Supabase Review 2026: Postgres, Auth, Pricing & Limits

What Supabase is

Supabase describes each project as a full Postgres database, not a Postgres abstraction, and its compute documentation states that every project on the platform comes with its own dedicated Postgres instance. That database is the foundation for everything else Supabase sells: authentication, file storage, realtime messaging, serverless functions and APIs. If you only want a hosted PostgreSQL database, Supabase can be used that way too; you connect with any Postgres client or ORM and ignore the rest.

The difference from a plain managed database such as RDS is that the backend pieces are integrated with the database. Auth stores its users in your Postgres database, and the REST API respects Row Level Security policies tied to the signed-in user, so many apps can read and write data from the browser without writing a server.

The platform: Postgres, Auth, Storage and Realtime

Postgres database and APIs

Supabase provides a RESTful API using PostgREST, generated automatically from your database schema. Extensions such as pgvector (for embeddings and similarity search) can be enabled per project. Read Replicas are additional databases kept in sync with the primary, optionally in other regions. Each project is deployed to one primary region, which also decides where its data is stored.

Auth and Row Level Security

Supabase Auth supports passwords, magic links, one-time passwords, social login with providers such as Google, GitHub and Apple, and SAML single sign-on on higher plans. It issues JSON Web Tokens, and because user data lives in a special schema in your own database, you can join it to your tables and write Row Level Security policies that restrict each user to their own rows.

Storage, Realtime and Edge Functions

Storage handles files with access rules that can reuse the same policies. Realtime offers Broadcast (low-latency messages between clients), Presence and Postgres Changes, which streams database changes to subscribed clients. Edge Functions are server-side TypeScript functions for webhooks and third-party integrations. Branching creates preview environments from Git, but new branches start without production data unless you seed them or choose to include data.

Supabase free tier limits and pausing

The free plan is enough for a prototype, a learning project or a hackathon, but its two rules matter. Only 2 projects can be active at once, and free projects are paused after 1 week of inactivity. A paused project can be restored from the dashboard within a 1-year window; paid projects are never paused. There are no automatic backups on Free, and Supabase recommends that free projects export their data regularly with the CLI db dump command.

Limits and trade-offs

Compute is always on. Unlike serverless Postgres, a paid Supabase project runs continuously and is billed per hour of compute whether or not it is busy. Each additional project adds its own compute cost, so a staging copy of every project roughly doubles that line.

Disk can go read-only. Disk grows automatically on paid plans, but only a limited number of times in 24 hours; the documentation warns that a project reaching 95% disk use with no resize quota left enters read-only mode.

Networking. Direct database connections use IPv6 unless you buy the IPv4 add-on; IPv4-only networks connect through the shared pooler instead. Serverless and edge functions are told to use the pooler in transaction mode.

Backups cost extra for fine-grained recovery. Pro includes 7 days of daily backups. Point-in-time recovery is a paid add-on that also requires at least the Small compute size.

Platform coupling. The database is portable, but Auth, Storage policies, Realtime and Edge Functions are Supabase-specific. Self-hosting reduces that risk: the code is Apache-2.0 and Supabase recommends Docker for self-hosting, though you then own security, upgrades and backups yourself.

Who should use Supabase, and who should not

A good fit: web and mobile apps that need users, files and live updates without building a backend; teams who want SQL and relational data rather than a document store; and products that want a credible self-hosting fallback.

Probably not the right fit: databases that sit idle most of the time (scale-to-zero billing such as Neon's can cost less), estates with many small databases, organisations committed to AWS, Azure or Google Cloud networking and IAM, and workloads that only need a database and would pay for platform features they never use.

For a head-to-head on the most common alternative, see Supabase vs Neon and our Neon review. Other comparisons: Supabase vs Firebase and Supabase vs AWS RDS, plus our list of Supabase alternatives.

Pricing

Prices from the provider's official pricing pages, checked 8 October 2026, region All Supabase regions (the pricing page lists one rate per plan and compute size), in USD, excluding tax. List prices only; discounts, commitments and your actual usage change the bill.

A Supabase bill has three parts: the organisation's plan, compute for each project (billed hourly), and usage beyond the plan's quotas. Paid plans include 10 USD a month of compute credits, which covers one Micro project.

Worked examples are estimates calculated from the list prices above; they are not quotes or measured bills.

Frequently asked questions

Sources

• Supabase pricing
• Supabase docs: Compute and disk
• Supabase docs: Database overview
• Supabase docs: Auth
• Supabase docs: REST API
• Supabase docs: Realtime
• Supabase docs: Edge Functions
• Supabase docs: Branching
• Supabase docs: Backups
• Supabase docs: Upgrading and paused projects
• Supabase docs: Database size
• Supabase docs: Connecting to Postgres
• Supabase docs: Regions
• Supabase docs: Read Replicas
• Supabase docs: pgvector
• Supabase docs: JSON and unstructured data
• Supabase docs: Self-hosting
• Supabase (GitHub repository, licence)

Checked 8 October 2026.

How we research cloud database guides: our editorial method. CodeWithSQL earns nothing from the providers mentioned.