GUN
What it is
GUN is a free, open-source graph database and data protocol for developers building decentralized apps. It synchronizes data between peers in real time and can keep data available after a refresh, including while offline. Its graph model supports SQL-like tables, JSON-like documents, files, livestreaming video, relational data, and hypergraphs. Browser peers store subscribed data in localStorage by default, with IndexedDB also available; in Node.js, RAD can store data on disk. Peers can communicate through WebRTC, WebSockets, or other transports, and relay peers pass messages between them. SEA provides cryptographic tools such as signing, encryption, verification, and certificates for authorizing writes. GUN supports self-hosted deployment and lists Android, iOS, Linux, macOS, Windows, web, and API platforms. A key security caveat is that public-space data can be edited by anyone by default; the User system is needed to restrict edits. The documentation also warns that JavaScript passwords or private keys can be exposed through attacks such as XSS.
For and against
For
- Synchronizes data between peers in real time.
- Can keep data available offline after refresh.
- Supports several graph data types.
- Offers WebRTC and WebSocket transports.
- SEA includes tools for signing and encryption.
Against
- Public-space data is editable by anyone by default.
- JavaScript credentials can be exposed through attacks.
- Deployment is self-hosted.
- Documentation cautions against recovery for banking apps.
The verdict
GUN combines peer synchronization, varied graph data, and storage options for decentralized app development. Public-space editability and credential exposure warnings make access control and credential handling important considerations.
Who it suits
GUN is aimed at developers building decentralized apps who want peer synchronization and a graph data model. It may suit developers comfortable with self-hosting and configuring data access and credentials carefully.
On the record
- Account recovery
- The documentation describes serverless password recovery using 3-Friend Account recovery, but cautions against using it for banking apps.gun.eco · read 9 Oct 2026
- Credential risk
- The tutorial warns that passwords or private keys in JavaScript can be exposed through XSS or other attacks and recommends a browser extension such as Party.gun.eco · read 9 Oct 2026
- Data models
- GUN supports graph data, SQL-like tables, JSON-like documents, files, livestreaming video, and relational and hypergraph data.gun.eco · read 9 Oct 2026
- Data sync
- GUN synchronizes data between peers in real time and can keep data available after refresh while offline.gun.eco · read 9 Oct 2026
- Data types
- GUN supports graph data including SQL-like tables, JSON-like documents, files, livestreaming video, relational data, and hypergraphs.gun.eco · read 9 Oct 2026
- Developer integrations
- The documentation shows GUN used with plain HTML and JavaScript and says developers can also use React or Vue.gun.eco · read 9 Oct 2026
- Development
- The tutorial demonstrates installing GUN with npm and running a local Node.js peer.gun.eco · read 9 Oct 2026
- Integrations
- The docs list storage options and adapters including localStorage, IndexedDB, Node.js filesystem, AWS S3, IPFS, Level, MongoDB, MySQL, Cassandra, Elasticsearch, and LMDB.gun.eco · read 9 Oct 2026
- Local first storage
- Browser peers use localStorage or IndexedDB for subscribed data, and the documentation says the same browser code runs in Node.js.gun.eco · read 9 Oct 2026
- Networking
- Peers can sync using WebRTC, WebSockets, or other transports, and GUN describes relay peers that pass messages between peers.gun.eco · read 9 Oct 2026
- Product
- GUN describes itself as an open source, decentralized graph database and data protocol for developers.gun.eco · read 9 Oct 2026
- Public data limit
- The documentation warns that anyone can edit data in public space by default and says the User system is needed to restrict edits.gun.eco · read 9 Oct 2026
- Security
- SEA provides cryptographic features including key pairs, signing, encryption, verification, and certificates for authorizing writes.gun.eco · read 9 Oct 2026
- Security limitation
- The documentation warns that public-space data can be edited by anyone by default.gun.eco · read 9 Oct 2026
- Server storage
- In Node.js, RAD can store data on disk with fs, and plugins for AWS S3 and other storage systems are available.gun.eco · read 9 Oct 2026
- Storage
- Browser peers use localStorage by default, with an IndexedDB adapter also available through RAD.gun.eco · read 9 Oct 2026
- Support
- The tutorial directs users to the GUN chatroom for help, Stack Overflow for API questions, and GitHub Issues for bug reports.gun.eco · read 9 Oct 2026
- Target users
- GUN presents itself as a tool for developers building decentralized apps and calls itself an open source Firebase alternative.gun.eco · read 9 Oct 2026
The review
Overview
GUN is an open-source graph database and data protocol for developers creating decentralized applications. It is a strong fit for teams that want peer synchronization and local-first storage, and can take responsibility for permissions and credential safety. Its flexible model is useful, but public-space writes need deliberate controls.
Key features
GUN synchronizes data between peers in real time and can keep subscribed data available after a refresh, including offline. That makes it worth considering for apps that need local access alongside peer updates; it is less suited to teams seeking a conventional managed database without responsibility for peer networking.
Its graph model accommodates SQL-like tables, JSON-like documents, files, livestreaming video, relational data, and hypergraphs. This range gives developers latitude to model varied app data, though a team should choose GUN for its decentralized graph approach rather than assume the breadth alone guarantees a fit.
Browser peers store subscribed data in localStorage by default, with IndexedDB available through RAD. In Node.js, RAD can write to disk using the filesystem, and adapters include AWS S3, IPFS, Level, MongoDB, MySQL, Cassandra, Elasticsearch, and LMDB. Peer connections can use WebRTC, WebSockets, or other transports, while relay peers pass messages between peers. These options help developers shape storage and networking to a deployment, but require choices and integration work rather than one fixed stack.
SEA provides cryptographic tools for key pairs, signing, encryption, verification, and certificates that authorize writes. GUN also describes a serverless password-recovery method based on three friends, but cautions against using it for banking apps. Security still depends on application design: public-space data is editable by anyone by default, and the User system is needed to restrict edits. The tutorial also warns that passwords or private keys in JavaScript can be exposed through XSS and other attacks, recommending a browser extension such as Party.
Developers can install GUN with npm and run a local Node.js peer. Documentation shows use with plain HTML and JavaScript as well as React or Vue. For help, GUN directs users to its chatroom, Stack Overflow for API questions, and GitHub Issues for bugs.
Pricing
GUN is free, with a free plan. That makes it accessible for developers evaluating a decentralized app stack without a software charge. Its self-hosted deployment model means teams should be prepared to manage their own deployment and access controls.
Platforms
GUN supports Android, iOS, Linux, macOS, Windows, web, API, and self-hosted use. The browser storage and Node.js paths give it options across client and server development, rather than limiting it to a single runtime.
Who it's for
GUN is for developers building decentralized apps who want real-time peer synchronization, local-first data availability, and flexibility across data models and storage backends. It is a less natural choice for teams that need public data locked down by default or cannot safely manage credentials and write permissions in their application.
Pros and cons
- Pro: Real-time peer synchronization and offline availability after refresh support local-first app experiences.
- Pro: Broad graph data support and multiple storage adapters allow developers to choose how data is represented and persisted.
- Pro: SEA includes cryptographic tools and certificates for authorizing writes.
- Con: Anyone can edit public-space data by default, so teams must implement restrictions for protected data.
- Con: JavaScript-held passwords or private keys can be exposed through XSS and other attacks, demanding careful credential handling.
- Con: The three-friend recovery approach is explicitly cautioned against for banking apps.
Alternatives
For other graph database options, browse Graph Databases or Mobile Databases.
LadybugDB is another free option, with MIT-licensed source code and pre-compiled binaries. Sparksee may suit academic users looking for an academic licence; its free academic plan requires a valid school or university ID, and a free trial is also offered. SeKejap is another free option across mobile and desktop platforms. Apache HugeGraph is a free, self-hosted graph database and related components for teams targeting Linux, macOS, API, or web use.
ArcadeDB offers a free Community plan billed forever, with its full feature set, documentation, tutorials, and community support; consider it when that database-focused package is a closer fit. Memgraph offers a free, open-source Community Edition with an in-memory graph database, ACID transactions, and on-disk persistence, and may suit teams prioritizing those traits. NebulaGraph has a free open-source edition with a subset of core features and community collaboration and support. Neo4j offers AuraDB Free as a managed graph database plan with no credit card required; choose it when a managed option is preferable to GUN's self-hosted approach.
Verdict
Choose GUN if you are building a decentralized application and want peer-to-peer synchronization, local-first availability, and a choice of storage and data models. Its main advantage is that breadth within a free, open-source protocol; look elsewhere if your application cannot tolerate default public editability or your team cannot own access control and credential security.