How we scored the best vibe coding tools for people who can't code

This page shows the working behind the best vibe coding tools for people who can't code: the field, the criteria and weights, what each score means, and every score with the evidence behind it.

Everything here comes from desk research: each vendor's pricing page, help center, terms and security pages, plus published security research and incident reports. We did not build an app in any of these tools for this version of the page. All facts were read on October 21, 2026.

The question and the reader

The question, in the reader's words: "What's the best vibe coding tool for someone who can't code?" People also search for the best free vibe coding tool, the best vibe coding tool for app development, "Lovable vs Replit", "Lovable vs Base44", "v0 vs Lovable", "Lovable vs Emergent" and the best AI app builder. We asked four AI models (GPT, Claude, Gemini and Perplexity, through their APIs with web search on) five versions of the question in October 2026, which gave 20 answers. Those answers, the pages they cite and the top search results for "best vibe coding tools for non developers" and "best AI app builder" on October 21, 2026 built the field below.

The reader doesn't write code and wants a working app that other people can use: a sign-in, saved data, maybe payments, on a real web address, and often on their phone. They want to know which tool gets them there, what it really costs, and whether they can take the app with them if they leave.

Must-haves

A tool had to pass both to be scored. These are filters, not criteria.

1. You describe the app in plain language and the tool builds it in a browser or app, with no editor, terminal or Git needed.
2. The tool can put the app online for other people to use.

The field

"Named" counts the 20 AI answers that recommend or discuss the tool.

Tool	Named	Decision
Lovable	19	Scored
Bolt	17	Scored
Replit	15	Scored
v0	14	Scored
Cursor	9	Not scored: a code editor for developers; it doesn't host apps and assumes you work with files, a terminal and Git (cursor.com)
Base44	8	Scored
Devin Desktop (formerly Windsurf), Claude Code, Codex, GitHub Copilot, Google Antigravity, Cline, Roo Code, Aider, OpenCode	1 to 6 each	Not scored: coding agents that work in a code editor or terminal on files you manage, which fails must-have 1. Claude Code on the web works on a GitHub repository and hands back a branch and a pull request, and doesn't host the app (Claude Code in the cloud)
Claude (apps built in claude.ai)	6	Scored. Most answers mean Claude's artifacts: small apps built in a chat and shared from claude.ai
Softr, Bubble, Glide, Retool, Microsoft Power Apps, WeWeb, Airtable Omni, Superblocks	1 to 4 each	Not scored: no-code builders where AI drafts a starting point and you build in a visual editor or inside a data platform, or internal-tool platforms for companies. A different way of working, and a different question
Google AI Studio	2	Scored
ChatGPT	1	Not scored this round: named once, with Claude, as a zero-setup way to try small apps in a chat. OpenAI's help center refused our requests, so we couldn't confirm whether an app built in ChatGPT can be published for other people to use
Figma Make, Hostinger's AI builder, CatDoes, FlutterFlow, Draftbit, Adalo, Appy Pie, Choicely	1 each	Not scored this round: each named once, mostly by its own vendor's page or for phone apps built in a visual editor. Figma Make starts from a Figma design
Taskade Genesis	0	Not scored this round: it appears only in Taskade's own comparison pages, which three answers cite; no answer recommends it
Rork, Blink.new, Fuzen	0	Not scored this round: they appear in the top search results or the roundups those results link to (Fuzen on its own site), but in none of the 20 answers. Rork is named for phone apps in several roundups
Emergent	0	Scored. Not named in our sample, but people search for "Lovable vs Emergent" and it appears in the comparison pages the answers cite
Firebase Studio	0	Not scored: Google stopped new sign-ups and new workspaces on June 22, 2026 and shuts it down on March 22, 2027. Google points people to Google AI Studio, which is scored

Criteria and weights

These were set before any tool was scored.

Criterion	Weight	What it measures
Built-in backend	25	Whether sign-in for your app's users, a database, file storage, payments and hosting on your own domain come with the tool, without opening accounts elsewhere
Cost to build and run	25	The cheapest monthly plan that keeps you building and keeps one app live, what the free plan lets you finish, and how well you can cap spending
Ownership and leaving	20	Whether you get the code, and whether the app (with its data and user accounts) can run somewhere else
Safety nets	20	Automatic security checks on the app, protection for your live data, and the tool's security record
Phone apps	10	Whether the tool builds real iPhone and Android apps and helps you publish them to the app stores

Why these weights: a person who doesn't code can't wire up a database, a sign-in service and a payment provider by hand, so what comes built in counts most, along with the money. Ownership and safety are the two things people find out too late: when they try to leave, and when their users' data leaks. Phone apps matter to many readers: 9 of the 20 AI answers raise phone or app-store apps without being asked, and "best vibe coding tools for app development" is a common search. Most of these tools build web apps first, so phone apps count for less.

How much the weights decide: with phone apps weighted at 0, Lovable would lead (8.33 against Bolt's 8.11 and Replit's 8.00, on the other four criteria). Moving 7 of Phone apps' 10 points to Built-in backend is enough to put Lovable first. The page says so, and its decision rules send web-only readers to Lovable.

Not scored: how well each tool builds. Whether a tool turns the same description into a working app, how many prompts it takes, and how many credits it burns on the way are the questions readers care about most, and documentation can't settle them. A few people have published same-brief tests, and we read them: AI Alleyway's test (August 2026, one run per tool, seven tools including Lovable, Bolt and Replit, all of which met its six requirements), Pawel Jozefiak's cost diary (October 2025, one project in Replit, Lovable and v0, costing $127, $78 and $23), and a LinkedIn post timing one app in Bolt, Base44, Replit and Lovable. Each is a single run, two predate 2026 pricing, and none covers this whole field, so none can support a score. A larger review on TechSifted gives editorial ratings without saying each tool got the same brief.

What each score means

Built-in backend: the sum of five parts, up to 10

Part	Points
A. Sign-in for your app's users	2: email and social sign-in built in, with no outside account. 1: only one way to sign in, sign-in through an outside service you connect, or viewers must have an account with the tool's company. 0: none
B. Database	2: a database run by the tool, with no outside account. 1: a database the tool sets up in an outside service under a new account, or text storage only. 0: none
C. File storage	2: built in. 0: not built in
D. Payments	2: the tool creates your live payment account for you through its own sign-up form, on its entry paid plan. 1: the tool sets up a test sandbox that you claim with your own Stripe account (or by verifying your identity) to go live, a guided setup with your own Stripe keys, or built-in payments only on a higher plan. 0: none documented
E. Hosting on your own domain	2: hosting included and a custom domain on the entry paid plan. 1: hosting included, but custom domains aren't documented or commercial use needs another paid plan. 0: no public hosting (viewers must sign up with the tool's company)

What a 10 looks like: the tool hands you sign-in, a database, file storage, payments and your own domain without an outside account. A 6: a database and sign-in through outside services and hosting that needs another plan for a business. A 2: a page that only the tool's own users can open.

Cost to build and run: the sum of three parts, up to 10

Part	Points
A. Price	The month-to-month price of the cheapest paid plan, or plans, that let you keep building and keep one app live with sign-in and saved data, including any hosting plan the tool requires for commercial use. 4: $20 or less, with hosting one app costing no more than a quarter of the plan's allowance (or free). 3: up to $25, or $20 with hosting that uses more than a quarter of the allowance. 2: up to $35. 1: more than $35
B. Free plan	3: a renewing allowance, and the free plan publishes a public app that stays up. 2: a renewing allowance, but the published app is limited (taken down after a time limit) or the allowance is small. 1: you can try it, but you can't publish on the free plan, or the free credit is one-time. 0: no free plan
C. Spending control	3: you can't be charged beyond what you set, and building draws on a separate allowance from hosting, so heavy building can't take your live app offline (the app can still pause at a hosting cap you set). 2: you can set a hard limit, but building and the live app draw on the same credits or budget, so parts of the live app stop when they run out; or building and hosting are separate but a hard cap on hosting charges isn't documented with the tool. 1: parts of the live app stop when credits run out and there's no way to buy more mid-month, or the behavior isn't documented. 0: open-ended charges with no cap

Ownership and leaving: the sum of two parts, up to 10

Part	Points
A. Getting the code	4: two-way GitHub sync on the free or entry paid plan. 3: two-way sync only on a higher plan, a one-way push of the full code to GitHub on the entry plan, or code sync whose direction isn't documented. 1: copy or download of a single page only. 0: none
B. Leaving with the app working	6: a standard stack, and the database and user accounts live in accounts you own or export in a standard format, so the whole app can run elsewhere. 4: a standard stack and a full database export, but some built-in services (sign-in, AI, storage) must be replaced. 2: the code runs elsewhere, but the database or sign-in must be rebuilt or exported table by table, or no export is documented. 0: the vendor says the app can't run without its own backend

Safety nets: the sum of three parts, up to 10

Part	Points
A. Security checks on your app	4: an automatic check on every publish that covers who can read your app's data, on every plan. 3: a full review of the app's code and data rules that you start yourself, at no extra charge on the entry paid plan. 2: a review only on higher plans, or dependency scanning only. 0: none documented
B. Protecting live data	3: separate test and live databases, or point-in-time restore, on the entry paid plan. 2: automatic daily database backups on the entry paid plan. 1: version history for the code only, or backups only on top plans. 0: nothing documented
C. Security record	3: no known incident that exposed or destroyed the data of apps built with the tool. 2: a flaw fixed quickly with no evidence of exploitation, a platform incident that exposed some settings, exposure findings whose details the vendor says it wasn't given, or an incident in which the tool's AI deleted a user's data that was then restored. 1: a flaw in default setups that exposed the data of many apps

Phone apps

• 10: builds native iPhone and Android apps and documents publishing to both stores without a Mac or a terminal.
• 7: native apps for both platforms, but publishing needs a terminal, or one store isn't supported yet.
• 5: wraps the web app in a store app.
• 3: native apps for one platform only.
• 0: web apps only.

Publishing to the stores also needs your own developer accounts: Apple's costs $99 a year and Google Play's $25 once, whichever tool you use.

Scores

Everything was read on October 21, 2026.

Bolt: total 8.0

Criterion	Score	Evidence
Built-in backend	9	A 2: email sign-in built into Bolt Database; Google sign-in needs your own Google credentials (authentication). B 2: "Bolt creates a database automatically if your project needs one", on every plan (database). C 2: "Bolt includes built-in file storage" (file storage). D 1: Stripe needs "A Stripe account (individual or business)" (Stripe). E 2: hosting on every plan, and "Custom domains are only available for Pro users" (hosting). 2 + 2 + 2 + 1 + 2
Cost to build and run	9	A 3: Pro is $25 a month for 10 million tokens month to month ("the $25 Pro 10M monthly plan", billing), or $18 a month billed yearly ($216) (pricing); hosting is included. B 3: Free has 1 million tokens a month (300,000 a day) and hosting for up to 10 GB and 333,333 requests a month, with a Bolt badge (tokens; hosting plans). C 3: token plans don't charge overage, unused tokens roll over for two months, and hosting has its own allowance, so building can't use it up. Extra traffic on Pro is billed only "up to a spending cap you set"; "Once the cap is reached, the site will pause until your usage resets", and free sites "stay offline until usage resets" (hosting plans). 3 + 3 + 3
Ownership and leaving	7	A 4: GitHub sync commits every working change and "checks GitHub every 30 seconds for any updates made outside Bolt" (GitHub); "All code that you create with Bolt ... is your own code" (commercial use). B 3: the download runs with "npm install && npm run dev" (projects and files). Bolt's Supabase page says Pro users can claim their Bolt database into their own Supabase account (Supabase), but its database page says "There's currently no supported way to migrate an existing Bolt database to Supabase" (database). With the two pages in conflict, we scored between 2 and 4. 4 + 3
Safety nets	7	A 3: a project security audit of code and database that "fixes what it can" and uses no tokens, on paid plans, plus a database security check on all plans (security). B 1: Bolt saves a version after every prompt, but "Restoring to an earlier project version will not change your current Bolt or Supabase databases" (backup and restore); no database backups documented. C 3: no published incident found. 3 + 1 + 3
Phone apps	7	Builds iPhone and Android apps with Expo and publishes to the App Store and Google Play, but store builds mean downloading the code and running eas build in a terminal, with "paid developer accounts for Apple and Google" (Expo)

Replit: total 7.9

Criterion	Score	Evidence
Built-in backend	9	A 2: Clerk Auth sets up email, Google, GitHub, Apple and X sign-in for your app's users, "You don't need a Clerk account" and it is "free for now" (Clerk Auth); Replit Auth is the alternative, using Replit accounts. B 2: Replit Database, "Managed PostgreSQL ... built into every Replit App" (integrations overview). C 2: App Storage, Replit's built-in object storage. D 1: on Core and Pro, the Agent "sets up a Stripe sandbox", which you claim with a Stripe account to go live (Stripe payments). E 2: hosting included, and custom domains cost only what your domain provider charges (custom domains). 2 + 2 + 2 + 1 + 2
Cost to build and run	7	A 3: Core is $20 a month, or $18 a month billed yearly, with $20 of monthly credits and up to 30 hours of no-cost Agent work in Free Mode (pricing; pricing and plans). Hosting is paid from those credits: an Autoscale app's base fee is $1 or $2 a month (Replit's publishing costs say $2, its August 2026 price table says $1) plus compute and requests, and the live database is billed at $0.16 for each hour it is active, counting "an additional 5-minute period after the last request" (database billing). A quarter of the allowance, $5, buys about 31 active database hours a month, so an app used through the working day needs more. 3 rather than 4. B 2: Starter is free with a daily Agent allowance, but its one published app "expires after 30 days but can be re-published" (publishing costs; Starter plan). C 2: you can set a usage limit, and Replit "asks for confirmation before a paid action starts"; building and hosting draw on the same credits, and when the limit is reached "services will be suspended until the budget is increased or the next billing cycle begins" (managing spend). 3 + 2 + 2
Ownership and leaving	8	A 4: "Turn on auto-sync in the Git pane for two-way syncing", and any project downloads as a zip (projects and files). B 4: the production database is PostgreSQL that "any PostgreSQL-compatible SQL client" can reach with its connection string (connection details), but Replit Auth and App Storage are Replit services you would replace. 4 + 4
Safety nets	8	A 3: a package firewall on by default, automatic dependency scans, a Security Agent that audits the code, and an option to block publishing with critical vulnerabilities (security overview). B 3: separate development and production databases; "Agent is not able to modify the production database", though "At the time of publishing, any changes you've made with Agent to the structure of your development database (adding and deleting columns or tables) are applied to your production database" (development and production); Core restores the production database to any point in the last seven days (data recovery). C 2: in July 2025 Replit's agent deleted data from a user's database during a code freeze; the user restored it with Replit's rollback (Replit's account; The Register), and Replit then added the database separation above. Replit was also among the platforms in RedAccess's May 2026 exposure research (see Lovable). 3 + 3 + 2
Phone apps	7	Builds iPhone and Android apps with React Native and Expo and guides you to TestFlight and the App Store with an Apple Developer account; "Publishing to Google Play is not yet supported by Replit" (building mobile apps)

Lovable: total 7.5

Criterion	Score	Evidence
Built-in backend	10	A 2: email, phone, Google, Apple, Microsoft and other sign-in methods are part of the built-in backend (Lovable Cloud). B 2 and C 2: "a database, storage, authentication, realtime, and functions" built in (same page). D 2: "Built-in payments are currently powered by two providers: Paddle and Stripe", on Pro and up; "Lovable displays a short form to create your payment provider accounts", and Paddle acts as merchant of record, handling sales tax (payments). E 2: publishing is free and custom domains are on paid plans (custom domain). 2 + 2 + 2 + 2 + 2
Cost to build and run	8	A 3: Pro is $25 a month for 100 credits, or $250 a year, plus 5 build credits a day, a monthly grant of 20 Cloud credits and 4 AI credits (subscription plans); hosting small apps "does not cost anything" (pricing). B 3: Free has 5 build credits a day, up to 30 a month, plus the same monthly Cloud and AI grants, and publishes public apps (subscription plans; credits and usage). C 2: you can set usage limits that block spending and an auto top-up cap (out of credits); but building and the backend draw on the same credits, and when the Cloud grant and credits are gone, "Lovable pauses your app's backend services, such as the database, storage, and authentication", and AI features in the app stop, while the pages stay up (same page). 3 + 3 + 2
Ownership and leaving	8	A 4: two-way GitHub sync on every plan, including Free (GitHub; subscription plans). B 4: the database export "contains your full database, both structure and data", including users, as a standard PostgreSQL archive (database backups); but "A clone gives you the code, not the services the app calls", and Lovable's AI and connector credentials "cannot be copied out" (Git sync overview). 4 + 4
Safety nets	7	A 4: a quick security scan "runs automatically every time you publish" and checks database access rules and dependencies, on every plan (security). B 2: "Lovable backs up your project's database every day" (database backups); no separate test database. C 1: CVE-2025-48757: Lovable projects with a database "created on or before April 15th, 2025, but may also affect projects created after that date" had missing or insufficient row-level security, which let anyone read or write their tables. Lovable disputes the classification and says each customer is responsible for protecting their app's data (CVE record). The researchers list their organization as Replit, Inc. In May 2026 the security firm RedAccess reported 380,000 publicly reachable assets built on Lovable, Base44, Replit and Netlify, about 5,000 of them holding sensitive corporate data. Replit said it got only 24 hours' notice; Lovable and Base44 said the researchers didn't share the addresses needed to verify the findings; none of the platforms denied the exposed apps existed (VentureBeat, May 2026). 4 + 2 + 1
Phone apps	0	Lovable builds web apps. Its iPhone and Android apps are for building projects from your phone, not for publishing your app to the stores (Lovable mobile app)

Emergent: total 7.4

Criterion	Score	Evidence
Built-in backend	9	A 2: Emergent Auth builds in Google and email sign-in, "included at no additional cost", with no API keys or outside accounts (Emergent Auth). B 2: a MongoDB database included with every published app (database). C 2: Emergent Object Store; "No AWS account, bucket creation, access keys, or environment-variable configuration is required" (file storage). D 1: a managed Stripe sandbox that you "claim" and complete identity checks to go live, or your own Stripe keys (Stripe). E 2: hosting at an emergent.host address, and custom domains on Standard and above (plans and the free tier). 2 + 2 + 2 + 1 + 2
Cost to build and run	6	A 3: Standard is $20 a month, or $17 billed yearly, with 100 credits (pricing). Hosting is paid in credits: the Starter publishing tier uses 50 a month, half the allowance, and Emergent says it "is not suitable for production apps under meaningful load"; the next tier, Launch, uses 125, more than Standard includes (publishing plan levels). B 1: the free plan can't publish; the help center says "10 credits on your first day" (plans and the free tier), while the pricing page says 10 free monthly credits. C 2: you can set a maximum number of credits per prompt, and at zero "the platform pauses all active generation, builds and publishes ... There is no overage billing"; top-ups start at 250 credits for $50 and never expire. Building and hosting share one balance, and a balance still negative after renewal means "your published app may be taken down" (managing credit usage). 3 + 1 + 2
Ownership and leaving	7	A 3: "Save to GitHub" on Standard and above pushes the full code, but "There is no pull or in-platform merge available mid-project" (workspace tour). B 4: React, FastAPI and MongoDB, all standard, and you can export the database "at any time with mongodump" (your data and ownership); Emergent Auth, the Object Store and Emergent's AI key are Emergent services you would replace. 3 + 4
Safety nets	6	A 0: Emergent's pre-publish health check is a checklist for you to work through; no automatic security check on generated apps is documented (pre-publish health check). B 3: after the first publish, "the two databases are independent", and later preview work doesn't touch live data (preview vs published); Emergent keeps routine production backups, which "are not a self-serve restore service" (your data and ownership). C 3: no published incident found. 0 + 3 + 3
Phone apps	10	Builds iPhone and Android apps with Expo and runs the store builds in Emergent's cloud: "you do not need an Expo account, the eas-cli, or any local build tooling", and "no Mac required for iOS". iPhone builds go to TestFlight for you; Android builds are uploaded in the Play Console. Google Play notes that going live "requires 14 days of active testing across 12 real testers" (publishing to the stores)

Base44: total 6.6

Criterion	Score	Evidence
Built-in backend	9	A 2: built-in login pages with email and password, Google, Microsoft, Facebook and Apple (login and registration). B 2 and C 2: "Integrated backend and database system" and "Cloud storage" on every plan (pricing). D 1: "Base44 Payments powered by Wix" and Stripe both need the Builder plan ($50 a month) or higher (Wix payments; Stripe). E 2: "Custom domains are available on the Starter plan and higher" (custom domain), and Starter includes a free domain for one year (pricing). 2 + 2 + 2 + 1 + 2
Cost to build and run	8	A 4: Starter is $20 a month, or $16 a month billed yearly, with 100 message credits and 2,000 integration credits (pricing); hosting has no separate fee. B 3: Free has 25 message credits a month (up to 5 a day), up to five apps and public publishing (billing and plans). C 1: there are no top-ups; "When you reach your credit limit, actions that use credits pause until your next reset", and in a live app "Any action you perform that requires integration credits fails", such as sending email (credits). 4 + 3 + 1
Ownership and leaving	3	A 3: two-way GitHub sync "requires the Builder plan or higher" (GitHub). B 0: "The exported code still relies on Base44 to run, so a ZIP is a copy of your code, not a way to move your app off Base44", and "Base44 doesn't support self-hosting" (developer tools). Data exports table by table as CSV. Base44's pricing page says "Nothing is locked to the platform"; its own documentation says otherwise. 3 + 0
Safety nets	6	A 3: a security scan that checks exposed secrets, unauthenticated backend functions and data access rules, with code vulnerability checks on Builder and up (security overview). B 1: automatic data backups only on Elite and Enterprise (developer tools; billing and plans); deleted records are kept 30 days. C 2: in July 2025 Wiz found that a non-secret app ID let anyone register on private Base44 apps; Base44 fixed it in under 24 hours and found no evidence of exploitation (Wiz). Base44 was also named in RedAccess's May 2026 research (see Lovable). 3 + 1 + 2
Phone apps	5	Store apps run "your published Base44 app inside a secure web view", with store files on Builder and up (app stores)

Google AI Studio: total 6.4

Criterion	Score	Evidence
Built-in backend	4	A 1: the agent sets up Firebase Authentication with "Sign in with Google" when asked (full-stack apps). B 2: a Firestore database, set up by the agent in Google's own Firebase (same page). C 0: Google is "working on adding direct support for storage" (Build mode). D 0: Stripe is mentioned only as an outside service your code can call (full-stack apps). E 1: publishing to Cloud Run, with an ai.studio subdomain (deploying); custom domains aren't documented in AI Studio. 1 + 2 + 0 + 0 + 1
Cost to build and run	9	A 4: building is free within a "Modest quota", with higher quotas in Google AI subscriptions (Google AI plans); the Starter Tier publishes "up to 2 full-stack applications without setting up a Google Cloud project or billing account" (deploying). Not every account qualifies: Google Workspace accounts, anyone with "an active or prior paid Google Cloud billing account", and accounts without "enough evidence from your account activity" may be refused (deploying). B 3: the same free quota and free publishing. C 2: past the free quota you need a Gemini API key with billing, and a published app "will use your API key for all users' Gemini API calls" (Build mode), so building and your app's AI features draw on the same bill. Prepaid billing stops when the balance runs out, and Gemini's billing page describes project spend caps. 4 + 3 + 2
Ownership and leaving	10	A 4: "Connect your app to a GitHub repository to enable two-way sync", or download a ZIP (Build mode). B 6: "AI Studio apps are standard apps running in a Cloud Run container", and you can "host it elsewhere" (Build mode); the Firebase project is in your own Google account. 4 + 6
Safety nets	4	A 0: no security check on generated apps documented. B 1: GitHub sync keeps the code's history; no database backups documented. C 3: no published incident found. Apps are private by default, and people you share with "can see its code and fork it" (Build mode). 0 + 1 + 3
Phone apps	3	Builds native Android apps in Kotlin and Jetpack Compose and publishes them to Google Play for internal testing; no iPhone apps (Build mode)

v0: total 5.1

Criterion	Score	Evidence
Built-in backend	6	A 1: no built-in sign-in is documented; sign-in comes from a connected service such as Supabase (full-stack apps). B 1: one-click databases from Supabase, Neon and Upstash, where "Adding an integration provisions a new user account on that service" (databases). C 2: Vercel Blob, part of the Vercel account v0 already uses (databases). D 1: Stripe through the Vercel Marketplace (agentic features). E 1: hosting on Vercel with custom domains (custom domains), but Vercel's free Hobby plan is for "non-commercial, personal use only", and taking payments counts as commercial (Hobby plan; fair use). 1 + 1 + 2 + 1 + 1
Cost to build and run	4	A 1: Plus is $30 a month with $30 of credits and $2 of free credits a day when you log in (pricing), plus Vercel Pro at $20 a month for a commercial app (Vercel pricing), $50 in all. B 1: new free users get "$5 in one-time credits" and 7 messages a day; "A one-time allowance does not renew", though "Existing Free users keep their $5 monthly allowance" (pricing; v0 pricing docs). C 2: "When credits are used up, generation pauses" (v0 pricing docs), and hosting is billed by Vercel, not from v0 credits; on Hobby, an app over its limits waits 30 days (Hobby plan). We didn't check Vercel Pro's own spend controls. 1 + 1 + 2
Ownership and leaving	10	A 4: GitHub sync on every plan, into a private repository (GitHub). B 6: "Vercel doesn't own the code generated", and you can "export code and deploy elsewhere" (FAQ); the Next.js app's database and sign-in live in accounts you own at Supabase or Neon. 4 + 6
Safety nets	3	A 0: v0 runs generated code in a sandbox, but no security check on the app itself is documented (security). B 1: version history and GitHub; database backups depend on the outside provider. C 2: in April 2026 attackers who had compromised Context.ai, a tool used by a Vercel employee, reached Vercel environment variables not marked sensitive; Vercel told customers to rotate them (Vercel bulletin). 0 + 1 + 2
Phone apps	0	Builds web apps that work on phones; no native app building documented (FAQ)

Claude: total 3.6

Criterion	Score	Evidence
Built-in backend	2	A 1: every viewer needs a Claude account: "People without one can't open a shared artifact, even with the link" (sharing artifacts). B 1: artifacts can store data between sessions, up to "20 MB limit per artifact and accepts text only", on Pro and up (artifacts). C 0. D 0: no payments documented. E 0: artifacts live on claude.ai, open only to people signed in to Claude; no custom domains. 1 + 1 + 0 + 0 + 0
Cost to build and run	9	A 4: Pro is $20 a month, or $17 a month billed yearly (pricing); storage needs Pro. When an artifact calls Claude, "usage counts against each person's own plan limits rather than yours" (artifacts). B 2: Free plans can create and share artifacts, but storage needs Pro (artifacts). C 3: usage limits reset every five hours, paid usage beyond them happens only if you turn on usage credits (pricing), and viewers' use of a shared artifact comes from their own plans. 4 + 2 + 3
Ownership and leaving	1	A 1: older artifacts can be copied or downloaded; the help center doesn't say how to export newer ones (artifacts). B 0: an artifact runs on claude.ai; there is no backend to take with you. 1 + 0
Safety nets	3	A 0 and B 0: none documented for artifacts. C 3: no published incident found. Artifacts start private, and artifacts that use Claude or connected apps can't be shared with "Anyone with the link" (sharing artifacts). 0 + 0 + 3
Phone apps	0	No app-store publishing; the Claude phone apps can view and edit artifacts (artifacts)

The order

Bolt 8.0, Replit 7.9, Lovable 7.5, Emergent 7.4, Base44 6.6, Google AI Studio 6.4, v0 5.1, Claude 3.6. The site computes each total as the weighted average of the scores, rounded to one decimal place.

How close is the top? Bolt leads Replit by 0.1. Bolt wins Cost by 2 points; Replit wins Ownership by 1 and Safety nets by 1. Moving 4 points of weight from Cost to Safety nets, or to Ownership, would put Replit first. Treat the two as a near tie: Bolt is cheaper and simpler to keep online, Replit protects live data better.

Lovable is 0.5 behind Bolt, and the gap comes from Phone apps (Lovable 0, Bolt 7, worth 0.7). With no weight on phone apps, Lovable leads (see Criteria and weights). For a web app only, the top three are within about a quarter of a point.

Emergent (7.4) sits just behind Lovable for the opposite reason: it leads on phone apps and trails on everything a web-only reader weighs most.

Base44 (6.6) and Google AI Studio (6.4) are close for opposite reasons: Base44 has the backend and AI Studio has the ownership.

Changes after review

A reviewer who took no part in the scoring checked this sheet against the sources on October 21, 2026, before publication. What changed:

• Replit, Cost to build and run, 8 to 7. The first version counted only Replit's hosting base fee and missed that the live database is billed by the hour it is active. That puts hosting one app above a quarter of Core's allowance for most apps, so part A is 3, not 4. Replit's total fell from 8.2 to 7.9, and Bolt moved to first.
• Emergent, 5.6 to 7.4. The first version scored Emergent on what its marketing pages said, because its help center showed no content to our browser. Its full text is published as a data feed, and it documents built-in file storage (Backend 7 to 9), credit top-ups with no overage billing (Cost 5 to 6), a database export (Ownership 5 to 7) and separate preview and live databases (Safety nets 3 to 6). Emergent moved from sixth to fourth.
• Anchor wording made precise, with no score changed by it: Payments (part D) now says what "sets up the payment account for you" means; Spending control (part C) now says whether building and hosting share one budget; Getting the code (part A) now places a one-way push to GitHub; Security record (part C) now has a line for an AI deleting a user's data.
• Phone apps weight kept at 10, with the evidence for it added above, and the page now says what happens without it.
• Google AI Studio's "Best free" award removed. Bolt, Lovable, Base44 and Google AI Studio all score 3 on the free plan, so no single tool wins the fact that defines it.
• Replit's Autoscale hosting was described as always on; it idles after 15 minutes without requests. Wording on the RedAccess research and on CVE-2025-48757 was corrected to match the sources.

What we couldn't check

• How well each tool builds the same app, and what it costs in credits to finish. Until we run a same-brief test across this field, build quality is not scored.
• Emergent's developer documentation site (the domain didn't resolve); its help center covered what we needed.
• Bolt's reload prices and Lovable Cloud's per-unit hosting rates, which both companies show only inside the app.
• Replit's custom domain plan requirement, which its documentation doesn't state, and how many active database hours a typical small Replit app uses.
• Whether ChatGPT can publish an app for other people; OpenAI's help center refused our requests.
• The Axios report on the RedAccess research refused our requests; we read VentureBeat's account of it.