Drag the slider below from your laptop out to a real web address.
Drag from "works on my laptop" to "a real product"
localhost:3000
- Who can open it
- Only you, on your machine
- Where it runs
- Your laptop
- Rough cost
- $0
What this stage adds: The app runs, but only where the code is. Close the laptop and it's gone.
Watch out: Nothing is exposed — and nothing is shareable.
Each stop is a bigger promise. Deploying is moving your app off your machine onto one that's always on, at an address anyone can reach.
On your laptop, the app runs on "localhost": only you can see it. Deploying is the act of putting it somewhere always on, so a link works for anyone, even when your laptop is shut.
Where your app runs, step by step
Localhost (your laptop)
- Runs on
- Your machine
- Who can see it
- Only you
Preview link
- Runs on
- The host's server, temporary
- Who can see it
- Anyone with the link
Production
- Runs on
- The host's server, permanent
- Who can see it
- Anyone, at a stable URL
Most hosts give you a throwaway link first. Cloudflare's docs: "Preview deployments allow you to preview new versions of your project without deploying it to production," and "every time you open a new pull request on your GitHub repository, Cloudflare Pages will create a unique preview URL."
The moment that matters is production. That's when real people can arrive, so anything you got away with in private stops being private: secrets placed in the frontend are now public (see API keys in the browser), and your access rules must already be right (see Row Level Security).
We speak from doing it: this very site is a vibe-coded project we deployed to Cloudflare, and production was the line where auth, access rules and secrets had to already be right, not a thing to fix later.
So "is it deployed?" really means "is it live for strangers, at an address that survives a redeploy?" A preview link is for showing a friend; production is a front door.
Try it with the rules off. In the sandbox, slide from localhost to production, then back. Notice how far along the line "anyone can see it" switches on, and what the panel says becomes risky at each stop.
Check yourself
0/3 got itSaved on this device only. No account, no streaks.
Next in making it real: Domains and HTTPS.




