Companies Using Supabase

We detect Supabase on 19,361 domains, including Varsity Tutors LLC, f5, RevGenius Inc.. A detection means the technology is present on that domain, which for large organisations is often a single storefront or subdomain rather than a company-wide deployment. Among domains we matched to a company with a resolved industry, the most common is Technology, Information and Internet (4.79%).

We detect 19,361 domains running Supabase across our monthly crawl of live business domains. Company data could be matched for 12,450 of them (64.3%), and every company-size, industry and country breakdown on this page describes that matched subset rather than the full detected base. A further 2,977 domains carried a Supabase detection previously and no longer do.

Supabase holds 0.83% of the PaaS category, ranking #11. This is a share of the domains we detect running a platform in this category — not a share of all websites, and not a share of spending — so it is not directly comparable to figures published on other denominators.

The top alternatives to Supabase include Amazon Web Services (39.98% market share), Vercel (16.64% market share), WordPress.com (8.24% market share), Azure (7.5% market share) — measured as a share of the domains we detect running a platform in this category.

United States leads with 3,327 matched Supabase domains, followed by Brazil (1,138), United Kingdom (871), India (569), Canada (451). These are counts within the 12,450 domains we could match to a company record, not the full detected base.

The most common company size is 1-10 employees, representing 69.4% of the Supabase domains we could match to a company record and size — a subset of 12,450 matched companies, not of all 19,361 detected domains. This is followed by 11-50 employees (21.66%) and 51-200 employees (6.24%).

Among the Supabase domains we could match to a company with a known founding date, the largest group was founded in the 2020s (39.9%), followed by the 2010s (38.5%). That matched subset is drawn from 12,450 companies and is not representative of all 19,361 detected domains. This suggests Supabase is most popular among relatively young companies.

The ideal Supabase customer is: Company Size: 1-10 employees (69.4%), then 11-50 (21.66%), Company Age: Founded in the 2020s (39.9%) or the 2010s (38.5%), Geography: United States (3,327 matched domains), Brazil (1,138), United Kingdom (871), India (569), Industry: Technology and Internet, Software Development, Retail, IT Services and IT Consulting, Tech Stack: Next.js (40.33%), Vercel (40.05%), Cloudflare (54.04%), React Router (25.01%), Use Case: Postgres database, auth and storage behind a JavaScript front end — based on our analysis of 12,450 enriched companies at TechnologyChecker.io.

Supabase is an open-source backend platform built on PostgreSQL. A project gives you a Postgres database, an auto-generated API over it, authentication, file storage, edge functions and vector search, all reachable from a client library. It is a data layer rather than a host: you add it to a site that is already deployed somewhere, which is why 40.05% of the domains we detect running Supabase are also running Vercel.

No, and this is the most common misreading of the numbers on this page. Supabase hosts your database and its API; your application still runs somewhere else. That is why it sits in the PaaS category next to Amazon Web Services, Vercel and Azure while co-occurring with them rather than displacing them. Two in five Supabase domains run Vercel at the same time.

Because the products a corridor would be computed against are complements. Of the domains that ever carried both Supabase and Vercel, 90.2% still carry both; against Netlify it is 88.2% and against Amazon Web Services 78.3%. A switching figure built on numbers like those would mostly describe a site dropping its database layer while staying exactly where it was hosted, or a crawl that missed one of the two signals on one pass. It would read as a market moving when nothing moved, so we publish none.

Yes, and you should know that before you act on a single detection. One of our clauses matches a wordmark image linking back to supabase.com, the attribution badge that sites and templates display. It is strong evidence the site was built on Supabase, but it matches a picture and a link rather than a running service, and a template keeps the badge whether or not the project behind it is still live. The other clauses, the JavaScript globals and the .supabase.co script sources, do indicate a live client. Confirm in a browser before telling anyone they are actively running Supabase.

Six clauses, matched independently, any one of which counts a domain. Four JavaScript globals: supabase.AuthAdminApi, supabase.storageKey, __NUXT__.config.public.SUPABASE_URL and __NUXT__.config.public.supabase. One script clause matching sources under .supabase.co. One DOM clause matching a "Made with Supabase" wordmark image that links to supabase.com.

This profile previously showed 5,720 domains and now shows 19,361, about 3.4x. Supabase did not triple in a month. Our coverage of the signals that identify it widened, and the same widening is visible inside the chart: 10,775 active domains on 1 June 2026, 16,596 on 1 July and 19,361 on 1 August. Read the level as current and the June to July step as coverage rather than growth.

Two of the four JavaScript globals we match, __NUXT__.config.public.SUPABASE_URL and __NUXT__.config.public.supabase, exist only on Nuxt sites, where the Supabase URL is exposed through the framework's public runtime config. It is a reliable signal where it applies but it is framework specific, so it adds Nuxt sites to the base without describing it. The stack data confirms as much: Next.js is on 40.33% of sampled Supabase domains while Vue.js, the family Nuxt belongs to, is on 5.3%.

2,977 domains dropped a detection since we began tracking in March 2026, roughly 15% of the current base, and most of that is intermittency rather than removal. The clearest Supabase signals are JavaScript globals that exist only once a page has loaded and run its client bundle, so a route that never touches the database, or a page that renders differently between crawls, produces a miss. Treat the drop count as detection flicker unless you can confirm a specific domain in a browser.

Because a managed backend that you provision, scale and pay for per project belongs there, alongside Amazon Web Services, Vercel, Azure and Firebase. The category is broader than the competitive set, though. Only Firebase in the category's top five answers the same question Supabase answers; the rest are places to run an application, and Supabase runs alongside them rather than instead of them.

No. A detection means Supabase is present on that domain. For larger organisations that is usually one subdomain: f5 on community.f5.com, Vanta on community.vanta.com, Mixpanel on community.mixpanel.com, Deriv on blog.deriv.com, the Rockefeller Foundation on impactreport.rockefellerfoundation.org. Twelve of the fifteen recognisable names highlighted on this page were detected on a subdomain rather than a main site, most often a community forum or a standalone portal.

For many teams, yes; the two answer the same question with different databases. Supabase is Postgres, so you get SQL, joins, constraints, extensions and the option of taking your data anywhere Postgres runs. Firebase is a document store with deeper mobile SDKs and tighter Google Cloud integration. Choose on the data model rather than on a feature checklist. We publish no switching count between the two, for the reason given in the question about migration data on this page.

The G2 criticism on this page is unusually consistent: beginner unfriendly, high complexity, insufficient guidance and learning difficulty, all describing the same reviewer, someone who arrived without SQL. Postgres is the product's greatest strength and its steepest requirement. Premium pricing draws the other repeated complaint, and self-hosting the open-source stack is real operational work rather than a checkbox.

There is a free tier with caps on database size, storage, bandwidth and monthly active users, and projects that sit idle can be paused. Paid plans lift those caps per project. The free tier is generous enough to run something real, which is part of why this base skews so hard to the smallest companies: 69.4% of matched Supabase domains belong to companies with 1-10 employees.

The database underneath is Postgres, which is production software with decades behind it, and the paid tiers add backups, point-in-time recovery and read replicas. The caveats are operational rather than technical: Row Level Security has to be configured deliberately, and a project that grew out of a prototype often has not been. Our data shows the shape of that risk, with 69.4% of matched companies at 1-10 employees and 39.9% founded in the 2020s.

Row Level Security is the whole game. The anon key is designed to be public and is only safe in client code if every table it can reach has policies on it; the service_role key bypasses those policies and must never ship to a browser. Turn RLS on for every table, write the policies before you expose an endpoint, and check what an unauthenticated request can actually read. Generated code deserves particular scrutiny here, because it will happily return working queries against an unprotected table.

Because it collapses the backend into one provisioning step. A tool generating a full-stack application needs a database, authentication and file storage to exist within seconds and be reachable from generated client code, and Supabase provides all three behind one project URL and one key. The result shows up in our stack data as a very JavaScript-heavy base: Next.js on 40.33% of sampled domains, React Router on 25.01%, React on 11.71%.

Next.js leads on 40.33% of sampled Supabase domains, followed by React Router (25.01%) and React (11.71%). Vue.js sits at 5.3%, Svelte at 1.24% and Astro at 1.1%. These are shares of the sampled active domains, and a domain can appear in more than one row.

Brazil is second with 1,138 matched domains, behind the United States on 3,327 and ahead of the United Kingdom (871) and India (569). The Brazilian names in our matched set are ordinary businesses rather than software companies: Le Biscuit in retail, Parkindigo in facilities services, Geolab in pharmaceutical manufacturing, Vedraga in outsourcing. That is the signature of a backend arriving through agencies and app builders rather than through enterprise procurement. These are counts inside the 12,450 domains matched to a company record.

Mostly. 69.4% of the 11,803 matched domains with a resolved employee band belong to companies with 1-10 employees, against 55% to 64% for the other five PaaS platforms in this refresh. Every band above 200 employees adds up to 319 domains. The large names that do appear are real but narrow: f5, Deriv, Varsity Tutors, Alpine Formula 1 and Haas F1 Team were each detected on a single subdomain.

Of the 7,250 matched domains with a known founding decade, 39.9% were founded in the 2020s, ahead of the 2010s at 38.5%. In the same category Cloudways shows 16.85% in the 2020s and Heroku 10.47%. A platform that companies adopt at founding builds a base shaped like the founding cohort; a platform that companies migrate to inherits whatever cohort was already there.

The distribution is unusually flat. Technology, Information and Internet leads on 547 domains (4.79% of industry-resolved domains), then Software Development (498, 4.36%), Retail (494, 4.33%), IT Services and IT Consulting (472, 4.14%), Real Estate (427, 3.74%) and Advertising Services (410, 3.59%). No vertical clears 5%, and Retail sitting level with Software Development is the tell that a large share of this base did not pick a backend deliberately.