Export the frontend · Keep the backend · Own both instead

Leaving Base44

Base44 claims the code is yours. Not one customer has ever got the backend out!! Their Terms say they warrant no such thing, and there is a paid service that exists purely to rebuild what they keep.

MIT-licensed, all of it — runtime included, so leaving is copying a folder
Self-host on your own hardware, on-premise or air-gapped — or $100/month managed
No message credits, no integration credits, no metering on your app’s traffic

What the export button actually hands you

Base44’s GitHub integration works exactly as advertised. Your code syncs to your repository, you can read it, edit it and commit it. What syncs is the frontend.

Their own developer documentation describes the rest. The database is Base44’s. Authentication is Base44’s. Backend functions run as Deno serverless inside Base44’s runtime. Custom integrations are, in their words, proxied through Base44’s backend. Every one of those is reached from your exported code through the Base44 SDK.

So the repository you own is a React application that calls a backend you cannot export, cannot self-host and cannot run. Two further details are worth knowing before you rely on that export: two-way GitHub sync requires the Builder plan or higher, so on the Free and Starter tiers the mechanism behind “nothing is locked to the platform” is not available to you at all — and once connected, version history from before the integration can no longer be restored.

Leaving does not mean moving. It means rebuilding your backend somewhere else and repointing the frontend at it. That is why a paid migration service exists, advertising more than a hundred completed migrations, and why its pitch promises to recover “the code Base44 keeps hidden.”

Two sentences, one company

The marketing and the contract

SourceWhat it says
Pricing FAQ“You own everything you build on Base44: your code, your data, your users… Nothing is locked to the platform.”
Terms of Service“Company makes no warranties or guarantees regarding the functionality, compatibility, or usability of any such exported Customer Data, including whether such exported data will operate properly in any other environment or system.”
Terms of Service“Customer shall immediately delete and shall not maintain any copy of any component of the Platform… installed or saved on the Customer’s systems or environment.”
Terms of ServiceCompany “reserves the right, in its sole discretion, to delete all Customer Data and Generated Output at any time following termination or expiration” of the subscription.
Terms of ServiceThe licence granted to you is “non-exclusive, non-transferable, non-sublicensable, fully revocable” and lasts “for as long as Company provides you with its services.”

You own the Generated Output. You are contractually required to destroy any copy of the Platform. The Platform is the half that runs it.

The comparison

Magic Cloud vs Base44, honestly

Nineteen rows: seventeen to Magic, two to Base44. The two they take are real, they are listed first, and they are the only two.

FeatureBase44Magic Cloud
Time to a deployed, working appMinutes — no published figureMagic wins — 2 minutes 10 seconds, deployment included
Ease for non-developersBase44 wins — genuinely excellentA developer tool, and honest about it
Frontend generationBase44 wins — polished UI, visual editorHTML and JavaScript from the agent, no visual canvas
IntegrationsA fixed catalogue of roughly seven: Gmail, Slack, Notion, Drive, HubSpot, Salesforce, StripeMagic wins — describe any API in a sentence and the generator writes it, live in seconds; import any OpenAPI spec; headless browser for systems with no API
Operations burdenNone, and no other optionMagic wins — none on a managed cloudlet, upgraded every week; self-host instead whenever you want to
Runtime ownershipFrontend exports; backend cannot be exportedMagic wins — MIT, entire stack, runtime included
Self-hostingNot possible at any tierMagic wins — anywhere a container runs, including air-gapped
If you stop payingWorkspace drops to the free tier’s limits, at their discretionMagic wins — it keeps running, on your hardware, forever
Price shapeTwo credit meters, monthly expiry, no top-upsMagic wins — $100/month flat, or free self-hosted
Your app’s trafficMetered as integration creditsMagic wins — not metered
UsersCountedMagic wins — unlimited, never counted
DatabaseNoSQL, schemas explicitly not enforcedMagic wins — SQLite, MySQL, PostgreSQL, SQL Server, real constraints
Your existing databaseNo path — you build on theirsMagic wins — wrap the one you already have
AuthenticationTheirs — you cannot read, audit or patch itMagic wins — a file in your cloudlet you can change
SSOEnterprise contract onlyMagic wins — eight OIDC providers included
Generated backend codeBehind the SDKMagic wins — readable files, diffable, in git
Sandbox for AI-written codeNoneMagic wins — whitelisted runtime, throws at dispatch
MCP serverNoMagic wins — role-filtered, every endpoint a tool
HostingSPA only, no server-side renderingMagic wins — backend, static sites and SPAs

Speed is not on their side of that table. A Magic cloudlet goes from nothing to a deployed, working application in 2 minutes and 10 seconds, and a complete role-secured CRM backend has been generated in sixty seconds for six cents of tokens.

Nor are integrations. Base44 ships a fixed catalogue of roughly seven services. Magic ships a generator: describe an API in a sentence and it writes, verifies and deploys the integration in seconds, imports any OpenAPI specification, and drives a headless browser for systems that have no API at all. They enumerate; Magic generates — and the reachable surface that produces is not a number you can write down in the ordinary way.

The argument is narrow and it is this: the moment the application is the business, the question stops being how fast you can build it and becomes what happens when the vendor changes its pricing, its terms, or its mind.

When their authentication broke, every customer could only wait

In July 2025, Wiz Research disclosed an authentication bypass affecting private Base44 applications. The exploit needed one thing: the app_id, which was publicly visible in app URLs and manifest files. Two undocumented endpoints, for registration and verification, had no authentication on them. Supply the identifier and you could create a verified account on somebody else’s private application, bypassing SSO entirely.

Wiz confirmed the bypass against real enterprise applications: internal chatbots, knowledge bases, and PII and HR operations. Wix patched it within twenty-four hours and reported no evidence of exploitation, which is a better incident response than most companies manage and deserves to be said clearly.

The bug is not the point. Every platform has bugs, this one included. The point is that not one Base44 customer could have found that flaw, prevented it, audited for it, or fixed it. They did not write that authentication code and they cannot read it. They learned about it from a security company’s blog post, and then they waited.

On Magic, authentication is a slot invocation in a file on your cloudlet. You can read it, test it and change it, and if you find something wrong at four in the morning you can fix it at four in the morning. That is not a feature — it is what owning the runtime means. The same principle governs what AI-generated code is permitted to do, and there is a standing bounty on breaking it.

The meters

Two credit types, and both expire

Message credits are spent when you build. Integration credits are spent by your users, in production — emails, API calls, AI runs, file uploads, automations, backend tasks.

PlanBilled annuallyMessage creditsIntegration credits
Free$025 / month100 / month, max 5 apps
Starter$16 / month100 / month2,000 / month
Builder$40 / month250 / month10,000 / month
Pro$80 / month500 / month20,000 / month
Elite$160 / month1,200 / month50,000 / month
Magic Cloud$100 / month flatNone — not meteredNone — not metered

Both credit types expire monthly and do not roll over. There are no top-ups, so running out in week three means upgrading the whole plan rather than buying a little more. And single sign-on is not on that list at any price — it requires an Enterprise contract. The structural problem is the second meter: your application’s success costs you money in a way that has nothing to do with compute. On Magic your app’s traffic is your app’s traffic, and self-hosting on a $12 droplet costs you nothing at all.

The claim, as published

Their pricing page, captured 22 September 2026

This is not a paraphrase and it is not an old cache. It is the live answer to “Do I own my app, and can I export the code?” on base44.com, on the day this page was written.

Screenshot of the Base44 pricing page FAQ. Question: Do I own my app, and can I export the code? Answer: Yes. You own everything you build on Base44: your code, your data, your users. Two-way GitHub sync exports the full source code to your own repo at any time. Nothing is locked to the platform.

Now set it beside the clause their own Terms of Service require you to accept before you can pay them:

“Company makes no warranties or guarantees regarding the functionality, compatibility, or usability of any such exported Customer Data, including whether such exported data will operate properly in any other environment or system.”

One sentence is on the page that takes your money. The other is in the document that governs what you actually bought. They are published by the same company, on the same day, about the same product.

If you believe you were misled

You have somewhere to take this

Misleading marketing is prohibited in every developed jurisdiction on earth, and the test is close to identical everywhere: was a material claim made that is not true, and did it affect someone’s decision to buy? Base44’s claim sits on one global, English-language pricing page, which means it is published into all of these at once. Reporting costs nothing.

Norway

Misleading commercial practices are prohibited by markedsføringsloven § 7, and a trader must be able to document the factual claims it makes. Separately — and this is the more useful route — digitalytelsesloven, implementing EU Directive 2019/770, provides that statements made in marketing form part of what a consumer has reason to expect from a digital service. If the service does not match, there is a mangel, and the remedies include price reduction and cancellation with a refund. The burden of proof sits on the trader — both to show there is no defect, and to show any defect is insignificant. Fines under mfl. § 42 reach 4% of annual turnover or NOK 25 million, whichever is higher.

Report to Forbrukertilsynetpostmottak@forbrukertilsynet.no, +47 23 40 06 00.

Germany

Misleading commercial acts are prohibited by UWG § 5, with injunctive relief available under § 8. Germany is the jurisdiction that matters most here, because competitors and trade associations have direct standing — no regulator has to be persuaded to act first. A single Abmahnung can require a company to stop making a claim across its entire site.

Report to the Wettbewerbszentrale Beschwerdestellemail@wettbewerbszentrale.de, or the Verbraucherzentrale Bundesverbandbeschwerdestelle@vzbv.de.

United States

Deceptive acts and practices are prohibited by Section 5 of the FTC Act, carrying civil penalties of $53,088 per violation, and by the unfair-and-deceptive-practices statute of all fifty states, enforced by state attorneys general. Businesses harmed by a competitor’s false advertising have a private right of action under Lanham Act § 43(a).

Report to the FTC at reportfraud.ftc.gov, and to your state attorney general.

Elsewhere in the EEA

The Unfair Commercial Practices Directive 2005/29/EC applies across all thirty EEA states, with fines of at least 4% of turnover for widespread infringements under the Omnibus Directive. Your national consumer authority takes the complaint; cross-border cases go through the European Consumer Centres Network.

Read this part too. None of the above is legal advice, and no court or regulator has ruled on any of it. What this page gives you is the text Base44 publishes, the text of the Terms they ask you to accept, the statutes that govern claims of this kind, and the public channels that exist for raising them. Whether any of it applies to your situation is a question for a lawyer or a regulator — not for a competitor’s website, which is exactly what this is. Read both documents yourself and reach your own conclusion.

Now the alternative

Everything above is about what happens when the runtime belongs to somebody else. Here is the other arrangement.

Magic Cloud is MIT licensed — all of it. Not an open core with the good parts held back, not source-available with a competing-use clause, not a licence key that disables features when you self-host. The runtime, the database layer, the code generator, auth and RBAC, the dashboard and the MCP server are one MIT-licensed codebase on GitHub.

Which means you can run the whole thing on your own hardware, for nothing. On a server in your office, in your own cloud account, on a $12 droplet, or air-gapped in a room with no internet connection. There is no tier that unlocks self-hosting, because self-hosting is not a tier. If you never pay me a penny, the software keeps working — and it keeps working if I stop answering emails, sell the company, or get hit by a bus.

What building on it looks like

Describe it. Deploy it. Own it.

You do not click through a builder. You say what you want, and the generator writes verified Hyperlambda into the runtime — real files, on disk, that you can read, diff and commit.

Chat Ops in the Magic dashboard, asked to create a full stack app, replying with the product decisions it needs: what the app does, data source, entities, authentication, frontend design and name
Ask for a full-stack application and it asks back — what the app does, the data source, the entities, the authentication, the frontend design. Product decisions, not configuration screens.
Orbit, a CRM built on a Magic cloudlet in two minutes: overview with live counts of companies, people and open activities, and a recent companies table with industry and pipeline status
The result, two minutes later — a working CRM with live counts, a companies table, pipeline status, a real database behind it and role-gated endpoints in front of it. Deployed, not previewed.
A complete carbon-footprint calculator application built on a Magic cloudlet, showing the branded form and computed results
Another one — a branded carbon-footprint calculator, frontend and backend on the same cloudlet, served from the same process that holds the data.
The Magic Cloud dashboard, showing the full set of platform components available in a cloudlet
And this is the whole of it — databases, endpoints, the generator, Hyper IDE, users and roles, tasks, machine learning, plugins, logs. Every one of those runs on your hardware if you want it to, under a licence that cannot be revoked.

No message credits. No integration credits metering your users. No seat count. No plan that unlocks single sign-on. And no clause anywhere saying we make no warranty that your data works somewhere else — because somewhere else is just another machine running the same MIT-licensed code you already have.

Own the whole application

Database, generated APIs, auth and RBAC, SSO, scheduled tasks, file and frontend hosting, and an MCP server — one MIT-licensed process, on your hardware or ours. No credits, no seats, no export that leaves half of it behind.

Psst — leaving Base44 is probably one prompt. Point an agent at your exported frontend, describe the backend it used to call, and let the generator write it. There is a company charging money to do that for you. You’ll be finished before your credits reset.