In-depth Report
-
Bolt.new is a browser-side AI full-stack development tool launched by StackBlitz. It relies on its own WebContainers technology to move the complete Node.js environment into the browser tab. Users describe their needs in natural language, and it can generate, run and deploy a usable web application in tens of seconds with one click. Its core selling point is "fast" - it often only takes half an hour from an idea to an online link. This made it one of the fastest-growing development tools after it was launched at the end of 2024, with more than one million users in four months. It is reported that it achieved approximately US$4 million in ARR within four weeks of its launch. But the other side of the coin is equally clear: the per-token billing model makes costs highly unpredictable, AI can burn tens of millions of tokens in an afternoon when it is stuck in an "inexhaustible loop", the authentication function repeatedly has problems, and there are even a batch of one-star negative reviews on Trustpilot. In a word, it is good at prototyping but not good at production.
-
The parent company of Bolt.new is StackBlitz, a software company founded in 2017 and headquartered in California, USA. This company has been on the road to cloud development environments for ten years. The most critical technology accumulation is the open source WebContainers in 2021-a runtime that can run Node.js in the browser. It can be said that Bolt.new did not appear out of thin air, but a centralized realization for the public of StackBlitz’s ten years of technology accumulation. The product will be officially launched in October 2024, and the growth curve is quite exaggerated. StackBlitz CEO Eric Simons once publicly stated that Bolt.new achieved approximately US$4 million in ARR within four weeks of its launch. Subsequently, TechCrunch reported that it had crossed US$40 million in ARR by the beginning of 2025, almost doubling every month. The official website now has a long list of endorsing customers, from Google, Microsoft, Salesforce to Shopify, Stripe, and ByteDance. It is positioned as a "professional vibe coding tool."
-
The working method of Bolt.new can be broken down into four steps: you type what you want, the model builds the project skeleton (usually React, Next.js, Vue, Svelte or Astro with Tailwind), and a complete file tree appears on the left; with WebContainers, the project is started directly in the browser as if it were local, and the real-time preview on the right can be clicked to jump; every subsequent change is a new conversation - "add a login page" "change the homepage copy to be harder" "connect this form Supabase", change the model code and rebuild it; when satisfied, deploy it to Netlify with one click and get the real URL. What really sets it apart from others is WebContainers. It uses WebAssembly to launch a lightweight Linux environment in the browser. It can run native npm packages, install dependencies in a few seconds, execute Node.js, bind network ports, and start the development server, all without touching your local machine. Some reviewers have actually measured that it takes 30 seconds to install dependencies locally, but it takes 2 to 3 seconds to complete in the browser. This is not a "preview mode", but a real, runnable full-stack environment, which is also the foundation of its "zero installation, zero configuration, ready-to-use" experience. Functionally, the 2026 Bolt will do more than just generate code. It introduces design system integration and natively supports Porsche, Material UI, Chakra UI, Shadcn, and the Washington Post design system. Product teams can directly generate applications that comply with their own brand specifications; it supports import from Figma and GitHub, and Google's AI design tool Stitch can also be exported to Bolt with one click. It also has built-in Bolt Cloud, which packages back-end infrastructure such as hosting, database, user authentication, SEO optimization, and custom domain names into the same interface. The official slogan is "Stop splicing a bunch of platforms together." In addition, there is a new Plan mode that plans first and then generates it, and the ability to connect to external tools such as Notion, GitHub, Linear, and Miro as an MCP client. It claims to "automatically route to the most appropriate model" and reduces errors by 98% through automatic testing, refactoring, and iteration. It also claims to be able to handle projects 1,000 times larger than in the past.
-
Bolt.new adopts a subscription system based on token measurement. Every time AI generates, writes files, and iterates, tokens are consumed. The free version has 1 million Tokens per month (the daily limit is about 300,000). It can build public and private projects, use Bolt-branded hosting, upload 10MB files, and unlimited databases, which is enough for you to verify the platform and do some small projects. The Pro version costs US$25 per month and provides 10 million Tokens per month with no daily upper limit. It removes the Bolt brand watermark and supports custom domain names, SEO support, and AI image editing. Unused Tokens can be rolled over for one month. The Teams edition is $30 per person per month and adds team collaboration, centralized billing, permission management, a private NPM repository, and design system knowledge. Enterprise is a customized quote that includes SSO, audit logs, compliance support, and a dedicated account manager. You can save approximately 25% to 28% by paying annually. The key is to understand what the Token is buying. According to independent evaluation, a medium-complexity web application may consume 2 million to 5 million Tokens, which means that the 10 million Tokens per month in the Pro version are only enough for two to five decent projects; and for a project with complex requirements and repeated debugging, one person can use up the entire monthly quota. The bulk of Token consumption is "file context" - as long as a change touches a file with thousands of lines, the cost will remain high, and it has little to do with how short you write the prompt word. This also explains why "only edit relevant files" has become a money-saving tip passed down by experienced users.
-
Positive voices focus on speed and the "magic" of the experience. Some Reddit users said that Bolt's browser virtualization is "ridiculously fast and is a significantly better product to build." Someone posted on Twitter that "it takes two minutes to build and deploy. These tools are scary fast." Some developers praised it on Medium for "quickly trying out ideas with zero configuration." A Trustpilot user mentioned that he built a prototype App in about three days and spent $200. "It would have taken a few weeks as a developer and is much more expensive." Even though he complained about a lot of problems later, the value of rapid prototyping is real. The negative feedback was equally dense and quite harsh. A highly praised post on r/nocode accurately expressed the embarrassment: I was so excited at first using Bolt that I "felt like I could do anything." The UI, backend, and database came out in a flash, and then I suddenly remembered that I couldn't write code at all, and I was completely at a loss when faced with the whole "damn buffet" of hosting, deployment, load balancing, and Docker. With 151 points and 112 comments, this post is obviously not an exception. Some users complained in the "I'm fed up with bolt.new" post that it is becoming increasingly unreliable, adding back code you manually deleted, and burning more than 2 million Tokens without giving the desired solution. The authentication function is almost the most common pain point that is complained about: the login code generated by AI looks correct, but in fact there are subtle bugs hidden, and Tokens are burned like crazy to fix the bugs. Trustpilot has accumulated a batch of one- to two-star angry reviews, with titles ranging from "The Worst AI App in History" to "Bolt Stole My 10 Million Tokens", accusing it of being a "point-burning scam", eating up millions of tokens after changing just four pictures, and after the model was updated, the credit was inexplicably cleared and customer service did not respond for several days.
-
In the 2026 horizontal evaluation, Bolt.new's reputation is actually quite good, and most lists list it as "the best full-stack AI application builder for developers." TechSifted gave it a score of 9.0, saying it is "full stack, fast enough, and generates truly exportable code." The most important thing is the quality of the output - feed it "a project management application with Kanban, authentication and Postgres", and what comes back is a real Next.js application using Prisma and NextAuth, with a structure "like what I would write myself." AI Agent Square scored 8.6 points and ToolChase 4.3/5. Many people emphasized its generational advantage of "running the real runtime in the browser" - no cold start, no remote VM, and no dependence on the local environment. In terms of competing products, the consensus in the industry is becoming clearer: If you want freedom of the framework, want to own the underlying engine, and pursue the fastest "results", choose Bolt; non-technical users, who value the design sense of the product and clean and maintainable code, choose Lovable; if you want real backend, database, background tasks, and multi-language, choose Replit Agent; v0 only makes UI components of React/Next.js, and v0 is unmatched. The starting point of almost all evaluations is the same: these tools are all very good at "from 0 to 1", and they all hit a wall in scaling "from 1 to N". A recurring best practice in the industry is to first use Bolt or Lovable to prototype, export to GitHub, and then use Cursor or local CLI for production.
-
The biggest controversy is Token economics. It turns costs into a black box that you can't calculate beforehand and can't control during the event. The most typical scenario is the "error loop": the AI is stuck on a bug that it cannot fix. It generates code, reports an error, tries to fix it, generates almost the same code again, and reports the same error again. It burns money every time it turns around, and can eat up 7 million to 12 million Tokens in an afternoon. For budget-conscious individuals and small teams, this is almost fatal uncertainty. Security is the second most underestimated pitfall. Bolt has its own built-in database audit, which will check whether there is a lack of row-level security policies and improper permissions before release. This is a good thing in itself, but it also admits from the side that "the generated application may be directly launched online with vulnerabilities." Common problems listed by third-party scanning services (interest-related, need to be discounted) include: API keys are written directly into the source code, Supabase lacks row-level security, lacks security response headers, weak authentication, and source map exposure. The irony is: the product is called "can be built by just talking" to non-developers, but the release list requires you to audit the key, verify RLS, verify the authentication on the server, and turn off the source map - it is equivalent to skipping writing code and jumping directly to "taking responsibility for the code". There is also a positioning gap: marketing packages it as being usable by everyone, but in reality it is more like an “accelerator for people who can read code.” It can make non-developers feel like gods for a moment, and then dump a bunch of code in front of them that they can't understand, can't fix, and can't deploy. In addition, it only produces web applications (React, Next.js, Vue, Astro, Svelte) and does not generate native iOS/Android binaries; WebContainers cannot run modules that require native compilation (some image processing libraries, specific database drivers), and large monorepo and complex multi-service architectures will also encounter memory and execution limits.
-
The people it is suitable for are clear: developers, technical founders, and product teams with certain engineering judgments. Use it for rapid prototyping, hackathons, internal management tools, or to turn a requirement into an online link that can be placed in front of decision-makers - in these scenarios, there is almost nothing faster than it. The correct way to save money is to pile up enough details in the first prompt, get the runnable skeleton at once, push it to GitHub, and leave the remaining refinement to tools such as Cursor and Cline. This hybrid workflow of "Bolt is responsible for 0 to 1, and local Agent is responsible for 1 to 10" is currently the most cost-effective serious AI coding stack. Those who are not suitable are also clear: non-technical founders who expect to build profitable production-level SaaS from scratch will most likely be repeatedly discouraged by token bills, certification bugs, and debugging infinite loops; teams that require native mobile applications, GPUs, long-term background tasks, or complex enterprise-level architecture should also look at Replit or self-built environments. Those who want to completely get rid of the token ceiling can consider bolt.diy, a self-hosted branch with more active community maintenance, equipped with Gemini or Groq free models, at the expense of the polish of the managed version.
-
Bolt.new is the product that is closest to reality when it comes to "generating apps in one sentence" in 2026. WebContainers is indeed one step ahead of similar "chat box embedded remote VMs". But what it sells is speed, not immunity—the app appears in minutes, but liability does not. Use it as a junior developer who's fast, expensive and has memory problems, and you'll get the best of it; use it as "software engineering has been replaced by a chat box" and sooner or later you'll be reading documentation in the middle of the night.
User Reviews
-
Billy_Hernandez33—It was built in two minutes and deployed easily. This speed is really amazing. -
流年245—Using Bolt was so exciting at first that I felt like I was a god. The UI, backend, and database all came out. Then I suddenly remembered that I couldn’t write code at all. I didn’t know where to start with hosting, deployment, domain names, and Docker. The feeling of falling from heaven back to earth makes me laugh to death. It can help you remove the shell of the software, but it does not shoulder the responsibility after the software is running. -
Patricia_Gray_2021—Running Node.js directly in the browser is really advanced. There is no cold start or remote virtual machine. The installation is completed in two to three seconds, which is a bit faster than those similar devices that use a remote VM. -
CMendoza—The authentication function is always broken, help. -
MOrtiz_20215—The biggest pitfall is that Token is completely uncontrollable. I just wanted to correct a small bug, but the AI got stuck generating code, reporting an error, correcting it again, and reporting the same error again. Millions of tokens were gone in one afternoon, but the problem still existed. This kind of endless cycle is really fatal to budget-sensitive individuals. You can’t stop the car without knowing it beforehand. -
Preston265—The free quota was used up in one day, and I only built two apps. -
熊明宇—The core technique of saving Token is just one sentence: only let it edit relevant files. Because the bulk of the consumption is the file context. Once you modify a file with thousands of lines, the cost will not be reduced. It does not matter how short you write the prompt word. This is actually written in the official documents, but unfortunately most people only understand it after burning money. -
Peter.CookIII—Prototyping is indeed ridiculously fast. It took three days to create a working app for $200, and it took several weeks to find a developer, which was even more expensive. But don’t expect it to actually go into production. The correct solution is to export it to GitHub, get Cursor, and then modify it. -
CristinaSoler—Thai pants are spicy, and the first two or three prompt words are really amazing. -
DeborahLopez—I give full marks for the freedom of the framework. You can use React, Vue, Svelte, or Astro whichever you want, unlike v0 which only recognizes React. -
nakmaopt4—I only regretted it after I subscribed for the annual fee. It was amazing at first but then I messed up the code I wrote and burned tokens like crazy. -
Isabella_Jackson—I would like to ask, can Bolt directly produce native iOS apps, or can it only make web pages? -
Virginia_Williams_88—The most annoying thing is that it will add back the code that I deleted manually. Are you angry or not? -
alCRU—Replying to the above, you can only produce web apps, React/Next/Vue, etc. It does not generate native binaries. To put them on the App Store, you have to find another way. -
Rebecca_Foster_2021—Safety is grossly underestimated. It has built-in database auditing to check whether there are any missing row-level security policies before release. This is actually a disguised admission that the generated application may be launched online with vulnerabilities. I have seen API keys written directly into the source code. Non-technical users have no idea how dangerous this is, skipping writing the code and jumping directly to taking responsibility for the code. -
DrValgiFernandes_2024—The zero-installation feature is very friendly to people like me who use tablets and Chromebooks. You can open the browser to develop full stack. -
CFosterSr—Changing four pictures cost me millions of tokens. What the hell. -
TeresaLewis_88—Compared with Lovable, Bolt is better in that the framework is flexible and the underlying engine is your own, while Lovable is better in producing a sense of design and the code is clean and easy to maintain. If you want a real backend and multi-language, Replit is the way to go. To put it bluntly, these are all very good at going from 0 to 1. Once they reach scale, they will collectively hit a wall. Don’t expect one tool to take care of them all. -
Amanda.Butler_2022—It feels like it's fast, expensive and a junior programmer with memory problems has to keep an eye on it. -
gbk345—If you want to completely get rid of the token ceiling, you can try the self-hosted bolt.diy, which comes with Gemini or Groq’s free model, saving you $25 per month. The price is that it is not as sophisticated as the hosted version, but the community maintenance is more active. -
Christina.Allen_Pro—After updating the model, my token was cleared directly, and the work order was sent for several days but no one responded. -
WEfra—Objectively speaking, it is an accelerator for developers, not a substitute. Feed it a project management requirement with Kanban, authentication, and Postgres, and what comes back is a real Next.js application using Prisma and NextAuth. The structure is like what I would write myself. Two drag and drop places are broken, and the email verification is only half written, but the skeleton saved me a whole day. People who can read code will be more powerful when using it, but those who can't use it will be a disaster.