Firebase Realtime Database: Complete Guide (Intro, Limits, Read/Write, Best Practices)

import { ref, set, update } from "firebase/database";
set(ref(db, "users/u1"), {
  name: "John",
  age: 25
});

import { ref, push, set } from "firebase/database";

const postListRef = ref(db, 'posts');
const newPostRef = push(postListRef);
const postId = newPostRef.key; // Get unique Key from ref Generated

set(newPostRef, {
  title: "My First Post",
  author: "User123",
  id: postId 
});

import { ref, set, update } from "firebase/database";
update(ref(db, "users/u1"), {
  age: 26
});

import { ref, child, push, update } from "firebase/database";

// Get a key for a new Post.
const postData = {author: username, uid: uid, body: body, title: title};
const newPostKey = push(child(ref(db), 'posts')).key;

// create updates Objects with key[path] value[data]
const updates = {};
updates['/posts/' + newPostKey] = postData;
updates['/user-posts/' + uid + '/' + newPostKey] = postData;

// if failed, it will all failed  & if success it will all success
update(ref(db, "users/u1"), updates);

import { ref, onValue, get } from "firebase/database";
const snapshot = await get(ref(db, "users/u1"));
console.log(snapshot.val());

import { ref, onValue, get } from "firebase/database";
onValue(ref(db, "users/u1"), (snapshot) => {
  console.log(snapshot.val());
});

import { ref, onValue, get } from "firebase/database";
onValue(ref(db, "users/u1"), (snapshot) => {
  console.log(snapshot.val());
});

// modern sdk v9+ : 
// 1. Start the listener and save the "Unsubscribe" function
const unsubscribe = onValue(ref(db, 'users/u1'), (snapshot) => {
  console.log(snapshot.val());
});
// 2. When you want to stop (e.g., user leaves the page)
unsubscribe();

import { ref, onValue, get } from "firebase/database";
onValue(ref(db, "users/u1/username"), (snapshot) => {
  console.log(snapshot.val());
},  {
  onlyOnce: true
});

import { ref, remove } from "firebase/database";
const = ref(db, "users/u1") 
remove(userRef);

import { ref, set } from "firebase/database";
// This is 100% identical to calling remove(ref(db, 'users/u1'))
set(ref(db, 'users/u1'), null);

import { ref, update } from "firebase/database";
const userRef = ref(db, 'users/u1');
update(userRef, {
  bio: null,      // This field is deleted
  website: null,  // This field is deleted
  lastActive: 1708862400 // This field is UPDATED or CREATED
});

import { ref, update } from "firebase/database";
const userRef = ref(db, 'users/u1');
const updates = {};
updates['/users/u1/settings'] = null; // Delete u1's settings
updates['/posts/post123'] = null;     // Delete a specific post
updates['/logs/lastDelete'] = "User u1 deleted a post"; // Add a log

update(ref(db), updates);

import { ref, set, update } from "firebase/database";
set(ref(db, "users/u1"), {
  name: "John",
  age: 25
})
.then(()=>{
  console.warn("write success")
})
.catch((error)=>{
  console.warn("write error", error)
});

import { ref, runTransaction } from "firebase/database";

const counterRef = ref(db, "posts/post1/likes");

runTransaction(counterRef, (currentValue) => {
  if (currentValue === null) {
    return 1;
  }
  return currentValue + 1;
});

import { ref, update, increment } from "firebase/database";

update(ref(db, "posts/post1"), {
  likes: increment(1)
});

import { ref, onChildAdded } from "firebase/database";

const postsRef = ref(db, "posts");

onChildAdded(postsRef, (snapshot) => {
  console.log("New post added:", snapshot.val());
});

import { ref, onChildChanged } from "firebase/database";

const postsRef = ref(db, "posts");

onChildChanged(postsRef, (snapshot) => {
  console.log("Post updated:", snapshot.val());
});

import { ref, onChildRemoved } from "firebase/database";

const postsRef = ref(db, "posts");

onChildRemoved(postsRef, (snapshot) => {
  console.log("Post deleted:", snapshot.val());
});

import { ref, onChildMoved } from "firebase/database";

const postsRef = ref(db, "posts");

onChildMoved(postsRef, (snapshot) => {
  console.log("Post moved:", snapshot.key);
});

Sorting and Filtering Data in Firebase Realtime Database

Firebase Realtime Database allows you to sort and filter data using query methods. This helps you read only the data you need, which improves performance and reduces bandwidth usage.

Sorting Data

Sorting is used when you want data in a specific order. Firebase provides three main sorting methods.

1. orderByChild()

Sort data based on a specific child property. This is commonly used for posts, timestamps, prices, or status fields.

import { ref, query, orderByChild } from "firebase/database";

const postsQuery = query(
  ref(db, "posts"),
  orderByChild("createdAt")
);

2. orderByKey()

Sort data based on the unique key.

import { ref, query, orderByKey } from "firebase/database";

const usersQuery = query(
  ref(db, "users"),
  orderByKey()
);

3. orderByValue()

Sort data based on the stored value. This is useful when storing simple key-value pairs.

import { ref, query, orderByValue } from "firebase/database";

const scoresQuery = query(
  ref(db, "scores"),
  orderByValue()
);

Filtering Data

Filtering helps you get specific results instead of the full dataset.

1. limitToFirst()

Get the first number of records.

import { ref, query, limitToFirst } from "firebase/database";

query(ref(db, "posts"), limitToFirst(5));

2. limitToLast()

Get the last number of records.

import { ref, query, limitToLast } from "firebase/database";

query(ref(db, "posts"), limitToLast(5));

3. equalTo()

Get records that exactly match a specific value.

import { ref, query, orderByChild, equalTo } from "firebase/database";

query(
  ref(db, "posts"),
  orderByChild("status"),
  equalTo("published")
);

4. startAt()

Get records starting from a specific value.

import { ref, query, orderByChild, startAt } from "firebase/database";

query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  startAt(1700000000000)
);

5. endAt()

Get records ending at a specific value.

import { ref, query, orderByChild, endAt } from "firebase/database";

query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  endAt(1700000000000)
);

6. startAfter()

Get records that come after a specific value. This is commonly used for pagination.

import { ref, query, orderByChild, startAfter } from "firebase/database";

query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  startAfter(1700000000000)
);

7. endBefore()

Get records before a specific value.

import { ref, query, orderByChild, endBefore } from "firebase/database";

query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  endBefore(1700000000000)
);

Cursor Pagination Example

Cursor pagination is better than page numbers in Firebase. Instead of using page 1, page 2, you use the last item value as a cursor.

Step 1: Get first 5 posts.

const firstPageQuery = query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  limitToFirst(5)
);

Step 2: Save the last item's createdAt value.

Step 3: Get next 5 posts using startAfter().

const nextPageQuery = query(
  ref(db, "posts"),
  orderByChild("createdAt"),
  startAfter(lastCreatedAt),
  limitToFirst(5)
);

This method is efficient and scalable for large datasets.

Realtime Database Listener

Listeners allow applications to respond instantly when data changes. Always remove unused listeners to avoid memory leaks.

Firebase Realtime Database Security Rules

Firebase Security Rules protect your Firebase Realtime Database by controlling who can read and write data. Without proper rules, anyone could access or modify your database. Security Rules ensure that only authorized users can perform specific actions.

These rules run on the Firebase server and are automatically enforced for every read and write request.

1. Basic Authentication Rule

The simplest rule is to allow only authenticated users to read and write data.

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

This means only logged-in users can access the database.

2. User-Based Access Control

Often, users should only access their own data. You can restrict access using their unique user ID (uid).

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid === $uid",
        ".write": "auth != null && auth.uid === $uid"
      }
    }
  }
}

This ensures users can only read and write their own data.

3. Role-Based Access Control

You can create roles like admin or editor and restrict access based on roles.

{
  "rules": {
    "posts": {
      ".write": "root.child('roles').child(auth.uid).val() === 'admin'"
    }
  }
}

In this example, only users with the admin role can modify posts.

4. Data Validation Rules

Security Rules can validate data before it is written to the database. This prevents invalid or malicious data from being stored.

{
  "rules": {
    "posts": {
      "$postId": {
        ".validate": "newData.hasChildren(['title', 'createdAt'])"
      }
    }
  }
}

This ensures that every post must contain both a title and createdAt field.

5. Field-Level Validation

{
  "rules": {
    "users": {
      "$uid": {
        "age": {
          ".validate": "newData.isNumber() && newData.val() >= 13"
        }
      }
    }
  }
}

This rule ensures age must be a number and at least 13.

6. Read-Only Data

You can make certain data publicly readable but not writable.

{
  "rules": {
    "publicPosts": {
      ".read": true,
      ".write": "auth != null"
    }
  }
}

7. Indexing for Better Query Performance

When you query using orderByChild(), you should define indexes in your Security Rules for better performance.

{
  "rules": {
    "posts": {
      ".indexOn": ["createdAt", "status"]
    }
  }
}

Without indexing, large queries may fail or become slow.

Best Practices for Firebase Security Rules

• Never leave your database fully open in production.
• Always require authentication for sensitive data.
• Restrict users to access only their own records.
• Use validation rules to prevent invalid data.
• Use indexing for frequently queried fields.
• Test rules using the Firebase Emulator before deploying.

Properly configured Firebase Security Rules are essential for building secure, scalable, and production-ready applications.

Client Connect and Disconnect Functionalities

Firebase Realtime Database provides built-in features to detect when a user connects or disconnects from your application. This is very useful for online status systems, chat apps, multiplayer games, and live dashboards.

Using special paths like .info/connected and the onDisconnect() method, you can manage user presence automatically in real time.

Client Connect - Online Status

Firebase Realtime Database provides a special path called.info/connected. It returns true when the client is connected to the Firebase server and false when the client is disconnected.

This feature is mainly used to mark a user as online when they successfully connect to the database.

import { ref, onValue } from "firebase/database";

const connectedRef = ref(db, ".info/connected");

onValue(connectedRef, (snapshot) => {
  if (snapshot.val() === true) {
    console.log("User is connected. Mark user as online.");
  }
});

This helps you detect real-time connection changes instantly and is commonly used in chat apps and live presence systems.

Client Disconnect - Offline Status

The onDisconnect() method allows you to register an action that will automatically run when the client disconnects from the Firebase server.

It is mainly used to mark a user as offline in the database. The important thing to understand is that onDisconnect() runs on the Firebase server, not on the client device.

This means even if the user closes the browser, loses internet, or the app crashes, the server will still execute the registered operation.

import { ref, onDisconnect, serverTimestamp } from "firebase/database";
const userStatusRef = ref(db, "status/u1");
onDisconnect(userStatusRef).set({
  state: "offline",
  lastChanged: serverTimestamp()
});

Because the operation runs on the Firebase server, it is reliable and safe for building real-time presence systems without needing a separate backend server.

Real Life Example

In real-time applications like chat apps, messaging systems, or multiplayer games, it is important to track whether a user is online or offline. Firebase Realtime Database provides a reliable way to manage user presence across multiple devices or browser tabs.

In this example, each device connection is stored separately insideusers/{uid}/connections. If at least one active connection exists, the user is considered online. If all connections are removed, the user is marked offline.

The .info/connected path detects when the client connects to the Firebase server. The onDisconnect() method registers actions that automatically run on the server when the user disconnects, even if the app closes or the internet connection is lost.

import { getDatabase,  ref,  onValue,  push,  onDisconnect,  set,  serverTimestamp } from "firebase/database";

import { getAuth } from "firebase/auth";

const db = getDatabase();
const auth = getAuth();

auth.onAuthStateChanged((user) => {
  if (!user) return;
  const uid = user.uid;

  // Path to store active connections
  const connectionsRef = ref(db, "users/" + uid + "/connections");

  // Path to store last seen timestamp
  const lastOnlineRef = ref(db, "users/" + uid + "/lastOnline");

  // Special Firebase path to detect connection state
  const connectedRef = ref(db, ".info/connected");

  onValue(connectedRef, (snapshot) => {
    if (snapshot.val() === true) {

      // Create a new connection for this device/tab
      const newConnectionRef = push(connectionsRef);

      // Mark this device as connected
      set(newConnectionRef, {
        connectedAt: serverTimestamp()
      });

      // When this device disconnects, remove only its connection
      onDisconnect(newConnectionRef).remove();

      // When ALL devices disconnect, update lastOnline
      onDisconnect(lastOnlineRef).set(serverTimestamp());
    }
  });
});

This approach ensures accurate real-time presence tracking and works safely when a user is logged in from multiple devices at the same time.

Realtime Database Limitation

Firebase Realtime Database has technical limits to keep the system stable and fast. If your application grows large, these limits become important. Below are the most important limits explained in simple words with examples.

1. Maximum Data Depth (32 Levels)

Your data structure cannot be deeper than 32 nested levels. Deep nesting also makes reads slower and increases bandwidth usage.

{
  "level1": {
    "level2": {
      "level3": {
        "... too deeply nested ..."
      }
    }
  }
}

Solution: Keep your data flat and avoid deep nesting.

2. Maximum String Size (10 MB)

A single string value cannot be larger than 10 MB. This usually happens when developers store images or large text as strings.

set(ref(db, "profile/u1"), {
  image: "very_long_base64_string_here..."
});

Solution: Store images or large files in Firebase Storage and save only the file URL in the database.

3. Maximum Read Size (256 MB)

A single read request cannot return more than 256 MB of data. Reading very large collections at once may fail or increase cost.

// Bad: reading entire large collection
get(ref(db, "allUsers"));

Better way: Use pagination.

import { query, limitToFirst } from "firebase/database";

query(
  ref(db, "allUsers"),
  limitToFirst(50)
);

4. Write Rate (~1,000 Writes Per Second)

A single database supports around 1,000 writes per second (soft limit). If you continuously exceed this, Firebase may slow down your writes.

// Bad: heavy writes to same location
for (let i = 0; i < 5000; i++) {
  set(ref(db, "counter"), i);
}

Solution: Distribute writes across different paths or use multiple database instances in the Blaze plan.

5. Maximum Write Size

When using the SDK, a single write request cannot exceed 16 MB. Using the REST API, the limit is 256 MB.

// Large object write
set(ref(db, "bigData"), veryLargeObject);

Solution: Split large data into smaller parts and avoid uploading huge JSON objects at once.

Realtime Database Limits Table Overview