Comprehensive comparison of 20+ auth free tiers in 2026. Compare Auth0, Clerk, Supabase Auth, Firebase Auth, PropelAuth, Kinde, Keycloak, Authentik, Authelia, Appwrite, and more — MAU/MRU limits, overage costs, MFA, SSO, agentic AI support, and growth pricing.
Published 2026-04-03 · Reviewed 2026-10-01 · Figures compiled 2026-04-03, last checked 2026-10-01 · 20+ auth services compared
Quick verdict: Auth0's free plan covers 25,000 monthly active users (MAU). Clerk's free Hobby plan covers 50,000 monthly retained users (MRU) per application. Supabase's Free plan covers 50,000 MAU. Firebase Authentication without Identity Platform has no MAU cap. Identity Platform is free up to 50,000 MAU (3,000 daily active users on the no-cost Spark plan). WorkOS User Management is free for up to 1 million MAU. Stytch's free tier covers 10,000 MAU. Amazon Cognito's free tier is 10,000 MAU per AWS account or organization on the Lite and Essentials tiers; on Lite, user pools created on or before 22 November 2024 keep 50,000.
Growth costs: At 100,000 users: Clerk costs $1,025 a month; Supabase costs $25 a month; Appwrite costs $25 a month; WorkOS costs $0; Firebase Authentication without Identity Platform costs $0; Kinde costs $1,533.85 a month on its Plus plan; PropelAuth costs $4,650 a month on its Growth plan; Stytch's rate gives $18,000 a month before any volume discount it does not publish. On its B2C Essentials plan, Auth0 charges $2,100 a month for 30,000 MAU and publishes no price above that. The free editions of the self-hosted servers charge no licence fee per user.
Side-by-side comparison of 18 auth services.
| Service | Free Limit | Overage / User | Social Login | MFA | SSO/SAML | M2M / Agents | Self-Hosted? |
|---|---|---|---|---|---|---|---|
| Auth0 Source ↗ | 25K MAU | None: a paid plan sized to all users | Unlimited social | Not listed on Free | 1 enterprise connection + SCIM | 1,000 M2M tokens/mo; Token Vault (2 apps) | No |
| Clerk Source ↗ | 50K MRU | $0.02/MRU | Up to 3 (Hobby) | Pro plan ($25/mo) | Pro plan ($25/mo) | 2,500 token creations/mo | No |
| Kinde Source ↗ | 10.5K MAU | $0.0175 (Pro, $25/mo) | Unlimited social | Included | 1 enterprise SSO connection | 2,000 tokens | No |
| PropelAuth Source ↗ | 10K MAU | $0.05 (Growth, $150/mo) | Google, GitHub, etc. | Included | Growth plan | — | No |
| Stytch Source ↗ | 10K MAU | $0.20 | OAuth providers | Included | 5 SSO or SCIM connections (B2B), then $125/mo each | 1,000 M2M | No |
| Descope Source ↗ | 7.5K MAU | None on Free; $0.05 on Pro and Growth | 6+ providers | Included | 3 connections, 10 active tenants | 10,000 exchanges | No |
| WorkOS 1M FREE Source ↗ | 1M MAU | $2,500/mo per extra 1M | Social free; SSO $125/connection/mo | Included | SSO paid add-on | M2M apps (price not listed) | No |
| Supabase Auth Source ↗ | 50K MAU | $0.00325 above 100K (Pro, $25/mo) | 19 + custom OAuth/OIDC | TOTP (phone MFA paid, Pro) | SAML on Pro (50 SSO MAU, then $0.015) | — | Yes (Docker) |
| Firebase Auth Source ↗ | No cost; SMS on Blaze only | $0.0055 (Identity Platform, 50K-100K MAU) | Google, Apple, etc. | SMS + TOTP (Identity Platform) | Identity Platform | — | BaaS-integrated |
| AWS Cognito | 10K MAU (50K for Lite pools created by Nov 22, 2024) Source ↗ | $0.0055 Lite / $0.015 Essentials | Social, SAML, OIDC | SMS + TOTP | 50 federated MAU free, then $0.015 | Paid add-on ($0.00225/token request) | AWS-only |
| Appwrite Auth CHANGED JUN 29 Source ↗ | 75K MAU | $3 per 1,000 above 200K (Pro, $25/mo) | 30+ providers | Email, phone, TOTP (no phone on Cloud Free) | — | — | Yes (Docker) |
| Keycloak Unconfirmed | Unlimited | $0 (self-hosted) | Any OIDC/SAML | TOTP + WebAuthn | Full SAML/OIDC | Unlimited | Yes (Java) |
| Authentik Source ↗ | Unlimited | $0 (self-hosted) | Any OIDC/SAML | TOTP + WebAuthn + Duo | Full SAML/OIDC | Unlimited | Yes (Python/Django) |
| Authelia No record | Unlimited | $0 (self-hosted) | None | TOTP + WebAuthn + Duo | OIDC provider | Client credentials | Yes (Go) |
| FusionAuth Source ↗ | Unlimited | $0 (Community) | Any OIDC/SAML | TOTP | SAML + OIDC | Starter plan and up | Yes (Docker) |
| SuperTokens Source ↗ | 5K (managed) | $0.02 (managed) | Social + passwordless | Paid ($0.01/MAU managed, $0.02 self-hosted; $100/mo min) | Multi-tenancy (paid) | Paid add-on (managed service only) | Yes (open-source features free) |
| Hanko Source ↗ | 10K (cloud) | $0.01 above 10K (Pro, $29/mo) | Passkeys + social | TOTP, security keys | SAML on Pro ($49/mo per connection) | — | Yes (unlimited) |
| Ory Source ↗ | Self-hosted; cloud Developer plan has no production use | $0.14/aDAU (Production, $70/mo or $770/yr) | OIDC + social | TOTP + WebAuthn | Full OIDC | Self-hosted Hydra; billed on Ory Network | Yes (unlimited) |
Fully hosted authentication with drop-in SDKs, pre-built UI components, and managed infrastructure. Zero auth infrastructure to maintain — but per-user costs at scale.
| Provider | Free Limit | Overage | Best Feature |
|---|---|---|---|
| Auth0 Source ↗ | 25K MAU | None: a paid plan sized to all users | Actions, SCIM and 1 enterprise connection on Free; Token Vault |
| Clerk Source ↗ | 50K MRU | $0.02/MRU | React components, org management |
| Kinde Source ↗ | 10.5K MAU | $0.0175 (Pro) | Feature flags + auth combined |
| PropelAuth Source ↗ | 10K MAU | $0.05 (Growth, $150/mo) | B2B-first: org management, roles, RBAC |
| Stytch Source ↗ | 10K MAU | $0.20/MAU | Passwordless and password login, B2B, AI-agent auth |
| Descope Source ↗ | 7.5K MAU | None on Free; $0.05 on Pro and Growth | Visual flow builder for auth |
| WorkOS 1M FREE Source ↗ | 1M MAU | $2,500/mo per extra 1M | Enterprise SSO ready (SAML/OIDC) |
Authentication bundled with backend-as-a-service platforms. The highest free MAU limits, but you’re adopting the full platform — not just auth.
| Provider | Free MAU | Overage | Platform | MFA | Self-Hosted? |
|---|---|---|---|---|---|
| Appwrite Auth 75K FREE CHANGED JUN 29 Source ↗ | 75,000 | $3 per 1,000 above 200K (Pro, $25/mo) | Appwrite (DB, Storage, Functions, Messaging) | Email, phone, TOTP (no phone on Cloud Free) | Yes (Docker) |
| Supabase Auth Source ↗ | 50,000 | $0.00325/MAU above 100K (Pro) | Supabase (Postgres, Realtime, Storage) | TOTP (phone MFA paid) | Yes (open source) |
| Firebase Auth Source ↗ | No cost; SMS on Blaze only | $0 ($0.0055/MAU from 50K to 100K with Identity Platform) | Firebase (Firestore, Hosting, Functions) | Phone + TOTP (Identity Platform) | No |
| AWS Cognito | 10,000 Source ↗ | $0.0055 Lite / $0.015 Essentials | AWS (Lambda, DynamoDB, S3, etc.) | SMS + TOTP | No |
Run your own auth infrastructure with zero per-MAU costs. Maximum control and no vendor lock-in, but you handle deployment, updates, and scaling.
| Provider | Free MAU | License | Language | Cloud Option |
|---|---|---|---|---|
| Keycloak Unconfirmed | Unlimited | Apache 2.0 | Java (Quarkus) | None from the project (Red Hat's build is self-run); third parties host it |
| Authentik Source ↗ | Unlimited | MIT (open core) | Python (Django) | None from authentik (Enterprise is self-hosted); third parties host it |
| Authelia No record | Unlimited | Apache 2.0 | Go | None (self-hosted only) |
| FusionAuth Source ↗ | Unlimited | Proprietary (free Community edition) | Java | FusionAuth Cloud (from $37/mo) |
| SuperTokens Source ↗ | Unlimited (self-hosted) | Apache 2.0 (core) | Java (core) | SuperTokens Managed (5K free MAU) |
| Hanko Source ↗ | Unlimited (self-hosted) | AGPL-3.0 | Go | Hanko Cloud (10K free MAU) |
| Ory Source ↗ | Unlimited (self-hosted) | Apache 2.0 | Go | Ory Network (Production $70/mo or $770/yr) |
Niche auth providers for specific use cases, plus dedicated authorization services that complement any auth provider.
| Provider | Free Tier | Specialty |
|---|---|---|
| Authgear Source ↗ | No MAU limit (cloud Free) | Passkeys + biometric auth, pre-built login UI |
| MojoAuth Source ↗ | 25K MAU | Passwordless-first: magic links, email OTP, social (passkeys on Business Pro) |
| Hexclave (formerly Stack Auth) Source ↗ | Self-hosting free; managed 10K user accounts | Open-source auth, managed or self-hosted |
Permit.io and Cerbos handle authorization (what a user may do), not sign-in. Authress handles both sign-in and permissions.
| Provider | Free Tier | Model |
|---|---|---|
| Permit.io CHANGED JUN 9 Unconfirmed | 1,000 MAU, RBAC + ABAC | Policy-as-a-service (OPA-based) |
| Cerbos Hub Source ↗ | 100 monthly active principals, 2 PDPs | Open-source policy engine (self-hosted or cloud) |
| Authress Source ↗ | First 1,000 billable calls free, then $0.0012/call | Login and permissions API |
This is the most important section of this comparison. Auth services that look free at launch can cost hundreds or thousands per month at scale. Here’s what each provider costs as you grow.
| Provider | At 10K MAU | At 25K MAU | At 50K MAU | At 100K MAU |
|---|---|---|---|---|
| Auth0 Source ↗ | $0 (free) | $0 (free) | No published price | No published price |
| Clerk (MRU) Source ↗ | $0 (free) | $0 (free) | $0 (free) | $1,025/mo |
| Kinde Source ↗ | $0 (free) | $278.75/mo (Pro) | $716.25/mo (Pro) | $1,533.85/mo (Plus) |
| PropelAuth Source ↗ | $0 (free) | $900/mo (Growth) | $2,150/mo (Growth) | $4,650/mo (Growth) |
| Stytch Source ↗ | $0 (free) | ~$3,000/mo | ~$8,000/mo | ~$18,000/mo |
| WorkOS AuthKit Source ↗ | $0 (free) | $0 (free) | $0 (free) | $0 (free up to 1M) |
| Appwrite Auth | $0 (free) | $0 (free) | $0 (free) | $25/mo (Pro) |
| Supabase Auth Source ↗ | $0 (free) | $0 (free) | $0 (free) | $25/mo (Pro) |
| Firebase Auth Source ↗ | $0 (free) | $0 (free) | $0 (free) | $0 ($275 with Identity Platform) |
| AWS Cognito | $0 (free) Source ↗ | $82.50 Lite / $225 Essentials | $220 / $600 | $495 / $1,350 |
| Self-hosted (Keycloak / Authentik / Authelia / Ory) | $0 licence | $0 licence | $0 licence | $0 licence |
Auth pricing has several non-obvious costs beyond the headline MAU number. Here’s what to watch for.
Auth0 has no per-user overage rate. Past 25,000 MAU you must buy a paid plan sized to all your users. Auth0's B2C Essentials plan starts at $35 a month for 500 MAU. Auth0's B2B Essentials plan starts at $150 a month for 500 MAU. On B2C Essentials, 30,000 MAU costs $2,100 a month. B2C Essentials and B2C Professional include no enterprise connections, no Self-Service SSO and no SCIM.
Clerk's free Hobby plan covers 50,000 monthly retained users (MRU) per application. Clerk defines a monthly retained user as a user who visits the app in a given month at least one day after signing up. Clerk says MRU is often lower than raw MAU, especially for apps with many one-time signups or trial users.
Auth0's free plan includes 1,000 M2M tokens a month. Auth0 counts the access tokens it issues, not API calls: one cached token can serve many calls until it expires. Clerk's free plan includes 2,500 M2M token creations a month. Kinde's free plan includes 2,000 M2M tokens. Descope's free plan includes 10,000 M2M exchanges. Cognito's M2M authentication is a paid add-on with no free tier. FusionAuth Community has no M2M support. Self-hosted Ory Hydra supports M2M clients at no licence cost; Ory's hosted service bills M2M tokens.
Firebase bills SMS for phone sign-in and SMS MFA at $0.01 to $0.50 per message, depending on the country. The first 10 messages a day are free. SMS MFA and TOTP MFA both require the Identity Platform upgrade on Firebase. SuperTokens charges for MFA even when self-hosted: $0.02 per MAU, with a $100 minimum a month. MojoAuth's Business Pro plan is required for passkeys and TOTP.
Keycloak's sizing guide starts at 1,250 MB of RAM per pod. authentik's Docker Compose install needs PostgreSQL and a host with at least 2 CPU cores and 2 GB of RAM. Their free editions charge no licence fee per user. You run the servers and apply security patches and upgrades yourself.
Clerk exports password hashes from its dashboard. Auth0 exports password hashes through a support case, which only paying and trial customers can open, and not every request qualifies. Users do not need to reset their passwords if the new provider accepts the hash format. Auth0, Keycloak, Ory, authentik and Kinde support OpenID Connect (OIDC).
Supabase pauses inactive free-tier projects after 1 week. If your auth backend pauses, users can’t log in until un-paused. For production apps, ensure regular activity or upgrade to Pro ($25/mo). Supabase details →
Recent auth-related pricing changes from our tracker. See the full timeline for all 424 tracked changes.
| Date | Provider | Change | Impact |
|---|---|---|---|
| effective Jun 9, 2026 | Permit.io | Permit.io's pricing page added a limit of 2,000 relationship tuples to its free Community plan. The row first appears between the Internet Archive's captures of 2026-05-23 and 2026-06-09; the plan's other limits were unchanged. Source ↗ | LOW |
| effective Nov 1, 2025 | Auth0 | Auth0 increased free tier from 7,500 to 25,000 monthly active users. Largest free tier expansion since Okta acquisition. Makes Auth0 competitive with Clerk and Firebase Auth on free tier Source ↗ | HIGH |
A source check reads each cited page for that service's name and a price. The figures in the tables above are from our own records, except for the services whose entry below dates them to a read of the vendor's own page.
Compare auth service free tiers, track pricing changes, and plan your authentication stack — all from your AI coding assistant.
claude mcp add agentdeals -- npx -y agentdealsWorks with Claude Desktop, Cursor, Cline, Windsurf → Full setup guide
We publish no ranking of these. Nothing we record measures popularity or generosity, so naming a best or a top few would be our preference rather than our data. We hold 31 Auth services in our catalogue, each with the free tier terms. This page compares them on free tier limits and what each charges past them; the tables above carry the figures side by side. Our ranking rule is published at /criteria.
We name no most generous free tier here, because generosity is not one quantity: the columns above measure different things and a tier that leads one trails another.
The free tiers cap monthly users (Auth0, Kinde, PropelAuth, Stytch, Descope, WorkOS, Supabase, Appwrite, Cognito) or retained users (Clerk), and some also cap SSO connections or M2M tokens. The growth-cost table shows what most of them charge past their free tier.