Was this website vibe coded?
Paste a URL and we will tell you which AI app builder it was made with, if any, and show you exactly what gave it away. It reads the same public markers a developer would check by hand, just faster.
How you tell what built a website.
Most AI app builders leave something behind: a script they load, the address they host on, a badge in the footer, or a tag in the page head. None of it is hidden. Anyone can open the page source and look. This tool just knows what to look for across the main builders.
Lovable
Leaves a runtime script from cdn.gpteng.co on the page, and often sits on a lovable.app address. One of the easier ones to spot.
Bolt.new
Apps published through Bolt usually sit on a bolt.host or bolt.new address. Move it to a custom domain and the trail goes cold.
Replit
Published Replit apps live on replit.app (or the older repl.co). The address is the giveaway.
Base44
Base44 apps are served from base44.app unless the owner has pointed a custom domain at them.
v0 by Vercel
The hardest to detect. v0 hands you code you host yourself, so a finished v0 site usually looks like any other hand-built one.
What it cannot see.
A detector that pretended to be certain would be lying to you. Here is where this one goes quiet, so you know how to read a clean result.
Cursor, Claude Code and Windsurf
These are coding tools, not hosts. A site built with them is just normal code on normal hosting, with nothing left behind to find.
Sites that have been cleaned up
Move a project to a custom domain, strip the badge, tidy the meta tags, and most fingerprints disappear. A clean result never means a site was not built with AI.
How good the code is
This tool tells you which tool was used, not whether the result is secure or well built. That is a separate question, and the one that usually matters more.
Knowing what built it is the easy part.
The build tool is rarely the real question. AI builders are quick, but they routinely ship apps with exposed API keys, databases left open to the public, and no real access control, because nobody told them not to. If a site you own or rely on was vibe coded, the next move is to find out whether it is actually safe.
Frequently asked questions.
Lovable apps load a small runtime script from cdn.gpteng.co (gptengineer.js), and many are served from a lovable.app address. Either of those on a page is a strong sign the site was built with Lovable. If both have been removed, it gets much harder to tell.
Bolt and Replit apps usually sit on their own hosting (bolt.host, replit.app), which is the clearest signal. v0 is different: it gives you code to host yourself, so a finished v0 site often has no fingerprint at all. We are honest about that in the result rather than guessing.
No, and nothing reliably can. Cursor, Claude Code and Windsurf are coding tools, not hosts or platforms. A site built with them looks like ordinary hand-written code, so there is no marker to find. If the checker says no fingerprint, that is one of the reasons why.
No. Markers are easy to remove. A site can be entirely AI-built and still come back clean once it is on a custom domain with the builder's badge taken off. Treat a clean result as no evidence either way, not proof.
Not on its own. The issue is that AI builders often ship code with security gaps the owner never sees, such as exposed keys or a database with no access rules. The build tool is not the problem; unchecked output is. If a site was vibe coded, the sensible next step is a security check.
When it finds a builder fingerprint, it shows you the exact thing it found and where, so you can judge it yourself. It only names a builder on strong, hard-to-fake signals. It is an indicative read from public markers, not a definitive statement about how a site was built.