PocketBase: a complete backend in a single file

What is PocketBase?

In the backend tooling ecosystem, few options are as straightforward as PocketBase: you download a file, run it, and you have a working backend.

PocketBase is an open source backend as a service written in Go that uses SQLite as its database engine. The combination may sound modest, but in practice it delivers something many projects need and few tools offer: fast setup without sacrificing functionality.

And there's something else that sets it apart: you can use it as a framework. That means you can write your own business logic in Go or JavaScript and still end up with a portable backend. You're not locked into a black box.

What do you get out of the box?

The list of features PocketBase ships with, no extra configuration required, is strikingly long for something so lightweight:

Database and API SQLite as the persistence engine, with REST endpoints generated automatically for every collection. Each endpoint includes validation, pagination and filtering, which removes a good chunk of the usual backend boilerplate.

Full authentication JWT, OAuth2, MFA and OTP are available from the start. It also handles separate roles for admins and application users, with nothing to configure separately.

Real-time sync WebSocket updates are available on collections. Any data change can be pushed to the client without polling.

Web admin dashboard A UI for managing collections, users, permissions and settings. It's especially useful in the early stages of a project, when you want to iterate fast.

File management Built-in file uploads and handling, with no need to set up an external service for basic use cases.

Migrations and SQL views Support for schema migrations and SQL views, which gives your data model more power without leaving the ecosystem.

Extensibility For more advanced logic, PocketBase exposes hooks and lets you write atomic transactions, triggers and stored procedures in Go or JavaScript.

Concrete advantages

Frictionless deployment A single binary. No external dependencies, no complex environment setup, no mandatory Docker. You download the executable and start the server. For local development or VPS deployments, this cuts setup time down to minutes.

Open source and customizable Because it's open source, you can modify it, audit it and plug it into your own pipelines. You don't depend on a vendor that might change its pricing or deprecate features.

Ready-to-use APIs The time you'd normally spend building CRUD endpoints with validation and pagination can go into product logic instead. PocketBase handles that repetitive work automatically.

Typed clients with community tools The community built pocketbase-typegen, a tool that generates TypeScript types from your collection schema. A very handy addition for frontend projects.

A practical example with the JavaScript SDK

The quickest way to see PocketBase's value is to look at how little code you need to work with a collection from the frontend:

import PocketBase from 'pocketbase';

const pb = new PocketBase('http://127.0.0.1:8090');

// User authentication
const authData = await pb.collection('users').authWithPassword(
    'user@example.com',
    'mi-password-segura'
);

// List records with filtering and pagination
const posts = await pb.collection('posts').getList(1, 20, {
    filter: 'published = true',
    sort: '-created',
    expand: 'author'
});

// Create a new record
const newPost = await pb.collection('posts').create({
    title: 'Mi primer post',
    content: 'Contenido del artículo...',
    published: false
});

// Subscribe to real-time changes
pb.collection('posts').subscribe('*', (event) => {
    console.log(`Evento: ${event.action}`, event.record);
});

With this you get authentication, filtered listing, record creation and real-time updates. Without writing a single line of backend code.

Limitations to keep in mind

PocketBase isn't the answer to everything. Before adopting it, you need to be clear on its constraints:

Horizontal scalability SQLite isn't designed for distributed databases or for handling very high write loads across multiple nodes at once. For applications expecting massive traffic or needing replication, other options are a better fit.

Complex backend logic PocketBase handles CRUD cases and standard authentication flows well. If your application requires very complex business logic or deep integrations with external systems, you'll probably need to complement it with additional services.

A relatively young ecosystem It's a new project, and its community, while active, doesn't have the maturity of alternatives like Firebase or Supabase. There are fewer libraries, fewer resources and fewer examples available.

Custom atomic transactions For cases that require complex transactions beyond the available hooks, extensibility has its limits within the model it offers.

When does it make sense to use it?

PocketBase fits well in specific contexts:

Prototypes and MVPs where development speed is the priority and initial scale is limited. You can have a working backend in hours instead of days.

Small and medium applications that don't need a distributed architecture and whose data volume and traffic SQLite can handle.

Personal or freelance projects where the cost of commercial BaaS platforms isn't justified and a self-hosted solution is preferred.

Internal tools within organizations where full control over the data and no recurring costs are requirements.

PocketBase vs. the alternatives

To choose well, it's worth placing PocketBase alongside its direct competitors:

Firebase is the choice when you need guaranteed scale, but it means depending on Google's infrastructure and growing costs.

Supabase is more robust for complex applications since it uses PostgreSQL, and it's also open source, but the initial setup is heavier.

Strapi makes sense when the use case is a headless CMS with content workflows, less so as a general-purpose application backend.

Conclusion

PocketBase solves a real problem: the gap between "I need a backend" and "I have a working backend" is far too wide in many modern stacks.

For teams working on MVPs, internal tools or projects where iteration speed matters more than future scale, PocketBase makes a hard-to-ignore case. A single binary, no dependencies, with full authentication, an automatic REST API and real-time updates.

Its limitations are real, but they're also predictable. If your application outgrows what SQLite can handle, you'll have the (good) problem of having validated your product. Migrating at that point is an informed decision, not a shot in the dark.

At Devlights we evaluate tools like PocketBase in the context of each project, looking for the right balance between delivery speed and technical soundness. If you're thinking about the architecture of your next application and want a second opinion, let's talk.