We tested 4 AI app builders with the same prompt. Here’s what broke.

Description and use

The author compared four free AI app builders on a multi‑user to‑do app with data isolation. All passed functional tests, but Bolt had mobile hover‑only buttons, Base44 lacked login recovery, v0 required lengthy manual setup, and Lovable had a 6‑character password minimum.

Problem

Assess how free‑plan AI app builders handle a multi‑user to‑do app with data isolation and usability on mobile.

Outcome

All four builders achieved perfect functional scores, but Bolt had mobile hover‑only buttons, Base44 lacked login recovery and token revocation, v0 required 15 min of manual setup, and Lovable had a 6‑character password minimum.

Workflow

• 1. Provide prompt: "A multi‑user to‑do app with sign‑up and login, a database where each user sees only their own tasks, and a public URL."
• 2. Run each builder on its free plan.
• 3. Execute 10 automated feature checks with Playwright, a phone‑width check, and a cross‑user visibility test.
• 4. Record score, build time, cost, and any functional issues.
• 5. Summarize findings and lessons learned.

Evidence

We kept seeing "best AI app builder" lists with no evidence behind them. So we gave Lovable, Bolt, Base44 and v0 the exact same prompt on their free plans:

Source

Then we checked what each tool built. We ran 10 automated feature checks with Playwright, a phone-width check and a cross-user test: can user B see user A's to-dos?

Source

None of them leaked data. User B never saw user A's to-dos in any of the four apps.

Source

Bolt: on a phone, the edit and delete buttons appear only on mouse hover, so touch users can't see them.

Source

Base44: if a new user closes the email-code page, the login screen offers no way to get back to it or resend the code. Logout also didn't revoke the token on the server.

Source

v0: setup took about 15 minutes and 6 manual steps: accept the terms, install Neon, approve SQL twice, generate an auth secret and publish by hand.

Source

Lovable: our checks found no functional bugs. The only nit is the 6-character password minimum.

Source

The useful signal is in the failures. Demos never show hover-only buttons, dead-end login screens or setup friction.

Source