The short version
- You can look at your code, but you cannot run your app elsewhere. Export covers the frontend only; database, auth, users and server functions stay inside Base44.
- Leaving is a partial rebuild, not a move. The shell transfers; the engine gets rebuilt.
- Costs are credit-gated, not infrastructure-gated. Growth is a ladder of plan upgrades, and when credits run out, live features stop.
- Staying can still be right — for internal tools and validation-stage products, the lock-in is often a fair trade for the speed. The point is to decide it, not drift into it.
What Base44 gives you — and what it keeps
A Base44 app's frontend is a conventional React + TypeScript single-page app on Vite with Tailwind and shadcn/ui, and its server code runs as Deno functions (Base44 docs). Static SPAs only — no SSR (docs). Code export, available from the Builder tier up, hands you that frontend as a ZIP or a one-way GitHub push — there is no path back in, and no two-way sync (HostAdvice).
The backend is the part that never leaves. The database is Base44's built-in, MongoDB-compatible store (docs) — you are never issued a connection string, so nothing outside Base44 can attach to it. Auth — email/password, social login, SSO — is fully managed and proprietary. Server functions are visible and editable, but they execute only through Base44's API. You can call an external database from inside a function for supplementary data, but your users, permissions and core records stay where they are.
What moves with you
The honest comparison with the other platform we have written about, Lovable, is structural — not which is better, but which half of your app each one lets you keep:
| Component | Lovable | Base44 |
|---|---|---|
| Frontend code | ● Moves — full repo, builds anywhere | ● Moves — ZIP / GitHub export (paid tiers) |
| Backend logic | ● Moves — Deno functions in your repo | ○ Stays — executes only via Base44's API |
| Database | ● Moves — your own Supabase Postgres* | ◐ Partial — per-collection CSV export only |
| Auth & users | ● Moves — Supabase Auth, standard JWT | ○ Stays — proprietary; credentials never export |
| GitHub sync | ● Two-way | ○ One-way — out only |
* On Lovable the expensive exception is Lovable Cloud — covered in the Lovable guide. Sources: Base44 docs, HostAdvice, Lowcode.agency. The no-connection-string and function-execution details come from a teardown by a migration vendor (EscapeBase44) — self-interested, so we checked its claims against Base44's own documentation where possible.
What it costs as you grow
Base44 prices by credits, not by infrastructure. Message credits burn when you build; integration credits burn when your live app does things — LLM calls, email, SMS, image generation. Database operations are free, credits do not roll over, and when integration credits run out the app keeps serving pages but stops performing those actions until the month resets or you upgrade (nocode.mba).
Monthly price by tier, annual billing (source). Monthly billing runs ~25% higher.
Integration credits per month by tier — the ceiling on what a live app can do: LLM calls, email, SMS, image generation. Cost per 1,000 credits falls from $8 (Starter) to $3.20 (Elite). If one user session averages a handful of AI-assisted actions, Starter supports a few hundred active sessions a month and Elite roughly ten thousand — the ceiling is behavioural, not a user count, which is why Base44 publishes no hard user cap and community reports of "invisible limits" persist (review aggregation — treat as sentiment, not data).
Two post-acquisition facts belong in any cost projection. Wix bought Base44 in June 2025 for $80M cash (TechCrunch), with earnouts since pushing total consideration past $150M on the back of a reported $150M ARR run-rate (Calcalist). Since the acquisition, independent tracking reports the same tier names buying 15–30% less per dollar, the free tier cut from 100 to 25 message credits, and a platform-wide outage in February 2026 with no contractual SLA (base44devs). None of that makes Base44 a bad product. It makes it a product whose pricing power over you grows with your lock-in — which is exactly the variable you control by deciding, early, what your exit would cost.
The security record
One serious incident is on the record. In July 2025, Wiz Research disclosed an authentication bypass: two API endpoints required no authentication at all, and because an app's ID is visible in its URL and manifest, anyone could register a verified account on a private, SSO-protected Base44 app and read everything inside — internal chatbots, HR tools, knowledge bases (Wiz, The Hacker News). Wix patched it within 24 hours and reported no evidence of exploitation.
The fair reading cuts both ways. The response was fast. But the incident illustrates the structural trade of every closed platform: its controls are the ceiling of your security, and you cannot audit what you cannot access. On Base44 you cannot inspect your auth configuration, your database policies, or your server runtime — the things a security review would normally read first. Whatever your compliance posture requires, it has to be satisfiable through Base44's controls alone, because those are the only ones you have.
Stay or migrate — the honest decision
Staying is right when the app is an internal tool, a validation-stage product, or anything whose users and data you could afford to rebuild; when your monthly credit spend sits comfortably inside a tier; and when nothing in your data (payments, health, identity documents) demands controls you cannot verify. The speed is real and the lock-in is the fair price of it.
Migrating is right when the product has proven demand and is becoming the business; when credit-ladder economics stop making sense against a ~$25–45/month infrastructure bill for an equivalent self-hosted stack; when a customer, investor or regulator asks security questions you cannot answer from inside a closed platform; or when you need capabilities (SSR, background jobs, your own database) the platform rules out.
And be clear-eyed about what migration is here: a partial rebuild. The frontend transfers largely intact. The backend — logic, auth, integrations — is rebuilt against a new stack; data returns via per-collection CSV; and because credentials never export, every user re-registers or resets their password (Perpetio). A small industry of "escape Base44" tools now exists — their marketing overstates, but their existence tells you the demand is real.
Nobody — us included — can size that rebuild without counting what is in your app: entities and collections, server functions, integrations, auth flows, and which of the frontend's assumptions about the Base44 SDK run deep. A quote produced without that counting is marketing.
If you want help
Appaya does this as a fixed-fee review: what your Base44 app actually contains, what transfers and what gets rebuilt, the security posture as far as the platform allows it to be assessed, and a migration estimate in developer-days with the counts it is derived from — so you can check the arithmetic rather than take our word for it. If the honest answer is "stay on Base44 for another year," that is what the report says.