Dekrypt Security

Web app, PWA, or native app: how to choose

· 5 min read

"We need an app" is a common request. Sometimes that means a native app in the App Store and Google Play. Often a web app, or a progressive web app that people can install, does the same job for less money and less maintenance.

This post compares the three options plainly so you can choose, or at least ask the right questions.

The three options

Web app

A web app runs in the browser. Users open a URL. There is nothing to install and nothing to approve: you deploy a change and everyone has it immediately. One codebase works on phones, tablets and computers.

Progressive web app (PWA)

A PWA is a web app with extra abilities. MDN describes it as an app built with web platform technologies that, like a website, runs on multiple platforms from a single codebase and, like a platform-specific app, can be installed on the device, operate while offline and in the background, and integrate with the device and other installed apps.

Two pieces make that possible:

  • A web app manifest, a small JSON file describing the app's name, icons and how it should open when installed.
  • A service worker, a script that can cache files and respond when the network is unavailable. MDN notes that service workers are only available in secure contexts, meaning the site must be served over HTTPS (with localhost allowed for development).

A minimal manifest looks like this:

{
  "name": "Example Bookings",
  "short_name": "Bookings",
  "start_url": "/",
  "display": "standalone",
  "background_color": "#0a0d12",
  "theme_color": "#0a0d12",
  "icons": [
    { "src": "/icons/icon-192.png", "sizes": "192x192", "type": "image/png" },
    { "src": "/icons/icon-512.png", "sizes": "512x512", "type": "image/png" }
  ]
}

The open-source project recall, is a PWA: it can be installed on iOS, Android and desktop from the browser, with no app store.

Native app

A native app is built for a specific platform, Android or iOS, using that platform's tools and distributed through its store. It has the fullest access to the device and the platform's look and feel. Android's application fundamentals and Apple's developer documentation describe the models each platform uses.

How they compare

Web appPWANative app
InstallNoneOptional, from the browserFrom an app store
Works offlineUsually notYes, if built for itYes
CodebasesOneOneOne per platform (or a cross-platform framework)
UpdatesInstantInstant (service worker refreshes)Through store review and user updates
Store listingNoNo (some stores allow PWAs; check each)Yes
Device featuresBrowser APIsBrowser APIsFull platform APIs
Store feesNoneNoneDeveloper account fees apply

On the last row: Apple's Developer Program lists a $99 annual membership, and Google Play's developer account registration lists a US$25 one-time fee. Those are platform fees, before any development cost.

Questions that decide it

Who are your users, and how will they find you?

If people find you through search, links or a QR code, the web wins: one tap and they are using it. If people expect to search an app store, or your competitors are all in the store, a store listing may matter.

Does it need to work offline?

Field work, travel, poor connectivity. If yes, a web app alone won't do, but a PWA often will.

Does it need device features browsers don't offer?

Browsers can do a lot: camera access, location, notifications on many platforms, file access. But some background processing, deep OS integration and certain hardware access remain native-only or behave differently by platform. List the features you need, then check each against current browser support before deciding.

How often will it change?

Web apps and PWAs update instantly. Native apps go through store review for every update, and users may not install updates promptly. If you expect to change things weekly, that matters.

What is your budget for the next two years, not just the build?

Two native apps means two codebases to maintain, two sets of OS updates to track, and two store reviews. A PWA means one.

Is "it's in the App Store" a requirement on its own?

Sometimes it is, for credibility or because a client asked. Be aware that Apple's App Review Guidelines (section 4.2, Minimum Functionality) say an app should include features, content and UI that elevate it beyond a repackaged website. Wrapping a website in an app shell may be rejected.

Security differences

All three can be built securely, and all three can be built badly. A few differences are worth knowing:

  • The server is your security boundary, always. Whatever the client is, browser or native, never trust it. Check permissions and validate input on the server.
  • Secrets in native apps are not secret. App bundles can be downloaded and unpacked. An API key compiled into an app should be treated as public. The same is true for JavaScript in a web app.
  • Updates are a security feature. Web apps get fixes to every user instantly. A native app fix waits for review and for users to update; plan for supporting older versions.
  • Data on the device. Offline-capable apps store data locally. Store only what is needed, and use the platform's secure storage for anything sensitive, such as tokens.
  • HTTPS is required for PWAs anyway, because service workers need a secure context. Use it for everything.

Recommendation

For most small businesses and first versions:

  1. Start with a web app, built mobile-first.
  2. Make it a PWA if users come back often or need offline use.
  3. Go native when there is a specific feature or distribution need the web can't meet, and you've confirmed it.

This order means you only pay for native development once you know you need it. If you start native and later find a PWA would have done, that money is hard to get back.

If you're not sure which fits your project, send it through the project brief and you get a straight answer, including "you don't need an app".

Sources