Bolt.new Review 2026: Pricing, GitHub Sync & Lock-in

Disclosure: CodeToolPilot may earn a commission if you buy through links on this page, at no extra cost to you. How we make money.

Last verified: October 12, 2026. This is an editorial research review — how we review. Prices and plans change often; confirm on the vendor’s site.

Bolt.new is StackBlitz’s AI app builder. You describe an app in a chat, and Bolt writes the code, runs it, and publishes it to a live URL. It suits founders, designers and product teams who want a working web app without setting up a local environment. Developers who want to skip the scaffolding stage of a new project also use it.

For a developer, the important questions come after the first prompt. Does the code end up in a real Git repository? How hard is it to leave the built-in hosting and database? And how fast does the token bill grow with the project? This review focuses on those questions.

It is an editorial research review. It is based on Bolt’s public documentation, pricing page, release notes and product blog as of October 2026, plus attributed patterns in public user feedback. We did not run hands-on tests.

Quick verdict

Bolt.new is one of the more developer-friendly app builders. Its GitHub integration is genuinely two-way, you can import an existing repository, and you are not forced to host on Bolt: Netlify publishing and a project download are both documented. Bolt Cloud adds hosting, a managed database, auth and server functions, which makes Bolt convenient but also creates lock-in. The main caveat is cost: Bolt bills by tokens, and its docs say larger projects use more tokens per message. Expect your spend to grow with the codebase.

Pro: Two-way GitHub sync with automatic commits, branches and import of existing repositories.
Pro: Built-in hosting on bolt.host, plus Bolt Database with authentication, file storage and server functions.
Pro: Unused tokens on paid plans roll over for one extra month, and publishing with the Publish button uses no tokens.
Pro: A project-wide security audit that does not use tokens (paid plans), plus a database security check on every plan.
Con: Token use grows with project size, so large or long-lived apps get expensive.
Con: Branches are merged in GitHub, not in Bolt, and in a sync conflict Bolt’s version overwrites GitHub’s.
Con: Model training on your projects and chats is on by default, except for accounts in the EU, UK and Switzerland.
Con: Subscriptions are non-refundable, and the full security audit requires a paid plan.

Visit Bolt.new

What is Bolt.new?

Bolt.new is built by StackBlitz. The original open-source Bolt.new repository describes an in-browser development environment powered by StackBlitz’s WebContainers, where the AI controls the file system, package manager, terminal and browser console. That design makes Bolt strongest in the Node.js and npm ecosystem. Since then, StackBlitz has added Bolt Cloud, with built-in hosting, custom domains and a managed database, so small apps can stay in production on Bolt.

Bolt does not name the language models it uses. Its documentation says Bolt “handles model selection behind the scenes” and offers two agents: Standard, for everyday work, and Max, for complex, multi-file work, which needs a paid plan. In September 2026 Bolt launched a third agent, Forge, as a research preview running on open-source models. It is included with individual Pro plans until October 14, 2026, and prompts and code sent through Forge are anonymized and shared with partners to train open-source models.

Key features

Agents, Plan Mode and prompt queueing

Plan Mode, which replaced Discussion Mode in August 2026, lets you agree on an approach before Bolt writes code. The original v1 agent was retired on August 3, 2026. Other 2026 additions include Skills (reusable bundles of context and rules), prompt queueing, and visual edits in the preview that only use tokens when you save them.

GitHub sync and repository import

For developers, this is Bolt’s strongest feature. According to Bolt’s GitHub guide, Bolt commits every change that doesn’t break the project. It also checks GitHub every 30 seconds and pulls in changes made outside Bolt. You can create and switch branches from inside Bolt, but you have to merge them in GitHub. You can also import an existing repository by URL. There are some constraints. Only the project owner can manage the integration. Disconnecting a repository is permanent unless support reconnects it. And in the rare case of a simultaneous conflict, the docs say “Bolt keeps your changes and overwrites the GitHub version.”

Bolt Cloud hosting and domains

Every project can be published for free to a bolt.host address. Custom domains and private (invite-only) sites need a paid plan; on the Free plan, all published sites are public. New projects use Bolt hosting by default, but you can choose Netlify instead, or download the project and deploy it yourself. Publishing with the Publish or Update button uses no tokens. Asking the agent to publish in the chat does.

Bolt Database

Bolt creates a database automatically when a project needs one. Its settings include authentication (email confirmation, password reset, Google sign-in), file storage and server functions. On Pro and Teams plans, you can choose Supabase instead when you create a project. Some details matter for production use. Restoring an earlier project version does not restore the database. Since July 2026, auto-pausing only applies to unpublished projects. And Bolt’s database page does not describe a data export or migration path. That gap is where lock-in begins.

Security audit

The security agent, introduced in July 2026, reviews the whole project before you publish. It covers data access rules, what the public parts of the app expose, sign-in and session handling, visitor input and key handling, and it fixes what it can. Started from the Publish menu, the audit and its fixes do not use tokens. It requires a paid plan and is limited to 30 audits per day. A lighter database security check is available on all plans. Bolt recommends running a check at least once before publishing, but it does not claim the audit makes an app secure.

Who should use Bolt.new

Bolt suits developers who prototype often and want a deployable result quickly, founders and product teams building small to medium JavaScript web apps, and teams that want AI-generated code in GitHub from the first commit and plan to continue in their own editor later.

Who should skip it

Skip Bolt if you maintain a large codebase and expect heavy AI use, since token costs scale with project size. It is also a poor fit for mostly non-JavaScript stacks, fixed monthly AI budgets, or compliance needs that only Enterprise controls cover.

Strengths and limitations

Strengths

Bolt treats Git as a first-class citizen. Automatic commits, branch support and import of existing repositories mean you can start in Bolt and continue in your own editor, or move between the two, without copy-pasting code. That gives you a real exit route, which is less common among app builders than it should be.

The zero-setup loop is fast: prompt, preview in the browser, publish to a URL. Hosting, a database and auth in one subscription replace several accounts a small project would otherwise need. Cost controls help too: button publishing is free, unused paid tokens roll over, and the docs note that you can still edit code directly in Code view at no token cost after hitting the free daily limit.

The token-free security audit is a welcome step in a category where generated apps often ship with weak access rules.

Limitations

The biggest limitation is cost predictability. Bolt’s token docs say most usage comes from reading and syncing project files, so “larger projects use more tokens per message.” Its troubleshooting guide also warns that the context window fills up quickly on large files. Fast token burn on growing projects is among the most common complaints in public user feedback and third-party reviews.

Lock-in is partial. Your code can live in GitHub, but Bolt Database, auth settings and server functions are tied to Bolt Cloud, and the docs do not describe a database export. Choose Supabase at project creation if a portable backend matters to you. That option needs Pro or Teams.

Check data handling, too. A new model-training setting is on by default (except for accounts in the EU, UK or Switzerland) and covers content submitted from October 7, 2026. Forge has its own data-sharing terms.

Finally, the browser-based architecture fits Node.js and npm projects best. Bolt is not designed as a general-purpose environment for Python, Go or JVM back ends.

Pricing (as of October 2026)

Plan	Price	What you get
Free	$0	1M tokens per month with a 300K daily cap; public and private projects; bolt.host hosting with Bolt branding; up to 333K web requests; 10MB file uploads; Standard agent only
Pro	From $25/month (10M tokens); larger token tiers cost more, such as $100/month for 55M tokens	No daily cap; unused tokens roll over for one extra month; custom domains; private sites; no Bolt branding; Max agent; security audit; choice of database provider; up to 1M web requests
Teams	$30 per member/month	Everything in Pro, plus centralized billing, admin controls and user provisioning, private npm registry and design-system knowledge; tokens per member
Enterprise	Custom	SSO, audit logs, compliance support, data governance and retention policies, SLAs and dedicated support

The pricing page says yearly billing saves up to 28%. The help center gives $216 per year for the 10M-token Pro tier as an example. Token reloads are only sold on the highest monthly Pro tier or any annual Pro plan, and reloaded tokens do not expire. Subscriptions are non-refundable. Prices and token tiers change often, so confirm the current figures on Bolt’s pricing page before you subscribe.

See Bolt.new pricing

Prices verified on October 12, 2026 against the official Bolt.new pricing page. Plans change often — confirm on the vendor’s page before you buy.

Use cases

For developers, Bolt.new is most useful when it feeds a real Git repository and when the exit route is planned from day one. These scenarios follow Bolt’s documented features, and each one notes the caveat that matters most.

Scaffolding a new JavaScript app straight into GitHub

A developer starting a new JavaScript web app can let Bolt generate the first version while its GitHub integration commits every change that doesn’t break the project. Bolt checks GitHub every 30 seconds and pulls in commits made elsewhere, so the work can move to a local editor without copy-pasting. Branches can be created in Bolt but must be merged in GitHub, and in a simultaneous conflict Bolt’s version overwrites GitHub’s, so avoid editing the same files in both places at once.

Prototyping a feature on an existing repository

Bolt can import an existing GitHub repository by URL, so a team can try a UI or feature idea on a branch of real code instead of a blank project. This works best on small to medium codebases. Bolt’s token documentation says larger projects use more tokens per message, so a large repository can become expensive quickly.

Client demos with private hosting

Freelancers and agencies can publish a working demo to a bolt.host address in one click, and publishing with the Publish button uses no tokens. On paid plans, the same project can use a custom domain and be published as a private, invite-only site for client review. On the Free plan every published site is public, which rules it out for anything confidential.

Shipping a small production app with a portable backend

Developers who may leave Bolt later can choose Supabase instead of Bolt Database when creating a project on Pro or Teams, so the data sits in a service they can manage directly. Bolt’s Netlify guide also documents Netlify as an alternative host, but only for projects not yet published to Bolt hosting, and it warns that there is no going back after the switch. In our assessment, making both choices early is the cheapest way to limit lock-in, because Bolt’s database docs do not describe an export or migration path.

A security pass before launch

Before publishing an app that stores user data, a developer on a paid plan can run Bolt’s security audit from the Publish menu. It reviews data access rules, what the public parts of the app expose, sign-in and session handling, visitor input and key handling, fixes what it can, and uses no tokens. Bolt does not claim the audit makes an app secure, so treat it as a first pass and still review access rules and secrets yourself.

Alternatives

Lovable: a similar chat-to-app builder with a built-in Supabase-based backend, Git sync on every plan and credit-based pricing.
v0: Vercel’s builder, with a branch-per-chat and pull-request workflow, best for Next.js teams already on Vercel.
Replit: a full cloud workspace and agent that supports many languages, with four deployment types and separate dev and production databases.
Cursor: for developers who would rather keep AI inside their own editor and repository from the start.

Final verdict

Bolt.new is a strong choice when you want a running, hosted web app fast and still want your code in GitHub. Its real two-way sync and documented exit routes set it apart from builders that keep code behind their own walls. Plan for token costs that grow with the project. Run the security audit before every publish. Make a deliberate choice about the database early, because that is where moving off Bolt gets hard.

Try Bolt.new

FAQ

Is Bolt.new free?

Yes. The Free plan includes a monthly token allowance with a daily cap, public and private projects, and hosting on bolt.host with Bolt branding, but only the Standard agent. Custom domains, private published sites, the Max agent and the full security audit require a paid plan. Check Bolt’s pricing page for current token allowances.

Can I export my code from Bolt.new?

Yes. The GitHub integration keeps your code in a GitHub repository, and Bolt’s Netlify guide describes running the build command and clicking Download to get the project files for a manual deploy. Bolt’s release notes say the older “Open in StackBlitz” export option is no longer available for new projects. Your code is portable, but Bolt Database, auth settings and server functions are tied to Bolt Cloud, and the docs do not describe a database export.

Does Bolt.new work with an existing GitHub repository?

Yes. You can import an existing repository by URL and create and switch branches inside Bolt, but you merge them in GitHub. Only the project owner can manage the integration, and disconnecting a repository is permanent unless Bolt support reconnects it.

Does Bolt.new use my code to train AI models?

By default it can, unless your account is based in the EU, UK or Switzerland. According to Bolt’s release notes, a Model training setting is on by default for content you create or submit to Bolt’s AI features on or after October 7, 2026, and you can turn it off in your account settings at any time without affecting your plan. The Forge research preview has separate terms: prompts and code sent through Forge are anonymized and shared with Bolt’s partners to help train open-source models.

Are apps built with Bolt.new secure?

Bolt provides security tools, not guarantees. Paid plans get a project-wide security audit that uses no tokens (up to 30 per day), every plan gets a lighter database security check, and Bolt recommends running a check at least once before publishing. As guidance, review generated access rules and key handling yourself before an app holds real user data, as you would with any generated code.

Bolt.new vs Lovable: which is better for developers?

Both turn a chat into a hosted web app, but they differ in the areas developers care about most. Bolt can import an existing repository, lets Pro and Teams users choose Supabase instead of its own database, and bills by tokens. Lovable always creates a new repository but supports GitHub, GitLab and Bitbucket on every plan, uses a fixed TanStack Start and Postgres stack, and bills by credits. In our assessment, Bolt is the better fit when you start from existing code, and Lovable when you want a fuller built-in backend.

Bolt.new Review (2026): Is StackBlitz’s AI App Builder Developer-Friendly?