Retool: The Rise of Low-Code for Internal Tools

Retool is a developer-focused low-code platform founded in 2017 by David Hsu to speed up building internal business tools. By mapping drag-and-drop React components to SQL and API queries, it reached a $3.2 billion valuation and an estimated $120 million in annual recurring revenue by late 2025.

Table of Contents:

1. Key Takeaways
2. Introduction
3. What Problem Was Retool Built to Solve?
4. Why Did Retool Target Developers, Not Citizen Developers?
5. How Did Retool Reach a $3.2 Billion Valuation?
6. What Did Retool's 2023 Security Breach Reveal?
7. How Is AI Reshaping Retool's Low-Code Platform?
8. Honest Tradeoffs
9. FAQ

---

Key Takeaways

• Retool's founder walked away from a payments startup after spotting where engineering time quietly vanishes, and that single observation became a $3.2 billion thesis.
• The platform's contrarian bet against "citizen developers" looks obvious now, but in 2017 nearly every mentor told David Hsu it was backwards.
• One phishing text in August 2023 exposed the real cost of centralized cloud admin, and the fallout reached a customer's wallet, not just Retool's reputation.

---

Introduction

Ask any in-house engineering team at a scaling startup where the week went, and a surprising chunk of the answer is admin panels nobody outside the company will ever see. David Hsu noticed exactly that in 2017: his engineers were spending up to half their hours building tables, forms, and dashboards for internal operations.

That frustration became Retool, the low-code development platform that turned repetitive internal software into a visual assembly job. This piece traces how Retool grew from a scrapped payments startup into a category leader, and what its wins, its breach, and its pricing fights teach the teams weighing it today.

---

What Problem Was Retool Built to Solve?

Retool was built to kill the repetitive code behind internal business tools. In early 2017, founder David Hsu watched his peer-to-peer payments startup Cashew burn roughly $1,000 a day while his engineers spent up to half their time building admin panels for tasks like KYC checks and fraud review. He decided the drudgery, not the payments product, was the real opportunity.

What caught his eye was how identical those internal apps were. According to First Round Review's account of the company, every operational tool came down to the same handful of interface parts wired to a different database:

• Tables to display database rows
• Forms to capture and edit records
• Dropdowns to filter data
• Buttons to trigger API calls

So Hsu built a drag-and-drop prototype that mapped those components straight to SQL and API queries. In the final weeks of Y Combinator's Winter 2017 batch, he abandoned Cashew entirely, and at Demo Day the team presented Retool alongside a $1.5 million enterprise pilot they had already signed. His framing, shared later in a 2022 Sequoia Capital spotlight, was blunt:

The way people were building software was ridiculously inefficient. There's no need for everybody to be constantly writing all this boilerplate code.

The product never tried to hide the code. It assumed engineers wanted less of the boring kind.

---

Why Did Retool Target Developers, Not Citizen Developers?

Most 2017 low-code bets chased non-technical "citizen developers." Retool went the other way, building for professional engineers who could write SQL and JavaScript but hated assembling front ends by hand. Mentors called the choice backwards. The wager was that developers wanted leverage, not a no-code cage, and that wager defined the company.

This is where the low-code development platform split from the rest of the movement. Unlike the wave of no-code builders aimed at bypassing IT, Retool kept engineers in the loop:

• No-code platforms: built for non-technical users, often bypassing IT and accumulating quiet technical debt
• Retool: built for engineers, embedding raw SQL and JavaScript, keeping security and governance with the people who own the data

The bet rested on an unglamorous truth: internal tools are a huge, neglected category, by some estimates more than half of all software ever written [unverified]. Off-the-shelf SaaS solves the average case, which rarely matches a company's actual workflow. The positioning clicked once the pitch shifted from an abstract "Excel with higher-order primitives" to a plain promise of building internal tools faster, a cold email that reportedly earned an instant reply from the CTO of delivery giant Rappi. According to First Round Review, Retool then delayed its public Hacker News launch until it had quietly reached about 40 paying customers and $2 million in annual recurring revenue.

Retool's insight was that handing engineers a faster path beats handing non-engineers a slower one.

If you want the cleaner definition, here is what separates low-code from no-code in practice.

---

How Did Retool Reach a $3.2 Billion Valuation?

Retool reached a $3.2 billion valuation in July 2022 through capital-efficient, product-led growth rather than heavy spending. According to Sacra, annual recurring revenue crossed $90 million by the end of 2024 and roughly $120 million by late 2025, while founder David Hsu used a reported $200 million buyback and secondary sales to consolidate majority control.

The funding ladder was deliberately slow on dilution. Per PitchBook, Retool raised a $1 million seed in September 2017, a $25 million Series A led by Sequoia Capital in April 2019, a $50 million Series B in October 2020 at a $925 million valuation, and a two-part Series C that closed at the $3.2 billion mark. Trackers disagree on the total: PitchBook and Forge Global cite around $141 million, while Tracxn reports closer to $165 million. Tracxn also puts headcount between roughly 415 and 471 people.

What set the trajectory apart was focus. Rather than fight for the crowded citizen-developer market, Retool captured professional engineering spend, where saving developer hours easily justifies the bill.

Retool sits at the intersection of two major trends: the rise of the developer and the increasing importance of operational excellence.

That line came from Sequoia's Bryan Schreier. Here is how Retool stacks up against the field:

---

What Did Retool's 2023 Security Breach Reveal?

In late August 2023, attackers used a phishing text, an AI voice deepfake, and a Google Authenticator cloud-sync flaw to breach Retool's internal admin systems. According to the Cloud Security Alliance, they took over 27 cryptocurrency customer accounts, which enabled a $15 million theft from customer Fortress Trust. The lesson pointed at centralized cloud admin, not Retool's code alone.

The attack chain reads like a checklist of modern social engineering:

• A phishing SMS posing as an internal payroll portal, timed to a real Okta login migration
• An AI-generated voice call impersonating a known IT staffer, accurate enough about the office floor plan to extract a one-time code
• Google Authenticator's April 2023 cloud-sync feature, which exposed every MFA token at once with no admin control to disable it
• Corporate VPN access, 27 account takeovers, and the downstream $15 million crypto theft

I find the Google detail the most uncomfortable part. A convenience feature shipped by a trusted vendor quietly turned two-factor login into one factor, and the security team had no switch to flip. Retool's disclosure drew criticism for relying on centralized admin access and skipping hardware security keys, but the deeper warning applies to any team trusting cloud-synced secrets it does not directly control.

---

How Is AI Reshaping Retool's Low-Code Platform?

Retool has rebuilt its low-code development platform around AI. It launched Retool AppGen in April 2025 and Retool Agents in May 2025, which together automated over 100 million production work hours by October 2025, according to Retool. The 4.0 release on June 17, 2026 moved self-hosting toward Kubernetes and Google's gVisor sandbox to support AI-native, governed code generation.

The mechanics aim squarely at the gap between prototyping and shipping:

• AppGen turns natural-language prompts into full-stack interfaces, SQL, and API wiring against live, authorized schemas
• Agents and workflows run with caps: 20 free agent hours and 5,000 workflow runs per month on Team and Business tiers
• Overages bill at $75 per extra 5,000 runs, layered on consumption-based AI credit packs
• Nokod Security and Kanopy Security scan AI-generated logic before it goes live

Hsu's stance is bullish but pointed, and it doubles as the company's pitch against pure vibe coding.

The bar to prototype has dropped to zero. The bar to ship hasn't moved. That gap is where real value gets lost.

Honestly, that framing is the whole strategy. As AI lowers the cost of generating code, Retool is betting its runtime, where permissions, databases, and security policies are pre-approved, becomes more valuable, not less. Whether that governance layer holds as raw AI agents improve is the open question for the next few years.

---

Honest Tradeoffs

The most repeated complaint is the "SSO tax." Retool gates single sign-on (SAML and OIDC) behind its custom-priced Enterprise tier, which many evaluators see as penalizing basic security hygiene. Standard pricing reflects the squeeze: per Retool's published rates, the Team plan runs about $10 per standard user and $5 per end user monthly when billed annually, and Business jumps to $50 and $15, before any SSO requirement forces an Enterprise contract.

Lock-in is the second sore spot. Historically, apps built in Retool could not be exported as plain React or JavaScript, so leaving meant rebuilding from scratch. The newer app builder generating editable React code softens this, but the proprietary runtime dependency still gives some teams pause.

Self-hosting is powerful and demanding. The Retool 4.0 migration to external Temporal and gVisor can trigger a background permissions migration that takes 3 to 15 hours, plus an ASCII-only encryption-key requirement that breaks legacy keys. That is real DevOps time.

And it is genuinely not for everyone. If you expect a fully no-code experience, need pixel-perfect consumer-facing design, or plan to deploy to hundreds of low-engagement users, the per-user math and the SQL expectation will work against you.

---

Start exploring launch-ready no-code templates here!

---

FAQ

What is a low-code development platform? A low-code development platform lets people build working software using visual components and configuration while still allowing custom code. It speeds up development by replacing repetitive boilerplate with prebuilt building blocks, and Retool is a developer-focused example aimed at internal business tools.

Is Retool free to use? Retool offers a limited free tier, but paid plans start at around $10 per standard user monthly on Team and $50 on Business when billed annually, according to Retool's pricing. Single sign-on and several self-hosting options sit behind the custom Enterprise tier.

Is Retool no-code or low-code? Retool is low-code, not no-code. It gives a drag-and-drop canvas of React-based components but expects users to write SQL and JavaScript for real logic. That is exactly why it targets professional engineers rather than non-technical citizen developers.

What companies use Retool? Retool serves thousands of corporate customers, from fast-growing technology firms like Plaid and DoorDash to legacy Fortune 500 organizations. It is most popular with engineering and platform operations teams that need to build internal tools quickly across many data sources.

Who owns Retool? Founder and CEO David Hsu retains majority voting control after a reported $200 million buyback and secondary share purchases. Retool's board is small and concentrated, chaired by Hsu alongside Bryan Schreier of Sequoia Capital, keeping product and engineering priorities ahead of sales pressure.