PHP 8 · SQLITE · ONE FILE · ZERO DEPENDENCIES

One PHP file.
A full admin app.

TurboCRUD is a self-hosted admin panel and no-code resource builder that lives entirely in a single index.php. Upload it, open it, and you get authentication, role-based access control, and a CRUD engine for whatever data you throw at it — no framework, no build step, no vendor folder.

Open Live Demo ↗ View Source on GitHub
MIT licensed 1 file · 8,950+ lines PHP 8.0+ · pdo_sqlite
deploy.sh
$ scp index.php you@server:/var/www/
.
├── index.php // the whole app
├── data.db // auto-created
└── uploads/ // auto-created
↓ open in a browser
TurboCRUD dashboard showing resource counts and quick links
no composer installno artisan migrateno npm run buildno docker composeno vendor folderno monthly seat pricing no composer installno artisan migrateno npm run buildno docker composeno vendor folderno monthly seat pricing
WHY TURBOCRUD

Admin panels usually cost you a whole stack. This one costs you a file.

Framework admin packages need the framework. Low-code builders need your data to leave your server. TurboCRUD needs a folder PHP can write to.

  TurboCRUD Framework admin
(Nova, Filament, Django admin…)		 Hosted low-code
(Retool, Appsmith…)
Setup Upload one file Install a framework, run migrations, register the package Create an account, connect a data source
Runtime deps None — just PHP Composer, the full app framework, often Node for the build None (it's not your runtime)
Database Self-contained SQLite file Whatever you provision (Postgres/MySQL) and manage yourself Whatever you connect — but the platform reads it
Hosting Any shared PHP host Needs an app server for the framework Only in their cloud
Your data Never leaves your server Stays on your infrastructure Passes through a third-party platform
Adding a field Click "Add Field" in the UI Write a migration, edit a resource class, redeploy Click in the UI (but you're building on their platform)
Pricing Free, MIT licensed Free or one-time license, self-hosted Per-seat monthly subscription
Table reflects typical defaults for each category — always check the specific tool you're comparing against.
FEATURES

Everything an internal tool needs. Nothing it doesn't.

A generic resource engine, real access control, and a security posture that isn't an afterthought — all editable from the app itself.

Data & Resources

  • No-code resource builder — new data types from the UI, no migrations
  • Schema changes only ever add columns; nothing is auto-renamed or dropped
  • 18 field types: text, richtext, Quill, code, relations, photo, file & more
  • Relations (one-to-one and many-to-many chip picker) with delete protection
  • Comments, tags, and shared dictionaries — all opt-in per resource
  • Bulk delete, duplicate record, sortable searchable lists

Access Control

  • Role-based access control with unlimited custom roles
  • Per-resource, per-role data scope: see everything or only your own records
  • In-app user management — users are deactivated, never hard-deleted
  • Self-service Profile — everyone manages their own name and password, no admin needed
  • Interactive first-run setup creates your admin account, no baked-in password
  • Trash is opt-in per resource, with full record snapshots before permanent delete

Security

  • Passwords hashed with bcrypt/argon via password_hash()
  • CSRF tokens on every state-changing request
  • Configurable login rate limiting and idle session timeout
  • Non-negotiable upload deny-list blocks .php/.svg/.html/.js regardless of settings
  • Auto-written .htaccess disables script execution in uploads/

Look & Feel

  • Light/dark mode, accent color, and independent sidebar/topbar colors
  • 50+ Google Fonts or the system stack, plus adjustable base font size
  • Custom app icon, favicon, and list density (comfortable/compact)
  • Personal timezone, theme override, and list page size — set once in Profile
  • Same admin, completely different skin — no code required
SEE IT RUNNING

Every screen an admin actually uses.

From the dashboard to the field editor that creates new field types on the fly — no separate design system, just the app.

Contacts list view with search and pagination
Resource list — search, sort, paginate, filter by tag
Edit Contact form showing multiple field types
Record editor — photo, tags, files and details in one view
Resource field list in the admin builder
Resource builder — every field, type, and status at a glance
Edit Field screen configuring a relation field
Field editor — configure a relation field, no code
Resources admin list with activate/deactivate controls
Resources admin — deactivate, never destroy, existing data
Shared tags manager across resources
Tags — one shared tag system across every resource
Appearance settings for theming the app
Appearance settings — this whole page's color came from here
Contacts list restyled in a dark monospace theme
Restyled: dark background, green accent, monospace font — set from Settings
Edit Company form restyled in the same dark monospace theme, showing relation_multi chip picker
Same engine: the relation_multi chip picker, in the new skin
USE CASES

Built for the tools nobody wants to build twice.

Anywhere you'd otherwise reach for a spreadsheet, a Retool subscription, or a weekend spent scaffolding a framework you don't need.

INTERNAL TOOLS

Ops dashboards

Give your team a place to manage inventory, leads, tickets, or requests — with roles so support can't see finance and vice versa.

AGENCIES

Client CRMs

Spin up a rebranded, self-hosted CRM per client in minutes. Their color, their font, their subdomain, their data — your codebase.

STARTUPS

MVP backends

Validate an idea with a real admin and real auth before you've earned the right to build a custom backend for it.

OPERATIONS

Data intake & forms

Structured intake for applications, orders, or submissions — with file uploads, validation, and a review queue built in.

EXISTING SITES

Bolt-on admin panel

Point it at its own SQLite file alongside an existing site to manage content or leads without touching your main app.

SMALL TEAMS

Spreadsheet replacement

Everything a shared spreadsheet does, plus real permissions, file attachments, relations, and an audit trail via Trash.

Deploy anywhere PHP runs
Your data stays one .db file you own
No per-seat monthly pricing
Fully rebrandable from Settings
RBAC and CSRF protection built in
MIT licensed, yours to modify

Upload it. Create your admin account. Start adding data.

The whole app is one file. The demo is one click.

Open Live Demo ↗ View Source on GitHub
index.php → your server → done