Tool Directory / Authentication

Ship login without building an identity provider

Authentication is the layer where rolling your own is technically easy and practically a bad idea. Sessions, password resets, OAuth callbacks, email verification, and account linking are each simple alone and a swamp together. Here is what to use instead.

Reviewed September 2026. Back to the tool directory.

What this layer decides

The real fork is where your users live. A library stores them in your own database, so a user row can be joined to an orders table and exported whenever you like. A hosted service stores them on someone else's, which buys you a pre-built UI, compliance paperwork, and an admin dashboard, at the cost of a foreign key you cannot join across and a bill that grows with your user count.

The second consideration is migration cost. Moving off a hosted provider means exporting password hashes, which some providers make deliberately awkward. Ask that question before signing up, not at 40,000 monthly active users when the invoice changes shape.

Libraries that keep users in your database

Better Auth

1.x - the current momentum pick

A framework-agnostic TypeScript library that ships email and password, OAuth, magic links, two-factor, passkeys, and organizations as first-class features rather than plugins you assemble. The core is MIT licensed and free forever, with paid enterprise add-ons for SSO and SCIM. It went from launch in 2024 to the default recommendation for new TypeScript projects in about eighteen months, which is unusual and earned. better-auth.com

Auth.js

Maintenance mode - now maintained by Better Auth

Formerly NextAuth, and still the most widely deployed open-source auth library in the React world with dozens of OAuth providers preconfigured. Free, self-hosted, and battle-tested. The Better Auth team took over maintenance in September 2025, and the project has since been security patches rather than new features. v5 is still tagged beta after three years - the newest publish is 5.0.0-beta.32 from July 2026 - and the Auth.js docs now point new projects at Better Auth. Keep it if you are running it; do not start on it. authjs.dev

Hosted identity providers

You trade a monthly bill and a data boundary for a login screen you never have to design and compliance work you never have to do.

Clerk

Free to 50k retained users, then 25 dollars plus usage

The best drop-in auth experience available: prebuilt components that look good untouched, organizations and multi-tenancy handled, and an admin dashboard your support team can actually use. The free tier expanded to 50,000 monthly retained users in February 2026, and retained is a narrower unit than active - someone who signs up and never returns does not count. That covers most products before revenue. Past that it is a per-user bill that grows fast, so model it at your target scale first. clerk.com

Supabase Auth

Free to 50k MAU, Pro from 25 dollars

Auth that lives inside your own Postgres database, which means user rows join to your application tables and row-level security policies can reference the logged-in user directly. That integration is the whole argument. It only makes sense if you are already using Supabase for the database, though the underlying auth server - a GoTrue fork that has since diverged and is now just called Supabase Auth - is open source and self-hostable. supabase.com

Auth0

Free to 25k MAU - the enterprise option

Owned by Okta and priced for organizations with a procurement department. It handles SAML, enterprise SSO connections, custom rules, and compliance requirements nobody else bothers with. For a startup it is expensive and heavy for what you get. For an enterprise sales motion where a customer demands SAML federation next quarter, it is the safe answer. auth0.com

Three rules that apply whatever you choose

Authorization is still yours

Every tool here answers "who is this?" None of them answers "may they delete this record?" Permission logic belongs in your application and your database, and no auth provider will write it for you.

Passkeys are table stakes

Every option on this page supports WebAuthn passkeys except Auth.js, where the provider is still flagged experimental and forces you off stateless JWT sessions onto a database adapter. Offer them alongside email login rather than instead of it, and skip SMS-based two-factor entirely - SIM swapping made it the weakest second factor available.

Test the export before you need it

Run a user export in the first week and confirm you get usable password hashes, not just email addresses. That single check is the difference between a weekend migration and a forced password reset for your entire user base.

Our pick

Better Auth, unless you are trading speed for money

Use Better Auth. Users live in your Postgres database, the cost is your database bill rather than a per-user rate, passkeys and organizations are built in, and there is no migration to plan because there is nothing to migrate off. It costs you a day of setup that Clerk would have given you in an hour.

Buy that day back with Clerk when time to market genuinely dominates - a funded startup racing a competitor, or a solo founder validating an idea this weekend. Choose Supabase Auth if Supabase is already your database. Choose Auth0 only when an enterprise contract requires SAML and someone else is paying.

Keep going

Clerk vs Auth.js

Hosted convenience against owning your own user table.

Read the verdict

SaaS stack guide

Auth in context with billing, database, and multi-tenancy.

See the stack

Internal tools stack

Where SSO against an existing directory beats any of this.