shouldiuse.io

Categories

VERDICT

Firebase Review

Depends

Should I use Firebase?

Discover Firebase, Google's mobile and web app development platform that helps developers build apps and games that users will love. - firebase.google.com

· 1 month ago

Buy it if you're a small team shipping a mobile or web app fast and you set billing alerts on day one. Skip it if you need relational data, predictable costs, or an easy exit path.

Confidence

Medium. Based on 60+ public sources; many snippets truncated, limiting verbatim user quotes.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo evidence in sources reviewed
  • Security posture

Pricing

$0

Spark

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
BlazePay-as-you-go

Best for

  • Mobile app MVPs
  • Indie devs and startups shipping fast
  • Realtime chat and sync features
  • Google Cloud shops

Not for

  • Apps needing complex relational queries and joins
  • Anyone allergic to surprise usage bills without budget alerts
  • Teams that need a clean exit — lock-in is real
  • Enterprises wanting SQL-native data control or self-hosting

Gotchas - check before you buy

high

Blaze pay-as-you-go can spike hard; Reddit documents bills skyrocketing from one bad loop

high

Default open security rules have publicly exposed 19M plaintext passwords

medium

SMS auth costs climb fast; alternative vendors call it the budget killer

medium

Deep Google lock-in: moving to SQL or self-hosted later is painful

Pros and cons

Pros

  • Firebase Auth is free at entry level
  • Full backend suite: auth, realtime DB, storage, hosting, monitoring, testing
  • Google-scale infrastructure and Google Cloud integration
  • Fast implementation highlighted in NPR case study
  • Widely adopted: 44,365 companies tracked using it

Cons

  • Usage bills can skyrocket from a single code mistake
  • Community reports unexpected extra charges stacking on paid plans
  • SMS verification pricing escalates quickly at scale
  • Misconfigured security rules have exposed millions of passwords
  • Lock-in and hard data migration cited as top limitations

Sources & method

- 10 sources - Google-backed and generally safe when configured correctly; SDK CVEs exist, and misconfigured rules have caused massive leaks.

official x2review x4security x2news x2
  • CVE-2024-11023: Firebase JS SDK auth token redirect, Attackers could manipulate the _authTokenSyncURL to point to their own server.
  • CVE-2026-8787: Firebase Support Plugin privilege escalation, Privilege escalation vulnerability in the Firebase Support Plugin.
  • 19M plaintext passwords exposed (2024), Researchers found large numbers of incorrectly configured Firebase instances exposing plaintext passwords.
  • 1.8M user passwords leaked via misconfigured servers (2025), Massive data leak through misconfigured Firebase servers exposed passwords of 1.8 million users.

Key stats

  • Value for money: 2/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 2/5. Generous free tier, but usage bills spike unpredictably
  • Ease of use: 4/5. Fast setup repeatedly praised by users
  • Feature depth: 5/5. Auth, database, hosting, monitoring, testing in one platform
  • Support quality. No evidence in sources reviewed
  • Security posture: 3/5. Google tooling solid; CVEs and misconfig leaks recur
  • 44,365 Companies using Firebase tracked by TheirStack
  • Free Starting price Spark tier; Blaze is pay-as-you-go
  • Yes Free tier Spark plan with usage limits
  • 0.34% Market share of software frameworks (Enlyft)

Pricing

Spark

$0

  • Free auth with entry-level limits
  • Starter hosting and database allowances

Blaze

Pay-as-you-go

  • Per-use pricing on database, storage, functions
  • Integrates with Google Cloud; no upfront cost

Security

Google-backed and generally safe when configured correctly; SDK CVEs exist, and misconfigured rules have caused massive leaks.

  • CVE-2024-11023: Firebase JS SDK auth token redirectAttackers could manipulate the _authTokenSyncURL to point to their own server.⁸
  • CVE-2026-8787: Firebase Support Plugin privilege escalationPrivilege escalation vulnerability in the Firebase Support Plugin.
  • 19M plaintext passwords exposed (2024)Researchers found large numbers of incorrectly configured Firebase instances exposing plaintext passwords.⁷
  • 1.8M user passwords leaked via misconfigured servers (2025)Massive data leak through misconfigured Firebase servers exposed passwords of 1.8 million users.

What users say

Users praise the quick setup and free auth but repeatedly warn about surprise bills and security-rule pitfalls.

“Firebase is good.”
Reddit, r/Firebase

Companies that use it

Full analysis

Based on 60+ public sources; many snippets truncated, limiting verbatim user quotes.

Google's fast, free-to-start backend — great for MVPs; usage bills and lock-in bite at scale.

Methodology

Based on 60+ public sources; many snippets truncated, limiting verbatim user quotes.

Read how a report is made.

Sources

  1. Firebase Reviews 2026 | G2g2.com
    review
  2. Firebase Reviews 2026 | Capterracapterra.com
    review
  3. Is firebase worth it? | Redditreddit.com
    review
  4. What Can Cause Firebase Costs to Skyrocket? | Redditreddit.com
    review
  5. Firebase Pricing | Googlefirebase.google.com
    official
  6. Firebase Authentication pricing explained | Logtoblog.logto.io
    news
  7. 19 million plaintext passwords exposed | Malwarebytesmalwarebytes.com
    security
  8. CVE-2024-11023 Firebase JS SDK | GitLab Advisoriesadvisories.gitlab.com
    security
  9. NPR Case Study | Firebasefirebase.google.com
    official
  10. Companies that use Firebase (44,365) | TheirStacktheirstack.com
    news

Add this review to your site

This check for Firebase says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Firebase Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.