The backend is the behind-the-scenes part of a website or app. It runs on servers rather than in the visitor's browser, and it does the work that has to be private or permanent: saving orders, checking passwords, charging cards, sending emails and storing data in a database.
What lives on the backend
- Application code. The rules of your business: what a booking costs, whether a time slot is free, who may see an invoice. Common languages include JavaScript on Node.js, Python, PHP, Ruby, Go, Java and C#.
- A database. PostgreSQL, MySQL and MongoDB are common. This is where customers, orders and content are kept.
- An API. The set of addresses the frontend calls to ask for data or trigger actions.
- Connections to other services. Payment providers, email senders, accounting software and maps.
How a backend answers a request
A visitor logs in to a client portal. The browser sends the email and password to the backend. The backend looks up the account, compares the password against a stored hash (never the plain password), creates a session and returns a token. On every later request, the backend checks that token before handing over that client's documents. None of this logic can be trusted to the browser, because anything running there can be inspected and altered.
Servers, serverless and managed backends
A backend used to mean a server you rented and maintained. Now many sites use serverless functions that run only when called, or backend-as-a-service platforms such as Supabase and Firebase that provide a database, logins and file storage out of the box.
Does your site even have one?
A simple brochure site may have almost no backend of its own: static pages on a host, with a form service or a third-party booking widget doing the server work. You start needing a real backend once you have customer accounts, a shop with stock levels, bookings with availability, or any data you must store and protect. That is also where most of the security responsibility, and the cost, of a project sits.
Backend mistakes with real consequences
- Storing passwords in plain text. Use a proper hashing algorithm such as bcrypt or Argon2.
- Trusting data from the browser. Prices, quantities and user IDs sent by the frontend must be re-checked on the server.
- No database backups, or untested ones. Restore a backup at least once so you know it works.
- Keys inside frontend code. Secret API keys belong only on the backend.
Related terms
- Frontend: the browser side that calls the backend.
- API: the interface a backend exposes.
- Serverless: running backend code without managing servers.
- Full stack: covering backend and frontend together.