Supabase vs Firebase vs Convex

Best for Anyone who wants a real relational database (Postgres) with SQL, plus auth/storage/realtime bundled — the default pick for most web apps in 2026.

Strengths

• It's actual Postgres. You own your data model, you can write SQL, run migrations, add extensions (pgvector for embeddings, PostGIS, etc.), and you can leave anytime because it's a standard database, not a proprietary store.
• Pairs cleanly with the tools vibe coders already reach for: Drizzle ORM for typed queries, Next.js, and it exposes an auto-generated REST + realtime API on top of your tables.
• Row Level Security (RLS) gives you real per-row authorization enforced at the database layer, and the auth product is decent enough that many teams skip a separate Clerk.
• Generous free tier, predictable usage pricing, self-hostable if you ever need to.

Watch out

• RLS is powerful but genuinely hard to get right — it's the single most common place people ship a security hole. Test your policies, don't trust the AI to one-shot them.
• The client-talks-directly-to-database model tempts you to skip a real backend layer; for anything nontrivial you'll still want server-side logic, and Edge Functions are less pleasant than writing normal server code.
• Free-tier projects pause after inactivity, which surprises people on hobby/demo apps.

Best for TypeScript-native teams building reactive apps who want backend logic, database, and realtime as one typed system — and don't want to think about SQL or cache invalidation.

Strengths

• Your backend is just TypeScript functions (queries, mutations, actions) with end-to-end type safety from the database to the React component — no schema drift, no separate API layer to wire up.
• Reactivity is the headline feature: queries are live by default, so the UI updates automatically when data changes. You get realtime for free instead of bolting on subscriptions.
• Transactions are real and serializable, scheduled functions and cron are built in, and the developer experience (local dev, type inference, dashboard) is the best of the three.
• AI coding agents do well with it because everything is typed TypeScript in your repo — the model can see and reason about your whole backend.

Watch out

• It's a proprietary document/relational hybrid, not Postgres. No raw SQL, and migrating off is a real project — you're committing to their model.
• Smaller ecosystem and community than Supabase or Firebase; fewer answers online, fewer battle-tested integrations, and you'll occasionally hit the edge of what the platform supports.
• The reactive model is great until you have heavy analytical queries or large aggregations — that's not what it's built for, and you'll feel the constraints.

Best for Mobile-first apps, teams already deep in Google Cloud, and prototypes that need auth + a database live in an afternoon.

Strengths

• Fastest zero-to-running for mobile — first-class iOS/Android SDKs, and Firebase Auth is still one of the smoothest auth setups anywhere, with broad social provider support.
• Mature, battle-hardened, and massive: it's run production apps for over a decade, so almost any problem you hit has a known answer.
• Tight integration with the rest of Google Cloud (Cloud Functions, Analytics, Cloud Messaging/push, Crashlytics) — genuinely useful if you're already there.
• Firestore's offline sync and realtime listeners are excellent for consumer mobile apps with flaky connectivity.

Watch out

• Firestore is a schemaless NoSQL document store with no joins and limited querying — you denormalize everything, and modeling mistakes are expensive to unwind later.
• Pay-per-read/write/delete pricing is notorious for surprise bills at scale — a chatty app or bad query pattern costs real money, and cost is hard to predict.
• Very Google-proprietary, and its momentum among new web projects has faded next to Supabase and Convex — it feels like the legacy choice for greenfield web work in 2026.