⚡Stack Radar

Infrastructure & Security · Authentication & Identity

Authentication Services

10 paid against 12 free you can run yourself.

Paid against free › Infrastructure & Security › Authentication & Identity › Authentication Services · Security and privacy on Repo Radar

Authentication services handle sign-up, sign-in and user identity for your app: social login, passkeys, multi-factor authentication and, for business customers, enterprise single sign-on and directory sync. The paid options range from developer platforms with ready UI (Clerk, Kinde, Logto Cloud) and broad identity platforms (Auth0, FusionAuth) to B2B-focused services (WorkOS, Stytch, Descope) and open-core managed services (SuperTokens, ZITADEL Cloud). On the open-source side you can self-host Keycloak, ZITADEL, Logto, SuperTokens, authentik, Ory Kratos or Hanko, build auth into your own app with Better Auth, or run a small passkey OIDC provider such as Pocket ID or Kanidm. Marks come from vendor pricing pages and project READMEs as of 19 October 2026; nothing was tested hands-on.

Paid 10 reviewed

Prices and free tiers as checked, dated on each review.

AAuth0

Auth0 is a cloud identity platform for authentication and authorization.

$35free tierCClerk

Clerk provides authentication, user management, and billing for modern applications.

$20free tierSStytch

Developer platform for authentication, authorization, and security.

free tierWWorkOS

API platform for adding enterprise features like SSO, SCIM, and audit logs.

$2500free tierKKinde

All-in-one auth, billing, and feature management for SaaS.

$25free tierDDescope

No-code CIAM platform for secure, frictionless authentication and user journeys.

$249free tierFFusionAuth

Developer-friendly CIAM platform for authentication, authorization, and user management.

free tierLLogto

Open-source auth infrastructure for developers, adding multi-tenancy, enterprise SSO, and RBAC.

$24free tierSSuperTokens

Open-source authentication provider for developers to add user login and session management.

free tierZZITADEL

Open source identity platform for developers.

$100free tier

Free 12 direct · 6 related

Free to use. You run it on your own server.

Direct alternatives

They do this job.

KEkeycloak/keycloak

Open Source Identity and Access Management For Modern Applications and Services

★ 37.4kFreeBEbetter-auth/better-auth

The most comprehensive authentication framework

★ 30.4kFreeAUgoauthentik/authentik

The authentication glue you need.

★ 26kFreeSUsupertokens/supertokens-core

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

★ 15.3kFreeZIzitadel/zitadel

ZITADEL - Identity infrastructure, simplified for you.

★ 15.3kFreeLOlogto-io/logto

An identity service that handles sign-in, accounts, roles and multi-tenant access.

★ 14.7kFreeKRory/kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

★ 13.9kFreePOpocket-id/pocket-id

A small sign-in server that lets people log in with a fingerprint or a face instead of a password.

★ 9.6kFreeHAteamhanko/hanko

Modern authentication, on your terms. Open source alternative to Auth0, Clerk, WorkOS, Stytch.

★ 9kFreeWAwarp-tech/warpgate

A guarded front door for a server, with two-factor sign-in and a recording of every session.

★ 8.1kFreeKAkanidm/kanidm

One place that holds the accounts, so every tool asks it instead of keeping its own passwords.

★ 5.5kFreeALaltcha-org/altcha

A self-hosted replacement for picture puzzles on forms, using a small computation instead.

★ 2.8kFree

Related alternatives

A second choice: they cover part of this job or are a building block for it.

CAcaddyserver/caddy

A web server that obtains and renews its HTTPS certificates by itself.

★ 78.1kFreeVAdani-garcia/vaultwarden

A password server that the official Bitwarden apps connect to, small enough to run on the cheapest machine that can be rented.

★ 69.1kFreeINInfisical/infisical

A self-hosted store for passwords, keys and certificates, with automatic rotation and short-lived access.

★ 29.8kFreeAUauthelia/authelia

One sign-in page in front of every private web service on a machine.

★ 29.3kFreeLLlldap/lldap

One small user directory that several self-hosted programs can all authenticate against.

★ 6.6kFreePOory/polis

Translates a company's own single sign-on into the ordinary modern login an application already understands.

★ 2.3kFree

Feature by feature

Every paid tool and free repository we compared, marked against the same features.

✓has itPartlysome plans or extra work—confirmed not available?not confirmed✓the vendor's claim onlypricingClick a mark for its note and source

Paid · 10Free · 10
Featurekeycloak/keycloaklogto-io/logtobetter-auth/better-authzitadel/zitadelsupertokens/supertokens-coregoauthentik/authentikory/kratoskanidm/kanidmpocket-id/pocket-idteamhanko/hanko
Starts at$35 per month (Essentials, up to 500 MAU)$20 per month billed annually (Pro)Free up to 10,000 MAU; usage-based aboveAuthKit free up to 1M active users; SSO $125 per connection$25 per month (Pro)$249 per month (Pro)Community self-hosted free; paid plans by MAU$24 per month (Pro)$0.02 per MAU, managed (free under 5,000 MAU)$100 per monthApache-2.0MPL-2.0MITAGPL-3.0Apache-2.0 for open-source partsMITApache-2.0MPL-2.0BSD-2-ClauseAGPL-3.0
Sign-in
Social loginSign in with Google, GitHub, Apple and similar providers.
PasskeysPasswordless sign-in with passkeys or WebAuthn.
Security
Multi-factor authenticationA second factor such as TOTP, SMS or passkey.
Sign-in
Magic links or passwordless emailSign in from an emailed link or one-time code.
B2B
Enterprise SSO connectionsLet business customers sign in through their own SAML or OIDC identity provider.
SCIM directory syncProvision and remove users automatically from a customer's directory.
Organizations or multi-tenancyGroup users into customer organisations or tenants.
Authorization
Role-based access controlRoles and permissions for users.
Developer experience
Pre-built sign-in UIReady-made sign-in pages or components.
Federation
Acts as an OIDC or SAML identity providerOther apps can use it as their identity provider.
LDAP or Active DirectoryConnects to or serves LDAP and Active Directory.
Authorization
Machine-to-machine or agent authCredentials for services, APIs or AI agents.
Deployment
Self-hostingRun it on your own infrastructure.
Pricing
Free tierFree use up to a user limit.
Licence
Open sourceSource published under an open licence.

Excluded candidates

Looked at, and left out of the comparison, with the reason.

Paid apps

  • FronteggFrontegg is a B2B customer identity platform with an admin portal for SaaS tenants. It overlaps WorkOS, Descope and Stytch for B2B identity and ranked below them for this comparison.Source
  • Supabase AuthSupabase Auth is sold as part of the Supabase Postgres platform rather than as a standalone authentication service, so it is compared better with backend platforms.Source
  • Firebase AuthenticationFirebase Authentication is part of Google's Firebase app platform, priced with its other services, so it is compared better with backend platforms.Source

Repositories

  • altcha-org/altchaALTCHA is a self-hosted CAPTCHA alternative that protects forms from bots. It is bot protection rather than user authentication.Source
  • warp-tech/warpgateWarpgate is a bastion that controls access to SSH, HTTPS, Kubernetes, databases and remote desktops. It is privileged access management, not sign-in for applications.Source
  • authelia/autheliaAuthelia adds single sign-on and MFA in front of self-hosted web apps through a reverse proxy. It protects existing apps rather than adding sign-in to the app you build.Source
  • casdoor/casdoorCasdoor is an open IAM platform now positioned as agent-first with an LLM MCP gateway. It overlaps Keycloak and Logto, which have larger communities.Source
  • nextauthjs/next-authAuth.js (NextAuth) is an authentication library for web frameworks. It overlaps Better Auth (G3) and has had no push since 22 July 2026.Source
  • lucia-auth/luciaLucia describes simple, clean authentication and now serves mainly as a learning resource for implementing auth yourself, rather than a maintained library to adopt.Source
  • pocketbase/pocketbasePocketBase is an open-source realtime backend in one file that includes auth. It is a backend platform, compared better with backend tools.Source
  • ory/hydraOry Hydra is an OAuth 2 and OpenID Connect server that delegates user login to another system. It covers token issuing only; Ory Kratos (G7) covers user identity.Source
  • dexidp/dexDex is an OIDC provider that federates to other identity providers, used mainly for Kubernetes. It is a federation bridge rather than full user authentication.Source
  • oauth2-proxy/oauth2-proxyoauth2-proxy is a reverse proxy that adds sign-in through Google, Azure and others in front of existing apps. Like Authelia it protects apps rather than adding auth to your own.Source
  • apereo/casApereo CAS is an identity and single sign-on server long used by universities. It overlaps Keycloak, which has a larger community and broader adoption.Source

Gaps

What the research could not settle from the vendors' own pages.

What vendors don't publish

  • Vendors count users differently (monthly active users, monthly retained users, daily active users, access tokens), so the same app can cost very different amounts and free tiers are not comparable at a glance.Auth0, Clerk, Logto, ZITADEL · checked 2026-10-19 · source 1 · source 2 · source 3 · source 4
  • Stytch's paid usage above the free 10,000 MAU appears only in a cost estimator, not as published per-user prices.Stytch · checked 2026-10-19 · source 1
  • Clerk's page says some add-ons, such as directory sync connections at $75 each, change from 1 January 2027, so current comparisons will date soon.Clerk · checked 2026-10-19 · source 1

Paid against free, in your inbox

One job at a time: the paid tools worth paying for, the free ones you can run yourself, and who should pick which.

No tracking pixels. One click to leave. We use your address to send Stack Radar and nothing else. Privacy.