Appwrite vs Supabase
Appwrite and Supabase compared for 2026: Free and Pro plan limits, MAU and bandwidth pricing, Postgres vs multi-model databases, permissions vs Row Level Security, function runtimes, realtime, storage, hosting, messaging and what self-hosting really gives you, with a clear pick per situation.
Quick Answer
Supabase is a Postgres development platform: every project gets its own dedicated Postgres database with an auto-generated REST API, Auth, Storage, Realtime, Edge Functions (TypeScript on a Deno-compatible runtime), Cron, Queues and vector support. Appwrite is a backend platform built around its own APIs and SDKs: TablesDB (the default), DocumentsDB and VectorsDB with table- and row-level permissions, plus managed PostgreSQL or MySQL on dedicated compute, functions in more than a dozen runtimes, Sites for hosting web apps, and Messaging for email, SMS and push. Both Pro plans start at $25 a month and both free plans pause projects after a week of inactivity and allow two projects. Supabase Free gives 50,000 MAU and a 500 MB database; Pro includes 100,000 MAU, an 8 GB disk, 250 GB egress and a Micro compute instance. Appwrite Free gives 75,000 MAU, 5 GB bandwidth and 2 GB storage; Pro includes 200,000 MAU, 2 TB bandwidth and 150 GB storage per project. Supabase is Apache-2.0; Appwrite is BSD-3-Clause (latest 2.7.1, 4 November 2026). Pick Supabase if you want real Postgres with SQL, RLS and its extension ecosystem at the centre. Pick Appwrite if you want one platform for backend, hosting and messaging, non-TypeScript functions, or a multi-project self-hosted install.
Last updated November 11, 2026. Covers Appwrite 2.7.1 (4 November 2026) and the current Supabase Platform, with plans and prices from appwrite.io/pricing and supabase.com/pricing and features from each vendor's docs, read in November 2026.
| Feature | Appwrite | Supabase |
|---|---|---|
| License | BSD-3-Clause | Apache-2.0 |
| Core Data Model | Appwrite APIs and SDKs over databases, tables and rows (TablesDB by default) | Dedicated Postgres database per project |
| Database Options | TablesDB (serverless or dedicated), DocumentsDB, VectorsDB, managed PostgreSQL 18/17 and MySQL on dedicated compute | Postgres only, with extensions; vector and analytics (Iceberg) buckets on the platform |
| APIs | REST, GraphQL and Realtime APIs; SDKs for web, Flutter, Apple, Android, React Native and server languages | Auto-generated REST Data API, GraphQL API, client SDKs, direct and pooled Postgres connections |
| Access Control | Table- and row-level permissions as role strings (any, users, user, team, label); RLS available inside managed PostgreSQL | Row Level Security policies written in SQL, tied to Auth JWTs |
| Auth Methods | Email/password (Argon2), phone SMS, magic URL, email OTP, OAuth2 with 30+ providers, anonymous, JWT, SSR, passkeys, custom tokens, MFA, teams | Password, magic link, OTP, social OAuth, custom OAuth/OIDC, anonymous, phone, MFA (TOTP; phone as add-on), Auth hooks, third-party JWTs |
| SAML SSO for Your Users | Not yet for end users (listed as coming soon); SSO listed on Enterprise | SAML 2.0 on Pro and Team: 50 SSO MAU included, then $0.015 per MAU |
| Serverless Functions | Many runtimes (Node.js, Bun, Deno, Python, Go, Dart, PHP, Ruby, .NET, Java, Kotlin, Swift, C++, Rust); HTTP, event and schedule triggers; Git deploys | Edge Functions: TypeScript on Supabase Edge Runtime (Deno-compatible), globally distributed; cold starts possible |
| Realtime | WebSocket subscriptions to events from every service (rows, files, executions, sessions, teams), filtered by permissions | Broadcast, Presence and Postgres Changes |
| File Storage | Buckets with permissions, image transformations (add-on usage), file APIs | S3-compatible, REST and TUS resumable uploads; CDN; image transformations on paid plans; RLS-based access |
| Web App Hosting | Appwrite Sites: static and SSR apps with Git deploys, previews and monorepo support | No; pair with a separate frontend host |
| Email / SMS / Push Messaging | Yes: email, SMS and push with topics and scheduling | No built-in messaging product (Auth emails via custom SMTP) |
| Free Plan | $0: 75K MAU, 5 GB bandwidth, 2 GB storage, 750K executions, 1 database, 1 bucket, 2 functions per project, 1 member, 2 projects, paused after 1 week inactive | $0: 50K MAU, 500 MB database, shared CPU with 500 MB RAM, 5 GB egress, 1 GB file storage, 2 active projects, paused after 1 week inactive |
| Pro Plan (Included) | From $25/month: 200K MAU, 2 TB bandwidth, 150 GB storage, 3.5M executions per project; unlimited databases, buckets, functions and members; daily backups; $10 database compute credit | From $25/month: 100K MAU, 8 GB disk, 250 GB egress, 100 GB file storage, 2M function invocations, 5M Realtime messages; $10 compute credit covers one Micro instance |
| Pro Overage Examples | $3 per 1,000 MAU above 200K; other add-ons pay-as-you-go under an organization budget cap | $0.00325/MAU, $0.09/GB egress, $0.125/GB disk, $0.0213/GB storage, $2 per 1M function invocations; spend cap on by default |
| Dedicated Database Compute | Optional dedicated tiers from Starter (1 core, 1 GB, $10/mo) to Scale Max (32 cores, 256 GB, $4,099/mo); HA replicas at full tier price | Per project, Micro (1 GB, $10/mo) to 16XL (64 vCPU, 256 GB, $3,730/mo); additional projects from $10/mo |
| Backups & PITR | Daily backups on Pro; backup policies; PITR on dedicated databases for +20% of the tier price | Daily backups kept 7 days (Pro) or 14 days (Team); PITR $100/month per 7 days of retention |
| Branching / Preview Environments | Database branches on managed PostgreSQL; Sites deployment previews | Branching at $0.01344 per branch-hour on Pro and above |
| Self-Hosting | Docker Compose or Helm; min 2 CPU cores, 4 GB RAM, 2 GB swap; same APIs and Console as Cloud; multiple projects per install | Docker Compose (min 2 cores, 4 GB RAM, 40 GB SSD); one project per stack; Kubernetes via community projects |
| Compliance (Cloud) | SOC 2 Type II certified; HIPAA/BAA on Enterprise | SOC 2 and ISO 27001 on Team ($599/month); HIPAA as a paid add-on |
| Latest Release (Nov 2026) | 2.7.1 (4 Nov 2026) | Hosted platform is continuously updated; self-hosted Docker stack versioned on GitHub |
Pricing at a glance
Entry prices and free tiers as listed on TechLogHub for Supabase; the other tool is not listed in the directory yet.
| Tool | Free tier | Starts at | Billing | Plans listed |
|---|---|---|---|---|
| Supabase pricing | Yes | — | — | Free · Pro · Enterprise |
Prices as written by the maker on their listing; medians and context on each tool's pricing page. See the 2026 pricing report for the directory-wide picture.
Appwrite
Open-source (BSD-3-Clause) backend platform with Auth, Databases, Storage, Functions, Messaging, Realtime, Sites hosting, Domains and a project firewall behind one set of APIs and SDKs. Available as Appwrite Cloud or self-hosted with Docker or Helm, using the same APIs, SDKs and Console.
Pros
- Functions run in many runtimes, including Node.js, Bun, Deno, Python, Go, Dart, PHP, Ruby, .NET, Java, Kotlin, Swift, C++ and Rust
- Sites hosts static and server-rendered apps (Next.js, Nuxt, Astro, SvelteKit, TanStack Start and more) next to the backend, including from npm, pnpm and Bun monorepos
- Messaging for email, SMS and push notifications is built in, so you don't need a separate notification service
- More included on Pro: 200,000 MAU, 2 TB bandwidth and 150 GB storage per project, plus unlimited databases, buckets and functions
- Permissions are role strings on tables and rows (users, teams, labels) enforced across the REST API, Realtime and every SDK, with no SQL policies to write
- Self-hosting supports many projects in one install, with PostgreSQL (default), MariaDB or MongoDB underneath
Cons
- The SDK-driven TablesDB/DocumentsDB model is Appwrite-specific; raw SQL, extensions and psql access require a paid managed PostgreSQL database on dedicated compute
- No SAML SSO for your own end users yet; Appwrite lists it as coming soon
- Free plan is tight on structure: 1 database, 1 bucket and 2 functions per project, 1 organization member, and projects freeze when a limit is hit
- Not every function runtime is available on Appwrite Cloud, and SSO, HIPAA/BAA and log drains are Enterprise-only
Best For
Teams that want backend, hosting and messaging in one platform, developers who write functions in Python, Go, Dart, PHP or other non-TypeScript languages, mobile and Flutter apps that lean on SDKs, and anyone self-hosting several projects on one server.
Supabase
Open-source (Apache-2.0) Postgres development platform. Each project is a dedicated Postgres database with an auto-generated REST API, Auth, Storage, Realtime, Edge Functions, Cron, Queues and vector tooling around it. Available as the hosted Supabase Platform or self-hosted with Docker Compose.
Supabaseon TechLogHub: reviews, pricing & alternativesPros
- Real Postgres in every project: SQL, extensions, foreign keys, triggers, and direct or pooled connections from any Postgres driver or ORM
- Row Level Security in SQL drives authorization for the auto-generated REST API, Realtime and Storage, so the database is the single source of access rules
- Mature auth on paid plans, including SAML 2.0 SSO for your users (50 SSO MAU included on Pro), Auth hooks and third-party JWTs from Clerk, Auth0, Firebase, Cognito or WorkOS
- Branching gives each pull request its own preview environment, billed per branch-hour on Pro and above
- Spend cap is on by default on Pro, and pricing for compute, disk, egress, MAU and add-ons is published down to the cent
- Largest community of the two (about 115,000 GitHub stars) and wide support in AI app builders and tutorials
Cons
- Edge Functions are TypeScript only, on a Deno-compatible runtime; Python or Go code needs another host
- No built-in web hosting or email/SMS/push messaging; you pair it with a frontend host and a messaging provider
- Pro includes less bandwidth (250 GB egress) and fewer MAU (100,000) than Appwrite Pro, and each extra project adds compute from $10/month
- Self-hosted Supabase runs one project per stack and lacks branching, managed backups and PITR, analytics and vector buckets, ETL and the Management API; the Kubernetes options are community-maintained
Best For
Teams that want Postgres as the centre of their stack: SQL-heavy apps, products that depend on extensions like pgvector, teams that prefer authorization in RLS policies, and B2B apps that need SAML SSO for customers on a mid-tier plan.
Data model: Postgres underneath vs Appwrite's own APIs
This is the decision that matters most. A Supabase project is a dedicated Postgres database. The REST Data API, GraphQL API, Auth tables, Storage metadata and Realtime's Postgres Changes all sit on top of it. You can connect with psql, run migrations with any tool, add extensions and write triggers, and your data is plain Postgres you can dump and move. Appwrite's default is TablesDB, a typed tables-and-rows model you reach through Appwrite's SDKs and REST or GraphQL APIs. It supports relationships, transactions, bulk operations, offline sync, CSV import and export, and type generation. DocumentsDB (schemaless) and VectorsDB (embeddings) sit beside it. If you want the raw engine, Appwrite also sells managed PostgreSQL (18 by default, 17 optional) and MySQL on dedicated compute, with pooling, up to five HA replicas, extensions such as PostGIS and pgvector, branches and PITR. Those databases are plain Postgres, though, without Appwrite's SDK permissions. So with Appwrite you choose per database between the platform model and the raw engine. With Supabase you always get the raw engine with a platform around it.
Authorization: role strings vs Row Level Security
Supabase authorizes data access with Postgres Row Level Security. The client sends the user's JWT, and RLS policies written in SQL decide row by row what the auto-generated API returns. The same model protects Storage. It is powerful: policies can join other tables, call functions and express multi-tenant rules precisely. The cost is that a missing or wrong policy is a data leak, and every engineer touching the schema needs to read SQL policies fluently. Appwrite attaches permissions to tables and rows as readable role strings: anyone, all users, one user, a team, a team role or a label. They are enforced the same way across the REST API, Realtime subscriptions and every SDK, so a Realtime client only receives events for resources it can read. Built-in teams and memberships handle multi-tenancy without writing policies. The trade-off is expressiveness. Rules that depend on data in other tables are easier in SQL than in role strings, and Appwrite's own comparison suggests RLS inside its managed PostgreSQL for that case. Choose based on who will maintain the rules: database-minded teams tend to prefer RLS, and app and mobile teams tend to prefer Appwrite's model.
Pricing at scale: where the $25 plans diverge
Both Pro plans start at $25 a month, but they bundle different things. Supabase Pro covers one project's Micro compute with a $10 monthly credit. Each additional project adds compute from $10 a month, and the quota includes 100,000 MAU, an 8 GB disk, 250 GB egress and 100 GB of file storage. Beyond that, list prices are $0.00325 per MAU, $0.125 per GB of disk, $0.09 per GB of egress and $0.0213 per GB of storage, and the spend cap is on by default. At 300,000 MAU, for example, the extra 200,000 users come to about $650 a month at list price. Appwrite Pro includes 200,000 MAU, 2 TB of bandwidth, 150 GB of storage and 3.5 million function executions per project, with $3 per 1,000 MAU beyond that. The same 300,000 MAU therefore adds about $300. Both include $10 of database compute credit and dedicated tiers from $10 a month. The gap is largest for bandwidth-heavy consumer apps and for teams running several small projects. Enterprise needs differ too. SOC 2, ISO 27001 and dashboard SSO come with Supabase Team at $599 a month, while Appwrite puts SSO and HIPAA/BAA on custom-priced Enterprise.
Functions, realtime, hosting and messaging
Supabase Edge Functions are TypeScript files that run on the Supabase Edge Runtime, which is Deno-compatible and distributed across regions. They suit webhooks, small API endpoints and calls to third-party or LLM APIs. Supabase's own docs warn about cold starts and suggest moving long jobs to background workers, and Cron and Queues cover scheduled and durable work. Appwrite Functions deploy from Git and are triggered by HTTP, SDK calls, events or schedules. They run on a long list of runtimes: Node.js, Bun, Deno, Python (including an ML image), Go, Dart, PHP, Ruby, .NET, Java, Kotlin, Swift, C++ and Rust. Not all of them are available on Appwrite Cloud. For realtime, Supabase offers Broadcast, Presence and Postgres Changes, while Appwrite streams events from every service, including files, executions and sessions. Two products have no Supabase counterpart. Appwrite Sites hosts static and server-rendered frameworks with Git deploys and previews, and it added monorepo builds on 10 November 2026. Appwrite Messaging sends email, SMS and push. With Supabase you would add a host such as Vercel or Netlify and a messaging provider.
Self-hosting and moving between them
Both projects are open source and both self-host with Docker, but they don't deliver the same thing. Supabase's Docker Compose stack needs at least 2 cores, 4 GB of RAM and 40 GB of SSD (8 GB or more recommended) and ships Studio. Its docs are explicit that a self-hosted install is a single project, without multiple organizations or projects in Studio. Branching, advanced metrics, managed backups and PITR, analytics and vector buckets, ETL and the Management API are platform-only, and the Kubernetes Operator and Helm chart are community-maintained. Appwrite's installer asks for 2 CPU cores, 4 GB of RAM and 2 GB of swap. It lets you pick PostgreSQL (default), MariaDB or MongoDB as the internal database, runs the same APIs, SDKs and Console as Appwrite Cloud, and hosts many projects per install. Helm charts support managed PostgreSQL, Redis, ClickHouse and S3. To move from Supabase to Appwrite, Appwrite's Migrations tool imports users, databases and files from a Supabase project, but Edge Functions have to be rewritten by hand. Leaving Supabase for any Postgres host is simpler, because your data is already standard Postgres.
Verdict
Pick Supabase when Postgres is the point. If your team thinks in SQL, wants Row Level Security as the one place access rules live, depends on extensions such as pgvector, or needs SAML SSO for business customers without an enterprise contract, Supabase fits better, and its branching and published per-unit prices make it predictable to run in production. Pick Appwrite when you want one platform for more than the database. Sites hosts your Next.js, Nuxt or SvelteKit frontend next to the backend, Messaging covers email, SMS and push, functions run in Python, Go, Dart, PHP and other runtimes rather than TypeScript only, and permissions are role strings rather than SQL. Appwrite also gives more on Pro for the same $25 starting price: 200,000 MAU against 100,000, and 2 TB bandwidth against 250 GB egress. That matters for consumer and mobile apps with many light users. For self-hosting, Appwrite is the easier choice if you want several projects on one server with the same Console as Cloud. Supabase's self-hosted stack runs one project per deployment and drops branching, managed backups and PITR. For a hobby project either free plan works, but both pause idle projects after a week.