban-style app generation: 2 of 25 message credits and 1.5 of 5 daily credits consumed, 0 of 100 integration credits used, with a 47-hour 45-minute 30-percent-off yearly campaign timer visible in the background. Captured April 29, 2026 at 13:22 JST.
Workspace credit state immediately after one generation The 30 off campaign timer in the background reads 474533 twelve minutes after Image 1s 475731

There is a third axis. Integration credits. Free plan: 100 per month, according to the pricing table on base44.com/pricing. The FAQ on the same page says 500. The pricing table and the FAQ on the same page disagree, and the platform has not reconciled them as of May 14, 2026.

I noted that for later. It comes back in section 9.


Deep Dive 1: The Two Pricing Pages

⚠ Marketing surface vs reality
Marketing
“Save 20% with yearly billing”
Reality
Monthly is the penalty price. Yearly is the default.
Marketing
“Free plan: 25 messages/month”
Reality
A 5/day cap that becomes ~3 generations/day.
Marketing
“You own the code you build”
Reality
You don’t own the SDK, auth, hosting, or database it depends on.
Marketing
“Build in your language”
Reality
Japanese UI. English AI conversation. English-only generated apps.
Marketing
“Secure by default”
Reality
Terms disclaim warranty. Compliance duty stays with the builder.

The Base44 landing page sells one price. The post-signup pricing page sells a different one. The two share a table layout but differ in three structural ways that matter at the moment of payment.

The first difference is the default billing toggle. The landing-page pricing tab defaults to Yearly. The Monthly tab exists but requires a click. Most users never see it before reading the “savings” framing.

The second difference is the in-app 48-hour countdown. New accounts see a campaign timer running against a 30% discount on yearly plans. The strikethrough on that screen shows the yearly base price (already 20% below monthly) as the “before” price. From a Builder yearly base of $40 per month, the campaign price becomes $28 per month. From a strict monthly comparison, that is a 44% reduction. From the user’s perspective, it presents as 30%.

Base44 main application input screen captured on April 29, 2026 at 13:15 JST showing the same thirty-percent-off yearly plans campaign timer now reading 47 hours 53 minutes 5 seconds, four minutes after the initial pricing view. The interface prompts'What will you build next' in Japanese with my English input 'Build a simple task management app' visible. Category buttons below show tasks and workflows, CRM and sales, content and sites, finance, and reservations. The Plan Mode toggle is visible but off at this point.
The same campaign timer four minutes later reading 475305 The prompt and category buttons are in Japanese the input itself was typed in English The clock kept counting whether I clicked or not

The third difference is the legacy promotional copy still embedded in Base44’s pricing-page source code as of May 2026. The HTML contains references to a “Cyber Monday final hours” block and an offer date of December 1, 2025, with a 00:00:00 countdown. I did not see that block rendered in the live browser UI during the May check. The stale source code does not appear on screen. It is still in the page. That is a maintenance signal, not a deception signal, but it is the kind of thing that shows up when nobody on the marketing side audits the file.

There is a $120 dual-charge case publicly logged on Base44’s feedback portal in which a user expected an upgrade differential of $40 (Builder to Pro) and was charged the full $40 plus the full $80, with the support thread describing four to five days of back-and-forth and unresolved status. I have not independently verified the case. It is one report, not a pattern. It is also the kind of report that becomes a pattern when pricing surfaces stack three discount layers and nobody on the buyer side knows which one applied.

When the headline price changes depending on which tab you open and which day of your account you are on, the failure mode is not malice. It is ambiguity. Base44’s pricing is not unfair. It is unclear, and unclear billing surfaces have higher dispute rates than fair ones.

This pricing-layer pattern is not unique to Base44. FSR has documented the same pattern in Instantly, where the marketed $9 plan masks a $144 reality. The mechanism differs. The structure is identical.

Read the upgrade screen twice before clicking. Open Monthly and Yearly tabs side by side. Take a screenshot of what you agreed to.

That is not a Base44-specific recommendation. It is a Base44-specific necessity.


Deep Dive 2: The 5/Day Cap as Behavioral Design

The free plan is described in two numbers. 25 message credits per month. 5 daily credits.

Most users read those as a single rate limit. They are not. They are two locks on the same door, and the daily lock closes first.

Here is what the meters actually do. In my April 29 test, generating a single simple Kanban-style task app consumed 2 message credits and 1.5 daily credits. The pre-generation state was zero on every counter. The post-generation state was 2/25 messages, 1.5/5 daily, and 0/100 integrations.

Base44 generation in progress screen showing'アイデアをビルド中' (Building your idea) with a Processing indicator, captured April 29, 2026 at 13:21 JST during my hands-on test. The iPhone stopwatch in the dynamic island confirms 31 seconds elapsed in the generation. The English in-app hint visible below the loader suggests connecting WhatsApp, Calendar, Notion, or Slack.
Generation in progress at 31 seconds elapsed The full generation completed in under a minute on April 29 2026

That arithmetic does not survive contact with the daily cap, and the arithmetic itself is not stable across all builds.

Base44’s own documentation notes that credit consumption varies with the complexity of the app being generated. A simple Kanban board is at the low end. A multi-screen CRUD app with several entities will sit higher. The 1.5-credit-per-build number I measured is one data point, not a benchmark, and the user-facing implication is that a free-plan budget on Base44 is not deterministic. You will not know in advance how many full generations your 5 daily credits will fund.

For builds of similar complexity to mine, the math runs as follows. 5 daily credits divided by 1.5 per generation is approximately three full builds per day. A free user who reads “5 per day” and plans to build five apps gets stopped at three. The first time. With no warning. By a counter expressed in a decimal unit that does not appear in the marketing materials.

Base44 generated Kanban-style task management app with three To Do items, one In Progress item, and one completed task. All UI elements and dummy data rendered in English including pull requests, npm audit, Git, and README references, despite the user interface being set to Japanese during generation. Captured April 29, 2026 at 13:22 JST.
The completed Kanban app generated in under a minute and rendered entirely in English from a Japanese UI session on April 29 2026

The pricing page documents the daily cap. The pricing FAQ tells the user to wait until the next day if the cap is hit. Beyond that, the reset timing is not clearly explained on the pricing surface, and I did not test the reset behavior end to end. The user-facing consequence is simple: once the daily counter closes, the free plan stops being useful for continued evaluation. The shape of that closure matters less than the fact that the closure exists and was not visible at signup.

This is not unique to Base44. It is shared with every credit-based AI app builder in the 2026 market. What is unique to Base44 is the gap between the marketing number (5) and the practical number (closer to 3 for simple builds, fewer for complex ones), the use of a decimal increment that the user cannot reason about until they have generated at least once, and the placement of the daily cap on a free plan whose conversion funnel is timed to the 48-hour campaign.

A free plan that runs out in roughly three simple builds is not a free plan. It is a trial.

Trials are fine. Trials labeled “free” are a different conversation.

If you are seriously evaluating Base44 against Lovable, v0, Bolt, or Replit Agent — see our AI coding assistant comparison for the broader landscape — the comparison is not “which free plan gives you more.” It is “which free plan gives you enough to decide before the 48-hour timer ends.” Base44’s answer to that question, for the kind of app most evaluators will try first, is roughly three full builds. That is enough to form an opinion. It is not enough to form a portfolio.

The platform will not tell you this in the upgrade screen. The platform’s design assumes you will not figure it out before the timer ends. That is not malice. It is the math of the funnel.


Deep Dive 3: Plan Mode Is Free. Building Is Not.

Base44 has one genuinely generous design choice on the free plan, and it is buried in the platform’s own documentation rather than the pricing page.

Plan Mode is the conversational structuring step before generation. The AI asks the user three structured questions about the intended app: audience, organization method, and detail fields. In my April 29 test, the answers were a four-option dropdown (“Just me / A small team / A larger team / Something else”), a four-option selector for task organization, and a multi-select for task fields including due date, priority, and assignee.

Base44 Plan Mode questions 2 and 3 of 3 shown side by side. Question 2 asks'What's the primary way you want to organize tasks?' with options By status (To Do / In Progress / Done), By project or category, By priority or due date, and Something else. Question 3 asks 'What key details should each task have?' as a multi-select with Due date, Priority level, Assignee (who owns it), and Something else. Both questions rendered in English despite the Japanese user interface. Captured April 29, 2026 at 13:18 JST.
Plan Modes structured questions 2 and 3 of 3 both displayed in English despite the Japanese UI The Send button on Q3 marks the boundary where Plan Mode ends and credit consuming generation begins

Plan Mode does not consume credits. Base44’s docs confirm this in writing. My April 29 test confirms it in data: the workspace credit counter read 0/25 messages and 0/5 daily after completing all three Plan Mode questions, at 13:17 JST. The meter started moving only after I clicked Start Building, at which point the 1 generation cost 2 message credits and 1.5 daily credits, captured at 13:22 JST.

This is the one section of Base44 where the marketing version and the reality version agree. Plan Mode is exactly what it claims to be. It is also where the platform’s design is at its strongest, because the structured questions force the user to specify enough that the generation step has somewhere to start. The output is correspondingly better than systems that take a single prompt and guess.

If you are using Base44 to evaluate whether AI app generation can work at all for your use case, spend most of your free-plan budget in Plan Mode and one generation at the end. You will learn more about Base44’s capability ceiling that way than by running three generations against three different vague prompts.

Plan Mode is free. Building is where the meter starts. Use the gap deliberately.


Deep Dive 4: Ownership Is Not Portability

The Base44 Terms of Service say users own the generated output. The Base44 Terms of Service also say Base44 owns the Platform, the Website, the Documents, the software, the SDK, the API, and the methodologies that make the generated output run.

Those two sentences live in the same document.

Both are true. The user-facing implication is that ownership of the generated output is real, and so is its limit. You can take the ZIP. You can put it in a GitHub repo. You can read the code. What you have at that point is source-code portability. What you do not have is infrastructure portability.

The distinction matters, and Base44’s own documentation is more honest about it than the marketing surface suggests.

The base44-sdk explicitly supports two patterns. The first is the in-platform pattern, where Base44 generates and hosts the application end-to-end. The second is the external-app pattern, where a developer uses the SDK to build a frontend or backend outside Base44 that calls Base44 as a backend service. The second pattern is documented on Base44’s developer pages. It is supported. It is the actual answer to “can I use my exported code somewhere else?”

The answer is: yes, if you keep Base44 as the backend.

That is a different sentence from “yes, you are free.” Running an external app against Base44 as the backend is supported. Leaving Base44 as the backend is the project that is not. The exported code expects base44-sdk calls. Those calls resolve to Base44’s hosted infrastructure for database access, authentication, permissions, file storage, and integrations. To run the same app against a different backend, the builder rewrites every SDK call. The migration is possible. The cost is engineering work proportional to the size of the app.

A 2024 paper by Alfonso et al., published on arXiv, characterizes this dependency pattern across low-code and no-code platforms with a sentence that maps onto Base44: migrating an app to another platform typically requires starting from scratch. That sentence is correct for the full-portability case. It overstates the case where the builder is content to keep Base44 as the backend and only wants frontend or auxiliary code to live elsewhere.

Base44 publishes the managed-stack tradeoff on its own product pages. The platform takes responsibility for the design, the database, the signups, the user permissions, and the hosting. That is a complete managed stack. It is also a complete vendor lock-in surface, and the platform’s Terms do not pretend otherwise. The reservation of platform IP is explicit. The duty to manage the runtime stays with Base44 as long as the app runs there.

You can own the generated code without owning the system that keeps it alive.

For a prototype, this does not matter. For an internal tool that does not need to outlive its host, this does not matter. For a public-facing product, the right question is not “can I export?” but “what runs when I do, and where?”

The honest answer is: you can export a working artifact and continue using Base44 as your backend with no migration cost. You can also leave Base44 entirely, but that is the project that needs an engineer.

The “don’t depend on it” lesson from our DeepSeek review applies in a softer form here. With DeepSeek the dependency is a choice. With Base44, dependency is the architecture.

The same ownership question lands on xAI’s terminal coding agent in a different shape. Grok Build CLI stores its session state under ~/.grok/, so the filesystem layer is yours. The capability layer is not. The agent’s tools and auth tokens live on xAI’s side and persist on their schedule, not yours. Grok Build CLI’s three memory layers describe the same partial-ownership question Base44 raises about runtime. Different surface. Same question.

Google’s Gemini CLI pushed the same question to its sharpest edge. The client shipped under Apache 2.0 and the repository stayed open after Google cut free consumer access on June 18, 2026; the license held, the runtime behind it did not. With Base44 you keep the backend while you pay for it. With Gemini CLI the backend was withdrawn and the open-source code stayed behind, running nothing on its own. The Gemini CLI shutdown is the 2026 case where owning the code and owning the access came apart in public.


Odysseus is the case where you do win the runtime. It runs the whole stack on your own machine, and FSR still found that owning the runtime is not the same as owning the outcome: its privacy holds only along the paths you keep local, and one cloud connection moves the boundary. Owning the runtime is necessary, not sufficient. See the Odysseus review.

Plan for that distinction before you click yearly. Speed at the front end of a project does not refund itself at the back end.


Deep Dive 5: The Subprocessor Problem Is Documentation Quality

Base44’s Data Processing Addendum, Exhibit C, lists nine subprocessors in its primary table. As of May 14, 2026, that table reads as follows.

#SubprocessorPurposeCountry
1MongoData storage and hostingUS
2SendGridEmail transmission and external communicationUS
3RenderServer servicesUS
4GCP – Google CloudAnalytics servicesUS
5OpenAIAPI calls to LLMUS
6AnthropicAPI calls to LLMUS
7Wix.com Ltd.Providing and improving the servicesIsrael
8SupabaseMedia hostingUS
9DataDogGeneral logging purposesUS

The problem with that table is not the names on it. It is that Base44’s own pages do not agree about what the list contains.

A later table on the same DPA page surfaces Langfuse, described as LLM logging with Germany as the country of processing, and Logfire, described as general logging with the UK. Base44’s Security page surfaces Langfuse in a Subprocessors Directory listing alongside DataDog. The primary Exhibit C table omits both. Reading across the public surfaces in the same hour, on the same day, produces three different subprocessor inventories.

This is not a legal violation. Subprocessor lists are not formally required to be a single canonical table under GDPR Article 28, only to be available to the controller. It is a documentation quality problem, and documentation quality is the first thing a security review at any mid-size customer will check.

For a non-technical builder shipping a hobby app, this does not matter. For an SMB shipping an internal HR tool, a compliance officer will find the inconsistency on the second read and ask Base44 to reconcile it before approval. That delay is not a Base44 failure. It is a Base44 readiness gap, and the gap is fixable by Base44 in an afternoon, not a quarter.

The second issue, less visible, is the LLM provider disclosure. Exhibit C lists OpenAI and Anthropic as the API providers for LLM calls. Base44’s product allows model selection on Builder plans and higher, with the dashboard offering choices that, based on third-party documentation and analysis, include Google’s Gemini family in addition to GPT and Claude. I did not capture a direct screenshot of the model-selector dropdown during my April 29 test, and that gap is the reason this section reads cautiously rather than decisively.

If Gemini is genuinely selectable as an in-product LLM, the subprocessor disclosure for Google Cloud, currently listed only as “Analytics services,” does not cover that use. That is a question Base44 should answer in writing for any customer with EU data residency questions or for any AI governance review under the EU AI Act’s general-purpose AI provisions.

The right move for a builder evaluating Base44 in May 2026 is to download the current DPA, compare the primary table to the secondary table, compare both to the Security page, and ask Base44 support to confirm in writing which list is canonical. That conversation will tell you whether Base44’s compliance posture is current or aspirational.

I am betting on current. The 24-hour response to the Wiz vulnerability (next section) suggests the security team takes findings seriously. I am also betting that the documentation surface has not caught up to the engineering one. That mismatch is a normal post-acquisition pattern, and Base44 has been a Wix product for less than a year.

The fix is editorial, not technical. It still has to happen.


Deep Dive 6: The Wiz Vulnerability and Shared Infrastructure Risk

On July 9, 2025, Wiz Research disclosed an authentication bypass affecting Base44’s private apps. The vulnerability allowed an attacker holding a non-secret app_id, retrievable from the manifest.json of any Base44-built app, to call two undocumented endpoints (api/apps/{app_id}/auth/register and api/apps/{app_id}/auth/verify-otp) and register a new account with full access, including bypassing SSO.

Wix and Base44 fixed the issue within 24 hours of disclosure. Wiz reported no evidence of exploitation in the wild. The incident did not, to public knowledge, result in customer data loss.

That is the entire surface fact. The interesting part is what it implies about platforms like Base44.

The vulnerability worked because Base44 apps share a runtime. The app_id was not secret. The authentication path was platform-level, not app-level. A single endpoint bug exposed every private app on the platform simultaneously. That is the blast radius pattern of shared-infrastructure platforms, and it is the pattern Base44 inherits from the architecture it sells.

Multi-tenant SaaS makes the blast radius. The bug exposed it. The fix closed it.

After the disclosure, Base44 added an Application Security Center that surfaces unauthenticated backend functions, RLS violations, and hardcoded secrets in user-built apps. That feature is the right response to the finding. It places more security-relevant information in the builder’s hands at the moment of building, which is the only moment a non-technical builder can act on it.

The harder question, the one that does not have a clean answer in May 2026, is what the post-vulnerability availability picture looks like.

Base44’s public status page reports operational status across systems as of May 14, 2026. StatusGator, a third-party aggregator that monitors public status pages, records a separate signal: a February 3, 2026 incident with 502 Bad Gateway errors and a duration of 3 hours 6 minutes, plus subsequent incidents on February 20, March 3, and April 9. The aggregator does not have access to Base44’s internal monitoring and lags Base44’s own confirmation by several hours.

I treat that as a third-party availability signal, not as proof of systemic unreliability.

The signal points to a pattern. A managed platform that loses three hours of availability across a single morning has, by definition, taken every app it hosts offline for that period. There is no per-app insulation, because per-app insulation is the thing Base44 explicitly outsources to its own infrastructure.

If your app’s downtime is a personal inconvenience, Base44 is operationally fine in 2026. If your app’s downtime is a contractual obligation to a customer, the right question to ask is whether your terms with Base44 (or Wix, downstream) cover the kind of platform-wide event StatusGator has been logging. The Terms do not promise uptime, and the absence of a promise is itself the answer.

The Wiz vulnerability is closed. The shared-runtime architecture that made it possible is the same architecture Base44 still runs on. That is not a criticism. That is just what the product is.

You are buying a platform. The platform behaves like a platform. The good and the bad of that statement are inseparable.


Deep Dive 7: Wix Bought More Than an App Builder

Wix announced the Base44 acquisition on June 18, 2025. The press release described it as approximately $80 million in initial consideration, with earn-outs running through 2029 and a $25 million retention bonus structure for the Base44 team. Wix stated that Base44 would continue as a distinct product and business inside the parent company.

The earn-outs are tied to Base44’s revenue and product milestones, not to calendar dates. Israeli tech publication CTech reported in March 2026 that Maor Shlomo, Base44’s founder, was positioned to receive additional earn-out consideration in light of Base44’s performance against the deal’s targets, and that Wix had recorded the corresponding amount as an acquisition-related expense in its filings. That same publication reported in May 2026 that Base44 had reached approximately $150 million in annual recurring revenue, triggering a further earn-out payment to Shlomo on the order of $38 million.

The reported number that has not been independently verified, and that this review will not assert, is the cumulative payout from acquisition close through May 2026. Wix’s Q1 2026 filing references acquisition-related expense of approximately $37.9 million and acquisition-related cash outflow of approximately $37.3 million in the same quarter, which is consistent with the CTech-reported payout figure. It is not consistent with a claim of $90 million in earn-out paid in full by March 2026. That stronger claim has appeared in third-party analyses and should be read as speculative until Wix’s filings confirm it.

What is confirmed is the structure. Wix bought Base44 in mid-2025, kept it as a separate product, and within a year was reporting from it the kind of ARR growth that triggers escalating earn-out obligations. Base44’s headcount went from 8 people at acquisition to 17 as of mid-2026, per the IVC database entry. Wix is not winding Base44 down. Wix is investing into it.

The Super Bowl LX advertisement on February 8, 2026, “It’s App to You,” led by Base44 VP Marketing Shay Korin and produced by an internal Base44 creative team, was the most public expression of that investment. Wix simultaneously launched Wix Harmony, its own AI website builder, with separate marketing under CMO Omer Shai. The two products overlap in market positioning. Base44 builds web apps with logic and data. Wix Harmony builds websites with AI assistance. Both target the citizen-developer segment. Both are marketed by Wix.

That overlap is the more interesting strategic question than the earn-out arithmetic.

Wix is hedging two paths into the AI-builder market simultaneously. One path is Base44, acquired, treated as a distinct product, and given budget for category-defining advertising. The other is Wix Harmony, built internally, integrated with the existing Wix editor, and pushed through the existing Wix customer base. The strategic case for buying Base44 was not just the product. It was the optionality of running both, observing which framing wins citizen developers in 2026 and 2027, and consolidating later.

For Base44 customers, this matters because product roadmap decisions in late 2026 and 2027 will be influenced by whether Base44 is converging with Wix Harmony or remaining distinct. The integration surface, the pricing strategy, and the AI model selection are all candidates for cross-pollination. The platform you are buying today is one snapshot of a product that is being actively reshaped by a parent company with two parallel bets in the same market.

That is not a reason to avoid Base44. It is a reason to read the Terms section on platform modification carefully, because the Terms reserve Wix’s right to change Base44 substantially. If Wix decides to fold Base44 into Wix Harmony, or to fold Wix Harmony into Base44, the user-facing product can shift in ways your usage contract may not protect against.

Founders, in general, do not stay at companies after liquidity events. Maor Shlomo’s earn-out structure ties him to performance through 2029. That is unusual for a deal of this size and a useful signal that Wix wanted continuity, not just IP. The signal does not, on its own, predict the product roadmap. It does suggest the parent company is treating Base44 as a long-running bet rather than a feature acquisition.

Read your purchase decision in that light. You are not just buying an AI app builder. You are buying a position inside an unsettled product strategy at a public company.


Deep Dive 8: The Compliance Liability Transfer

The clearest sentence in Base44’s legal documentation is also the most consequential one.

Base44’s DPA places the controller designation on the user. If you build an app on Base44 and that app collects personal data, you are the controller. Base44 is the processor. The legal duty to ensure that data is collected lawfully, processed lawfully, stored lawfully, and deleted lawfully is yours.

That is standard for SaaS infrastructure. It is unusual when the buyer is, by Base44’s own marketing, a non-technical citizen developer who chose Base44 because they did not want to deal with compliance.

The implication is a liability transfer that the pricing page does not describe. A non-technical founder who ships a Base44-built CRM to their customers becomes, by the DPA, the data controller for those customers’ personal data. The founder, not Base44, signs the DPA with their downstream customer. The founder, not Base44, holds the legal responsibility for breach notification under GDPR. The founder, not Base44, defends a regulatory inquiry.

Base44 will help. Base44 will provide tooling. Base44 will not become the data controller for the founder’s customers, because doing so would expose Base44 to liability for every app built on the platform, and no managed AI builder is structured to absorb that.

This is fair. It is also invisible at the moment of purchase. The pricing page sells speed. The DPA, several clicks away, defines what speed cost the buyer agreed to absorb.

The EU AI Act, in force since August 2024 and increasingly enforced in 2026, adds a second layer for builders shipping to EU users. Article 50 of the Act imposes transparency obligations on providers of AI systems that generate or manipulate content, including content presented to users as AI-generated. A Base44-built app that uses the platform’s generation features in ways that produce outputs for end users is potentially subject to those obligations, and the obligation falls on the deployer of the app, which is the founder, not on Base44, which is the infrastructure provider.

I am not a lawyer. The exact scope of Article 50’s application to a particular Base44 app depends on the app’s design, its user base, and its deployment context. The general point is that EU-facing builders should review Article 50 with counsel before publishing.

For US-facing builders, the equivalent surface is the FTC’s enforcement posture on misrepresented AI capabilities and on data handling. The same logic applies. Base44 provides the platform. The builder makes the representations. The builder owns the regulatory risk.

The structural pattern across all of this is that Base44 is a tool, the Terms make it a tool, and the customer is a builder with a tool, not a customer being served. That is the right way to think about every managed AI platform in 2026. It is also the part the marketing reliably understates.

If you ship a Base44 app to anyone other than yourself, write down who the data controller is and who the legal duty falls on. If that name is yours and you are not prepared to defend it, you have not bought a builder. You have bought a regulatory exposure with a pricing screen attached.


Localization Theater

Base44 has a language selector. It offers English, German, Spanish, French, Portuguese, Japanese, and Italian. On April 29, 2026, I set the interface to Japanese and ran the test from a Japanese IP on an iPhone over 4G.

The interface elements translated. The AI did not.

The Plan Mode questions arrived in English. “Who is this app for?” “What’s the primary way you want to organize tasks?” “What key details should each task have?” The answer options were English. The post-generation Kanban app rendered in English: To Do, In Progress, Done, with dummy data labeled “Write weekly status report,” “Review pull requests,” “Update dependencies.”

Base44 generated Kanban-style task management app with three To Do items, one In Progress item, and one completed task. All UI elements and dummy data rendered in English including pull requests, npm audit, Git, and README references, despite the user interface being set to Japanese during generation. Captured April 29, 2026 at 13:22 JST.
Japanese UI request English generated app Tasks include Review pull requests npm audit and Git README as dummy data regardless of UI language

The localization stops where the work starts.

This is not an objection to Base44 in particular. Most AI builders in 2026 train their generation pipelines on English-heavy corpora and produce English output by default, with localization being a separate downstream concern. The objection is to the marketing implication that a seven-language interface is the same thing as a seven-language product.

For a Japanese builder shipping to a Japanese audience, the gap is operational. Every generated string has to be translated by hand or by a second AI call before the app is usable. The English Kanban output is, in practice, a starting template rather than a finished app for that market.

There is a workaround. You can prompt Base44 in English with explicit instructions to generate Japanese strings, and the platform will comply. The Japanese-UI surface is not where you do that work. The work is done in English regardless of which language the UI claims to support.

The marketing presents the language selector as if it determines the product behavior. The product behavior is determined by the underlying model, which speaks English first and other languages on request. The selector changes labels. It does not change the AI.

Read the language menu as a UI translation, not as a product capability. Plan your localization workflow accordingly.


If you searched “Base44 review” in April or May 2026 and read what ranked in the top results, you read mostly affiliate content.

I evaluated several English-language Base44 reviews from publishers ranking in the top search results during research for this article. The majority either contained explicit affiliate disclosures or used referral-tagged outbound links to Base44 without disclosure. The minority that did not run affiliate links were either competitor positioning pieces or smaller independent publishers with significantly less distribution. None of the reviews I read at the time covered the subprocessor documentation inconsistency, the StatusGator availability log, the compliance liability transfer in the DPA, or the pricing-table-versus-FAQ contradiction on integration credits.

This is not a slight against affiliate reviewers. Affiliate review is the dominant economic model for SaaS coverage in 2026, and it produces real value: speed, accessibility, and a clear comparison surface for buyers who want a list of features. It also has a structural bias against the kind of criticism that would cost a commission, and that bias is detectable in the reviews if you read them in sequence.

Base44’s own affiliate program, per the company’s public affiliate page, offers $100 per referral with a $300 minimum payout and a 30-day cookie. The economics are simple. A reviewer with moderate traffic on a “Base44 review” page can earn meaningful monthly revenue from positive coverage. The same reviewer earns close to nothing from a critical analysis that recommends the reader pause.

I am not running affiliate links on this review. That is not a moral position. It is an information-quality choice for this specific article, made because the review’s value depends on the reader trusting that the failure modes are accurately weighted. The next FSR review may include affiliate links where the product earns them.

If you read a positive Base44 review elsewhere and want to triangulate, check the URL for a referral parameter or check the page footer for an affiliate disclosure. Both are usually visible. The presence of an affiliate relationship does not make a review false. It does change which questions the review is structurally incentivized to ask.

Read three reviews, not one. At least one of them should be from a publisher that has nothing to gain from your signup.


Academic Literature Is Empty

There is almost no peer-reviewed research on AI app builders as a category in May 2026, and what exists predates the post-acquisition landscape Base44 now operates in.

The closest adjacent works are Alfonso et al.’s 2024 arXiv paper on low-code platform migration costs, Virk et al.’s 2025 IEEE VL/HCC paper on non-programmer verification of AI-generated code, and Yetistiren et al.’s 2023 HumanEval-based study of AI code completion accuracy. Each of these is useful as background. None of them is about Base44, or about a platform structured like Base44.

The questions the field has not yet answered with controlled studies include citizen-developer productivity measured against engineer baselines, long-term maintainability of AI-generated apps over twelve to twenty-four months, and user-behavior responses to quota-based SaaS pricing under timer pressure. A platform like Base44 will generate evidence for all three by existing. The research community has not yet structured studies around it.

This article is not academic research. It is one tester’s structured observation, paired with primary-source document review. It is not a substitute for the kind of evidence that does not yet exist. It is the kind of evidence available in 2026, and the absence of better evidence is itself a reason for caution rather than enthusiasm in production-bound decisions.

If you are making a procurement decision that touches more than a quarter’s budget on a Base44-built app, vendor materials describe the upside, structured reviews describe the failure surface, and academic research does not yet describe either. Allocate budget under that uncertainty.


Who Should and Shouldn’t Use Base44

Best for:

Non-technical founders building internal tools or contained side projects this week, who need a working artifact more than a portable codebase. Designers and PMs prototyping for stakeholders, where the prototype is a communication tool rather than the production system. Solo builders learning AI app generation as a category, who can use Plan Mode as a free learning surface and accept the credit limits as a budget. Teams using Base44 as a wireframe-with-data layer that will be rebuilt by engineers later.

Not for:

Anyone shipping a production app that touches customer PII without an engineering review of the SDK dependencies, the subprocessor documentation, and the compliance liability transfer. Regulated businesses (healthcare, financial services, education with minors) where the controller designation in the DPA materially changes the risk profile. Teams that need contractual SLA commitments beyond what Base44’s Terms currently offer. Builders shipping to EU markets without legal review of Article 50 obligations specific to their app’s behavior.

The platform is genuinely good at what it does. It is not equally good for everyone, and the marketing surface does not draw the line. The line is in the Terms, in the DPA, in Exhibit C, and in the StatusGator log. This review draws it where those documents draw it. If you sit on the safe side of that line, Base44 in May 2026 is worth your time and money. If you sit on the other side, read your contracts twice before clicking yearly.


FAQ

Is Base44 worth it in 2026?

For prototypes, internal tools, and learning, yes. Base44 produces working web apps from natural-language prompts faster than any competitor I tested in April 2026, and the Plan Mode workflow is genuinely free. For production apps with customer data, the answer depends on whether your team is comfortable with the platform’s lock-in surface, the DPA’s controller designation, and the documentation inconsistencies in Base44’s subprocessor disclosures. Read the Terms before clicking yearly.

Can I export my Base44 app to another platform?

You can export the code as a ZIP file or connect a GitHub repository on Builder plans and higher. Base44’s published SDK explicitly supports building external apps that use Base44 as a backend service, so you can run a frontend or auxiliary backend outside Base44 with minimal rewriting. What requires significant engineering work is leaving Base44 as the backend entirely. The exported code expects base44-sdk calls that resolve to Base44’s hosted database, authentication, and storage. To run the same app against a different backend, every SDK call has to be rewritten. Exporting the code does not export the runtime. Plan accordingly.

What’s the catch with Base44’s free plan?

Two caps, not one. The marketing version is 25 message credits per month. The active constraint is a 5-daily-credit cap that, at 1.5 daily credits per simple build (the rate I measured on April 29, 2026 with a Kanban-style app), works out to approximately three full builds per day for similar app complexity. Base44 documents that more complex apps consume more credits per build. The free plan is closer to a 3-build-per-day trial than to a permanent free tier, especially during the 48-hour onboarding window when a 30% yearly discount is being pushed.

Does Base44’s pricing match what their landing page shows?

Not always. The landing page defaults to yearly billing (20% below monthly). The post-signup pricing page adds a 48-hour campaign offering a further 30% off yearly plans, with strikethrough framing that compares against the already-discounted yearly base. Stale promotional copy from late 2025 is still embedded in the page source as of May 2026 without rendering visibly. The published pricing is accurate. The pricing surface a new account actually sees is layered on top of it. Open both the Monthly and Yearly tabs and screenshot what you agreed to before clicking purchase.


FSR Verdict

▶ FSR Verdict · Base44, May 2026

Base44 is one of the strongest AI app builders in 2026 for one specific job: turning a rough idea into a working hosted app before the buyer has had time to set up infrastructure. That speed is real. It is also the source of the risk.

Recommended
Prototypes, internal tools, stakeholder demos, and contained apps where Base44 remains the runtime. Use Plan Mode generously. Budget three free builds and one paid month before committing to yearly.
Not recommended
Production apps with customer PII, regulated workflows, or projects that must be portable off Base44’s backend without engineering work. Read the Terms, DPA, and Exhibit C before signing yearly.
Tier: B · 86 min hands-on (Apr 29, 2026) + research through May 14
Pricing verified on May 14, 2026 · base44.com/pricing
DPA / Subprocessor list verified on May 14, 2026 · base44.com/dpa/exhibitc

Base44 is one of the strongest AI app builders in 2026 for one specific job: turning a rough idea into a working hosted app before the buyer has had time to set up infrastructure. That speed is real. It is also the source of the risk.

For prototypes, internal tools, and stakeholder demos, Base44 is easy to recommend. Plan Mode is free, the first build can be fast, and the platform handles the backend, database, authentication, hosting, and deployment work that usually slows non-technical builders down. Use it. Test the platform with the free plan, take three full builds, and decide before the 48-hour timer closes.

For production software, the recommendation reverses. The question is not whether Base44 can build the app. The question is what remains tied to Base44 after the app works, and how that tether interacts with the legal duty attached to your customer data.

The safest way to describe Base44 is this: you may own the generated output, but you do not automatically own an independent runtime. The export gives you code access. It does not remove the dependency on Base44’s backend, SDK, hosted auth, database model, or compliance allocation. You can build external apps against Base44 as a backend through the published SDK. Leaving Base44 as the backend is a separate project that requires engineering time proportional to the size of the app.

Use Base44 when speed matters more than infrastructure control.

Do not use Base44 as the default production stack for customer PII, regulated workflows, or apps that must be portable without engineering work.

This review describes the platform as it stands on May 14, 2026. The pricing surface, the documentation surface, and the compliance surface will all change as Wix continues to invest in Base44 through 2029. Re-read the Terms and DPA at the next renewal. The parts of this article most likely to need updating are the parts most worth verifying directly before you commit.

That is the recommendation. Take it or leave it.


Review Methodology
Hands-on duration: 86 minutes, April 29, 2026, 13:14–14:40 JST
Test device: iPhone, Safari, 4G connection, Japanese UI
Pricing reconfirmation: May 10, 11, and 14, 2026
DPA / Subprocessor verification: May 14, 2026
Research tools: Consensus Pro, Perplexity Pro, SuperGrok, NotebookLM
Affiliate relationship: None at time of publication (May 2026)
This was a Tier B review.