What is Bolt.new?
Bolt.new is StackBlitz's conversational web-application builder. It uses an AI agent inside a browser development environment to create files, install packages, run an application, show a live preview, connect services, and prepare deployment. Users can inspect and edit source instead of receiving only a static mockup.
That makes Bolt useful for turning a defined idea into a prototype. It does not remove software engineering. The main evaluation questions are whether generated architecture is maintainable, whether token and hosting costs remain controlled, and whether the team can safely own the application after the first successful preview.
A safer build workflow
Begin with a short product brief: target users, primary task, data entities, roles, prohibited features, integrations, and acceptance criteria. Ask Bolt to produce the smallest end-to-end path before adding polish. Commit or export each stable checkpoint so a bad agent turn can be reversed.
Treat authentication, authorization, payments, uploads, administrative screens, database migrations, and external API calls as separate review milestones. A generated login page proves only that a form renders. Test server-side session validation, object-level access, account recovery, rate limits, audit events, and tenant separation.
Inspect every dependency before installation. Confirm the real package name, publisher, license, maintenance, security advisories, and whether a native or server-side dependency can run in the intended environment. Remove packages that appear only because the agent changed direction.
Tokens, rollover, and total cost
Bolt's token documentation explains that most usage can come from reading and synchronizing the project. A one-line prompt on a large repository may therefore cost more than a longer instruction on a small one. The documentation also describes different reset rules for free and paid users, limited paid-token rollover, free daily caps, and reload tokens for eligible plans.
Measure cost by accepted milestone. Record initial generation, repeated context reads, repairs, discarded designs, and manual engineering time. Then add deployment compute, database, storage, bandwidth, domains, email, authentication, monitoring, and any connected AI APIs. Set a token budget and checkpoint the project before a large refactor.
Paid plan examples and rollover rules change, so recheck billing documentation at purchase rather than relying on an old plan comparison.
Benchmark an accepted milestone
Give Bolt the same small application brief as another builder, with one role boundary, a database relation, an external API, responsive states, and an accessibility requirement. Record tokens after planning, initial build, each correction, and final acceptance. Inspect whether the agent rewrites working areas while repairing one bug and whether a longer thread steadily increases context cost.
Test in a clean browser and on a real mobile device. Verify empty, loading, error, expired-session, unauthorized, and offline states. Use the exported repository for independent tests so the hosted preview is not the only evidence.
Privacy, rights, and security
The current StackBlitz privacy policy covers Bolt and describes AI inputs and outputs, third-party providers, and plan-dependent training or improvement choices. Verify the account setting and contract before submitting proprietary code, client data, credentials, or internal documentation. Map which model providers receive context and how deletion works.
Review the terms for ownership, commercial use, and plan restrictions. A platform permission does not clear copied assets, generated dependencies, trademarks, personal data, or third-party source code. Preserve repository history and license records.
Before deployment, run type checking, tests, SAST, dependency and secret scans, accessibility checks, and a manual threat review. Keep secrets in server-side environment variables, never expose them through client prefixes, screenshots, prompts, or logs. Test rollback, backup and restore, error handling, abuse protection, and account deletion.
Portability and alternatives
Connect a Git repository early and verify that the application runs outside the Bolt preview. Document local setup, environment variables, migrations, build, and deployment. Export database data and confirm that the app can move to another host without a proprietary runtime dependency.
Choose Bolt for fast browser-based full-stack prototyping. Compare v0 when React, Next.js, design control, GitHub sync, and Vercel are central; Replit for a broader cloud IDE and operations platform; and Cursor when an existing local repository needs an AI-first editor rather than a hosted builder.
A useful pilot boundary
Choose a pilot that is more demanding than a landing page but smaller than a customer system. A good test has authentication, two user roles, one relational workflow, an external service, realistic content, and clear mobile and accessibility requirements. Freeze the brief before starting. Measure time to the first draft, time to an accepted build, tokens consumed, defects found outside the preview, and the amount of code an engineer rewrites. That evidence is more useful than counting generated screens.
End the pilot with an ownership exercise. Another developer should clone the repository, configure a fresh environment, run migrations, replace one integration, deploy to a separate account, restore a backup, and remove a user. If that handoff is confusing, the prototype has not yet become maintainable software. Keep the experiment away from regulated or sensitive data until access, deletion, provider terms, and incident response are approved.
Visit the official Bolt.new website
