A lean MVP with one core user flow takes 4 to 8 weeks to build, a standard one with a second user role and three to five integrations takes 2 to 4 months, and a complex or regulated one takes 4 to 8 months, according to a July 2026 timeline guide from the development agency Upsilon. Those are vendor estimates, but they match what most agencies publish, and they hide the more useful point: the scope decides the timeline long before anyone writes code.
This guide splits "MVP" into six scopes, gives each a sourced timeline, and lists what stretches each, including outside gates (app store reviews, Google's OAuth checks, compliance audits) that no developer can speed up.
Why "how long" has six answers
"MVP" covers everything from a page with a payment button to a marketplace handling health data. Y Combinator's Michael Seibel gives the founder's version of the answer: you "should be able to build it fast in weeks, not months", and the way to do that is to timebox the spec. His test is to ask what happens if you want to launch in three weeks, then "cut the stuff that clearly isn't important". Basecamp's Shape Up makes the same move with what it calls an appetite: "The amount of time we want to spend on a project, as opposed to an estimate." A standard Shape Up project is six weeks for one designer and one or two programmers.
Pick the smallest scope below that answers the question your MVP exists to answer.
| Scope | What it includes | Typical timeline | Where the number comes from |
|---|---|---|---|
| 1. Validation page | A landing page, a waitlist or a payment link, no product behind it | Days to two weeks | Our planning range; Stripe Atlas lets startups take payments straight after incorporation |
| 2. Clickable prototype or no-code tool | Figma prototype or a no-code app for a handful of users | 2 to 6 weeks | Upsilon (no-code and DIY builds), 2026 |
| 3. Lean web app | One user type, sign-in, one core flow, one or two integrations | 4 to 8 weeks | Upsilon (lean tier), 2026; Shape Up six-week cycle |
| 4. Standard B2B SaaS | Second user role, teams, billing, custom UI, 3 to 5 integrations | 2 to 4 months | Upsilon (standard tier), 2026; Altar.io network average about four months |
| 5. Mobile app | Scope 3 or 4 on iOS and Android, plus store review | Scope 3 or 4 plus 3 weeks or more | Google Play testing rule and review time; Apple App Review |
| 6. Complex or regulated | Marketplace, multi-role platform, AI features or regulated data | 4 to 8 months, plus compliance time | Upsilon (complex tier), 2026; Vanta on SOC 2 |
Source: Upsilon MVP development timeline guide, July 2026 (agency estimate); Altar.io; Google Play Console Help; Apple Developer; Vanta; Stripe
Costs for the same scopes are in our MVP Development Statistics 2026 page.
Scopes 1 and 2: validate before you build
Scope 1, the validation page. A single page that asks for an email, a call or a payment, to test whether anyone wants this enough to act. Stripe says that since January 2025 Atlas startups can accept payments immediately after incorporation, without waiting for a US tax ID, which removes one old reason to delay a paid pre-order. We would plan a single validation page at days to two weeks; our full marketing-site process, with several pages and a CMS, runs four weeks.
Scope 2, the prototype or no-code tool. A clickable prototype, or a no-code app for a handful of users. Upsilon puts no-code and DIY builds at 2 to 6 weeks. The UK government's Service Manual says its alpha phase, where teams test ideas with prototypes, typically lasts about 6 to 8 weeks, and that teams should expect to discard most of the code afterwards. The rule transfers.
What stretches these two. Decisions, not code: choosing one audience and one price, and recruiting testers.
Scopes 3 and 4: the web app most founders mean
Scope 3, the lean web app. One type of user signs in and completes one core job. Upsilon gives this tier 4 to 8 weeks of development, with discovery of 1 to 3 weeks and design of 1 to 2 weeks for the core flow only. That lines up with Shape Up's six-week cycle.
Scope 4, the standard B2B SaaS. A second user role, team accounts, subscription billing, a custom interface and three to five integrations. Upsilon's worked example for this tier is about two weeks of discovery, one and a half of design, twelve of development across six sprints and one and a half of QA and deployment, which totals just under four months. Altar.io, from its own projects and those shared by its founder network, reports three months as the most common build time and about four months as the average.
Both are agency figures: the time a focused team spends when decisions arrive on time, not a promise.
| Phase | Upsilon's worked example | What usually stretches it |
|---|---|---|
| Discovery and scoping | About 2 weeks | Skipping it, which Upsilon says adds 4 to 6 weeks later |
| Design | About 1.5 weeks | Designing every screen instead of the core flow |
| Development | About 12 weeks, six sprints | Feedback arriving 3 to 7 days late each sprint |
| QA and deployment | About 1.5 weeks | Treating QA as a phase at the end instead of every sprint |
| Total | Just under 4 months |
Source: Upsilon MVP development timeline guide, July 2026; agency estimate
What stretches scopes 3 and 4. Upsilon names three things. Skipping discovery adds 4 to 6 weeks. Late feedback, repeated across a dozen sprints, adds weeks; it suggests founders set aside 2 to 3 hours a week for reviews. And a custom Stripe billing integration takes 2 to 3 weeks, where Stripe's hosted checkout and prebuilt webhook handling shrink that to 3 to 5 days.
The fourth is Google access beyond a name and email. Reading a user's Gmail, Calendar or Drive means sensitive or restricted scopes. Google says sensitive scope verification "typically takes 3-5 business days", and brand verification, if your branding changed, typically 2 to 3 business days. Restricted scope verification "can potentially take several weeks", and the app must then complete a security assessment at least every 12 months. An MVP that only needs "Sign in with Google" for identity avoids the scope reviews.
Scope 5: mobile adds gates you do not control
A mobile MVP is scope 3 or 4 plus two review processes between "finished" and "live".
Google Play. Google requires personal developer accounts created after 13 November 2023 to run a closed test with "a minimum of 12 testers who have been opted in continuously for at least 14 days" before applying for production access. That review "usually takes seven days or less, but can occasionally take longer." On a new personal account, that is three weeks before the public can install the app.
Apple. Apple says App Review "works around the clock, typically reviewing at least 50% of submissions in less than 24 hours and 90% in less than 48 hours." Rejection is the bigger risk. Guideline 4.2 asks for features, content and interface that make an app more than "a repackaged website", so a thin wrapper around a web app is at risk. If the app supports account creation, it must also let users delete their account inside the app. If it offers a third-party login such as Google Sign-In for the primary account, guideline 4.8 requires an equivalent privacy-focused login option as well. Each must be in scope before submission.
What stretches scope 5. A rejection cycle, and a Play test that starts late because nobody recruited testers. We would usually recommend a responsive web app first, unless the core job needs the phone's camera, location or background notifications.
Scope 6: complex, regulated and marketplace MVPs
Upsilon puts complex MVPs, which it defines as multi-role platforms, AI features or regulated data such as HIPAA or PCI-DSS, at 4 to 8 months.
| Gate | Who sets it | Published timing |
|---|---|---|
| Google Play production access, new personal account | 12 testers for 14 days, then review usually 7 days or less | |
| App Store review | Apple | At least 50% within 24 hours, 90% within 48 hours |
| Google sensitive scope verification | Typically 3 to 5 business days | |
| Google restricted scope verification | Potentially several weeks, plus a security assessment every 12 months | |
| SOC 2 Type I report | Your auditor | Five weeks to two months (vendor estimate) |
| SOC 2 Type II report | Your auditor | Observation window of three months to a year, then the audit |
| HIPAA hosting | Your database and hosting providers | A signed business associate agreement before any patient data goes in |
Sources: Google Play Console Help; Apple Developer; Google for Developers, updated August 2026; Vanta; Supabase
SOC 2. Enterprise buyers often ask for a SOC 2 report before signing. Vanta, which sells compliance software, says a Type I audit takes between five weeks and two months in most cases, and that a Type II observation window runs from three months to a year, followed by an audit of 2 to 5 weeks and 2 to 6 weeks to produce the report. If your first customer needs a Type II, start the controls during the build.
Health data. Supabase's HIPAA page says customers "must sign a BAA with Supabase" and configure their projects to its security advisor's guidance, with connection logging kept on. Every provider touching patient data needs one, which rules out building on free tiers and moving later.
Marketplaces and AI. A marketplace is two MVPs plus payouts. An AI feature adds evaluation time. Neither has a published gate, so we would budget them as scope inside the 4 to 8 months.
How to shorten any of the six
Pick the scope from the question. Demand: scope 1 or 2. Retention: scope 3. Go further only when the answer depends on teams, billing or integrations.
Fix the time, flex the scope. Write the appetite first and let features fall out of it; our MVP Spec Template covers this.
Start external gates on day one. Open the Google Play developer account, submit the Google verification, sign the BAAs and start SOC 2 controls in week one, so they finish in parallel with the build.
Use bought parts for solved problems. Hosted checkout instead of custom billing, a managed sign-in provider instead of hand-built password flows.
Keep the founder's review time fixed. Two or three hours a week beats any extra developer.
Speed after launch is the real test. Stripe reports that among Atlas startups taking payments in their first three months of 2025, the median time to first payment was 34 days, and 20% landed a first customer within 30 days, up from 8% in 2020.
What this means for planning your MVP timeline
Pick the smallest scope that answers your question and add its external gates before agreeing a launch date. For a lean web app, plan 4 to 8 weeks of build plus discovery; for a standard B2B SaaS, plan around four months; for mobile, add at least three weeks of store time on a new Google account; for regulated data, start compliance in week one. We build applications in Next.js and we quote per project after a scoping call, which often ends with a recommendation to start one scope smaller. Our web app development service page explains how we scope it.
