Base44, reviewed
Wix's app builder is quick for simple tools. Its security record, its backend, its terms and its credits are why we would not run core processes on it.
Base44 belongs to the same family as Lovable: describe an app in plain language, and it builds the screens, the database, sign in and hosting. Maor Shlomo built it in Israel without outside funding, and in June 2025 Wix bought it for 80 million dollars in cash, plus milestone payments due in 2029. Wix now credits it for much of its growth. It reported about 150 million dollars of annual recurring revenue for Base44 as of May 2026.
The question for a company is not whether Base44 can build an app. It can. The question is whether you should run part of your business on what it builds. Mostly, we think not, and here is why.
What it is good for
Base44 is quick and complete for small jobs. Every plan includes a built in backend and database, so a team can turn a spreadsheet routine into an internal tool, a booking form or a simple portal in an afternoon, and connect its own domain from the Starter plan. For someone who has never shipped software, that is a real door opening.
Wix keeps investing. By May it had added Superagents, a native AI assistant, and an integration that turns Figma designs into Base44 apps. In August it announced Base 1, its own model, to gain more control over what it calls the largest cost driver in AI businesses: compute and inference.
The security record
In our view, Base44's security history is the main reason for caution. In July 2025 Wiz found that anyone could create a verified account on a private Base44 app, including apps protected by single sign on. An attacker needed only the app's ID, which appears in its web address and in public files, and two registration endpoints that should never have been open. Wiz called the flaw “remarkably simple to exploit”. To Wix's credit, it was fixed in less than 24 hours, and Wix found no sign of abuse.
A month later Imperva published three more flaws it had reported in March 2025. An open redirect in the login flow could hand a user's access token to an attacker's site, and the first fix only checked the start of the address, so it had to be redone. Code could be planted on Base44's own domain, because premium features such as editing code were enforced only in the browser. And the platform passed the token of a user's main Base44 account to the apps that user signed in to. Together, Imperva wrote, they opened a path to full account takeover. Imperva said Base44 moved quickly to implement fixes, and it did not report that the flaws had been exploited.
In May 2026 the security firm RedAccess said it had found about 380'000 publicly accessible apps and assets built with Lovable, Base44, Netlify and Replit, about 5'000 of them containing sensitive company information. Base44 said the reports did not include the addresses it needed to verify them, and the figures come from a vendor whose findings the platforms dispute. The mechanism described in the reports is still plain: some of these tools make apps accessible by default, and many such apps were indexed by search engines.
Owning the code is not leaving
Base44's terms say the customer owns the code and applications the platform generates. Leaving is harder. The backend is managed by Base44: a NoSQL database, sign in, serverless functions and realtime updates, all reached through Base44's own SDK. Two way sync with GitHub is available from the Builder plan, at 40 dollars a month billed yearly. Even the one time local copy Base44 offers is registered under a new Base44 app ID, and the documentation we read describes no way to run the backend outside Base44. Take the code, and you take a frontend that still calls home.
The terms have moved too. Since 21 June 2026, Base44 says its paid services are intended for businesses and organisations, and the licence customers grant over their data and generated output is irrevocable, perpetual and worldwide, and covers training Base44's AI models. Base44 may also use some of what you create for promotion. We found no opt out from training in the terms. And Base44 assumes no liability for errors, hallucinations or the code it generates.
Credits, cost and quality
Pricing runs on two kinds of credits: message credits for building, and integration credits for the built in services an app uses once it runs. Billed yearly, Starter costs 16 dollars a month with 100 message and 2'000 integration credits; Elite costs 160 dollars with 1'200 and 50'000. An app with active users spends integration credits every day, so the bill grows with success.
Wix's own figures show how expensive the model is to run. Base44 entered 2026 with an adjusted gross margin near zero, Wix said in August, and it expects about 60 percent in the second half thanks to its own model. That is Wix's problem rather than yours, but in our view it helps explain why credits, limits and terms on platforms like this keep changing.
On quality, our view from using it: Base44 builds convincing screens and demos fast. It is weaker at what a real business needs next: roles that match an organisation, integrations with the systems a company already runs, tests, audit trails, and changes that do not break last week's work. Its terms put the review of all of it on you.
Our verdict
Use Base44 for a prototype, a personal tool or an internal app without sensitive data, and enjoy the speed. Do not put customer data, payments or core processes on it unless someone qualified has checked who can see what, and you accept that the app lives on Wix's backend, under terms Wix can change.
Werk takes the other route. We build web and mobile apps with our clients on our own platform, with roles, sign in, encryption, tests and reviews from the first version, hosted in Switzerland, in the EU or on your own infrastructure. And the source code is yours.
