Retool vs Appsmith vs ToolJet vs Budibase (2026): Prices, Licences, SSO

Every team I have worked with eventually needs the same thing: a screen where support can look up a customer, refund an order, or flip a flag without someone opening a database console. I have built these as Rails admin pages, as Retool apps, as Appsmith apps and as hastily written scripts with a Slack command in front. The internal tool builder market in 2026 is mostly the same four products it was in 2023 (Retool, Appsmith, ToolJet and Budibase), now with AI app generation bolted on and a new set of prompt-to-app builders sitting next to them. This post compares Retool vs Appsmith vs ToolJet vs Budibase on the things that actually decide the choice: list price for a realistic team, licence, whether you can self-host, where SSO sits, what the AI features cost, and the security record. Then it asks when you should skip all of them and write code.

The four products in one table

Prices below are list prices from each vendor's pricing page as of 10 November 2026, per user per month, annual billing where the page distinguishes it. Releases and licences come from the GitHub API.

	Retool	Appsmith	ToolJet	Budibase
Source licence	Proprietary	Apache-2.0	AGPL-3.0	GPLv3 overall, BSL for paid features
Latest release	Not public	v2.6.0, 28 Oct 2026	v3.20.256-lts, 6 Nov 2026	v3.50.0, 19 Oct 2026
Free tier	Up to 5 users, cloud only	Up to 5 users on cloud; Community edition self-hosted	2 builders, 50 end users, 10 apps	Community: self-hosted, unlimited users
Cheapest paid	Team: $10 builder, $5 internal user	Business: $15 per user	Basic: $23 per builder	Cloud: from $299 a month
Self-hosting	Enterprise only	Free (CE) and paid	Free and paid	Free (Community) and Enterprise
SAML or OIDC SSO	Enterprise	Enterprise ($2,500 a month for 100 users)	Team ($199 per builder)	Community lists "standard SSO"; enterprise identity controls by quote
Sources	Retool pricing	Appsmith pricing	ToolJet pricing	Budibase pricing

Two rows in that table do most of the work. Retool lists self-hosting ("Retool Cloud, self-hosted, or air-gapped") under Enterprise only, so if your data cannot leave your network, Retool's Team and Business prices are irrelevant to you. And SAML or OIDC single sign-on is an Enterprise feature at Retool and Appsmith, while Budibase keeps its "enterprise identity and access controls" behind a quote. The cheap tiers are cheap partly because they leave out the feature your security team will ask for first.

How much do Retool, Appsmith, ToolJet and Budibase cost for a real team?

Per-seat prices are hard to compare because each vendor slices users differently. Retool charges builders and internal users separately. Appsmith's Business plan is a flat $15 per user up to 99 users. ToolJet prices per builder and caps end users by plan. Budibase Cloud is a base fee that includes 2 creators and 20 end users, with extra creators at $50 a month on annual billing.

So I priced one team shape: 5 builders and 20 internal end users, on the cheapest plan each vendor sells that fits, using list prices only.

• Retool Team: 5 x $10 + 20 x $5 = $150 a month. No audit logs, no SSO, no self-hosting.
• Appsmith Business: 25 x $15 = $375 a month. Custom roles, audit logs and workflows, Google and GitHub OAuth, no SAML.
• ToolJet Pro: 5 x $79 = $395 a month, within its 50 end user and 10 app limits.
• Budibase Cloud: $299 plus 3 extra creators at $50 = $449 a month.
• Retool Business: 5 x $50 + 20 x $15 = $550 a month. Adds audit logs and richer permissions, still no SSO.
• ToolJet Team: 5 x $199 = $995 a month. The cheapest listed plan in this group with SAML, OIDC and LDAP.
• Appsmith Enterprise: $2,500 a month, the listed floor, which covers 100 users.

The pattern is the old SSO tax: the moment you need your identity provider in front of the tool, the bill moves by a factor of two to seven. If you already run an identity provider and only need OIDC, ToolJet Team is the cheapest listed route (Budibase documents an OIDC integration, but its pricing page does not say which plan includes it). If your Google Workspace or GitHub org is your identity source, Appsmith's free and Business tiers handle that with plain OAuth and no SAML required.

Open source licences: Apache-2.0, AGPL-3.0 and GPLv3 are not the same deal

"Open source Retool alternative" is the phrase people search, and all three alternatives qualify, but the licences differ in ways your legal team will notice.

Appsmith is Apache-2.0, the most permissive of the three. You can modify it, embed it and ship it without publishing your changes. ToolJet is AGPL-3.0: if you modify ToolJet itself and let users reach it over a network, you owe them the modified source. Building apps in an unmodified ToolJet is not the issue; forking the platform is. Budibase's licence file says to "consider Budibase to be GPLv3 licensed overall", with MPL 2.0 for the parts that ship inside your apps and the Business Source Licence for paid features in its pro package.

Here is how I checked, so you can rerun it when this post is stale:

# Requires GitHub CLI 2.x, authenticated. Output captured on 10 Nov 2026.
for r in appsmithorg/appsmith ToolJet/ToolJet Budibase/budibase; do
  echo "== $r"
  gh api "repos/$r/releases/latest" --jq '.tag_name + " " + .published_at'
  gh api "repos/$r" --jq '.license.spdx_id'
done
# == appsmithorg/appsmith
# v2.6.0 2026-10-28T18:10:23Z
# Apache-2.0
# == ToolJet/ToolJet
# v3.20.256-lts 2026-11-06T15:15:01Z
# AGPL-3.0
# == Budibase/budibase
# v3.50.0 2026-10-19T08:09:46Z
# NOASSERTION   <- mixed licences, read the LICENSE file

The other licence question is the one nobody asks: open core. Every one of these products keeps its best access-control features in a paid edition. Appsmith's free tier has three predefined roles; custom roles need Business. ToolJet's free self-hosted plan has predefined roles only. Self-hosting the free edition gets you the editor, not the governance.

Can you self-host Retool, Appsmith, ToolJet and Budibase?

Yes for all four, at very different prices. Retool's self-hosted deployment exists and is maintained, but sits behind an Enterprise contract. Appsmith Community runs as a single container with MongoDB, Redis and PostgreSQL embedded; its Docker install docs ask for at least 8 GB of RAM for that all-in-one setup and recommend pinning a version tag for production. ToolJet's self-hosted free plan works, with the 2 builder cap. Budibase Community is free with unlimited users, which makes it the most generous self-hosted free tier on paper.

Self-hosting is where platform discipline matters more than the product choice. An internal tool builder holds credentials for your production databases and APIs; it is one of the highest-value targets on your network. If you run one, you own its patching, backups, TLS and network exposure. I wrote up the full procedure for one of them in how to self-host Appsmith with Docker, including the parts the quick-start skips. The self-hosting vs SaaS trade-off is the same as for any other stateful service: cheaper licences, more of your time.

Security record: what actually went wrong

Two incidents are worth knowing because they map onto the two deployment models.

In 2023 Retool's cloud was breached through its staff, not its code. The company's own write-up, published on 13 September 2023, describes an SMS phishing message, a fake Okta portal, a deepfaked voice call for an MFA code, and Google Authenticator codes synced to the employee's Google account. Twenty-seven cloud customers were affected; on-premises deployments were not. The lesson for buyers is that SaaS moves the attack surface to the vendor's people and processes, which you cannot audit.

For self-hosted Appsmith, Rhino Security Labs disclosed CVE-2024-55963 and two related bugs. The bundled PostgreSQL used trust authentication, and because open signup was on by default, an attacker could register, build an app, connect to that local database and run system commands. Versions 1.20 to 1.51 were affected; 1.52 fixed it. CVE-2024-55964 let App Viewer users run arbitrary SQL against datasources through a schema preview endpoint. The lesson for self-hosters: turn off public signup, keep up with releases, and give datasources the narrowest database role that works. Appsmith's current release notes show the project still shipping access-control fixes in nearly every version; v2.6.0 tightened editor-mode page reads and Redis command bindings.

None of this makes one product "secure" and the others not. It says the boring controls (SSO, least-privilege datasource roles, patch cadence, audit logs) matter more than the logo. Those are exactly the controls the cheap tiers leave out.

AI features: credits, agents and prompt-to-app

All four now generate apps from prompts. The differences are in metering and in whether you can bring your own model.

Retool's pricing page lists pooled AI credits per month (250 on Free, 1,000 on Team, 3,000 on Business, 10,000 on Enterprise) that do not roll over, and only Enterprise can use its own provider key. Retool Agents are billed separately by the hour, with up to 20 free agent hours a month on every plan; Retool explained the hourly model in June 2025. ToolJet AI generates pages, queries and bindings from a description; its docs say self-hosted and Enterprise Cloud customers can bring their own model key so actions do not consume ToolJet credits, and ToolJet also exposes an MCP server so coding agents can build apps. ToolJet lists extra credits at $1 per 100. Budibase Cloud includes 50,000 AI credits a month. Appsmith's v2.6.0 release notes mention MCP structured SQL filters, though I could not find a pricing page line that meters AI.

My scepticism: AI generation is good at the first 80 percent of a CRUD screen, which was already the easy part in these tools. The hard 20 percent is permissions, edge cases in queries, and who is allowed to press the refund button. No credit pool fixes that.

AI app builders vs internal tool builders, and when to just write code

The newer prompt-to-app builders (Lovable, v0, Bolt and similar) produce a full application, usually React plus a hosted backend, rather than an app inside a governed platform. That is great for prototypes and customer-facing MVPs, and risky for internal tools that touch production data, because you inherit whatever auth and row-level security the model wrote. The vibe-coded app security numbers are why I would not point one at a production database without a review. (I build Riff, an open-source, self-hostable alternative to Lovable and v0, so weigh my view accordingly.) The market side of this shift is covered in no-code incumbents vs AI app builders.

Write code instead of buying a builder when any of these hold:

1. The tool is the product's admin surface. If it needs the same domain logic as your app, a builder will duplicate it in JavaScript snippets nobody tests. Your framework's admin (Django admin, Rails, a small Next.js page) reuses the real code.
2. You need real tests and review. Builders have Git sync, but diffs of JSON layouts are not reviewable in any meaningful sense.
3. You already have SSO, deploys and observability. The builder's main value is giving you those cheaply. If your platform already provides them, the marginal value drops.
4. The user count is large. At a few hundred end users, per-seat pricing outruns the cost of an engineer-week of CRUD code.

Buy a builder when the tools are many, small and owned by ops or support people; when you need something by Friday; and when the alternative is a shared SQL client with write access.

FAQ

Is Appsmith really free to self-host?

Yes. Appsmith Community Edition is Apache-2.0 and runs as a single Docker container. You get Google and GitHub OAuth, three predefined roles and up to 3 Git-connected repositories; custom roles, audit logs and SAML or OIDC need the paid editions.

What is the cheapest Retool alternative with SAML SSO?

On list prices in November 2026, ToolJet Team at $199 per builder per month (annual) is the cheapest plan in this group that includes SAML, OIDC and LDAP, self-hosted or on cloud. Retool puts SAML on its quote-only Enterprise plan, Budibase's pricing page does not name SAML at all, and Appsmith Enterprise starts at $2,500 a month for 100 users.

Can I self-host Retool on the Team or Business plan?

No. Retool's pricing page lists self-hosted and air-gapped deployment only under Enterprise. Team and Business are Retool Cloud only.

Is ToolJet's AGPL licence a problem for internal use?

Usually not. AGPL obligations apply when you modify ToolJet itself and offer it over a network; building apps in an unmodified instance does not require you to publish anything. If you plan to fork the platform, get a legal read first.

If I were choosing this quarter for a team of five builders, I would self-host Appsmith Community behind our existing Google or GitHub login if the data could not leave our network, and pay for ToolJet Team if SAML were a hard requirement. I would give every datasource a read-only role first and add write roles one query at a time, and I would write the one or two tools that carry real business logic as code in the main app. The builder handles the long tail; the code handles the things that can lose money.

Related: Enterprise-Ready SaaS in 2026: SSO, SCIM, Audit Logs and the SSO Tax, No-Code Didn't Die. It Sold for 2.7x ARR While Its Replacement Raised at 27x and Self-Hosting vs SaaS in 2026: 37signals Saved $2M a Year. Should You?