Auth0 alternatives: where to go and how to migrate without losing a user
Eight destinations, one per reason to leave, and an eight-step migration plan.
Short answer: Clerk if your app runs on React or Next.js, WorkOS if you sell to enterprises that demand SSO, Supabase Auth if your data already sits in Postgres, Amazon Cognito if everything runs on AWS, Firebase for a consumer mobile app. Done paying per MAU? Better Auth as a library, Keycloak or FusionAuth self-hosted. One thing to know before you choose: without a paid plan, Auth0 won't give you your password hashes. We compared all eight destinations and checked their pricing in 2026.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a score.
Why teams leave Auth0, and why it hurts
Auth0 is still a capable product: deep docs, dozens of social connections, SDKs for nearly every language. People rarely leave over the tech. They leave over the bill, the way it climbs, and how hard it is to get out once you're in.
A steep step from free to paid
Free covers 25,000 MAU. The first paid plan, Essentials, starts at $35 a month for 500 B2C users or $150 for B2B; Professional starts at $240 and $800. Higher up, the grid ends in "Contact us". As one Hacker News commenter put it: "Auth0's pricing really disappointed us, but we don't have the resource to switch".
You pay for the next tier up
If usage lands between two tiers, Auth0 bills the higher one. Hit 1,100 MAU and you pay the next band, not 1,100. On a fast-growing app, the bill jumps in steps instead of following your curve.
Enterprise SSO priced per connection
On B2B plans, Essentials includes 3 enterprise connections and Professional 5, then each extra costs $100 a month, capped at 30. One developer saw their bill go from free to $15k a year at around ten connectors. On B2C plans, enterprise connections aren't available at all.
Passwords don't leave easily
All your user data comes out through the Management API, except password hashes. Those need a support ticket and a paid plan, with no guaranteed date. On the free plan, Auth0 staff themselves suggest a temporary upgrade.
Forced rewrites from inside
Auth0 deprecated Rules and Hooks in favor of Actions. Teams with heavy Rules logic had to rewrite it, and many asked whether rewriting it somewhere else would really cost more.
A region you can't change
The hosting region, EU localities included, is picked when the tenant is created and can't be changed. A team that needs EU data residency for a customer or a GDPR review has to spin up a new tenant. That's a migration already, so many look elsewhere.
You're leaving because… go to…
The right Auth0 alternative depends on what's pushing you out. Usually one row fits. Each card links to the full profile below.
50,000 retained users free, then $25 a month.
Every enterprise customer costs you an SSO connectionWorkOSFree core auth up to 1M MAU, SSO priced per connection.
Your data already lives in Postgres or SupabaseSupabase Auth100,000 MAU on the $25 Pro plan.
Your whole product runs on AWSAmazon CognitoLazy migration through a Lambda trigger.
You want auth in your own codebaseBetter AuthFree TypeScript library, users in your database.
You want zero per-MAU fees and have ops skillsKeycloakOpen source server you host and upgrade.
Auth0 alternatives, tool by tool
For each tool: why move there, who it fits, its catch, how to migrate from Auth0, and what it costs. Prices are what vendors list in 2026, in US dollars. Watch the units: MAU (monthly active), MRU (monthly retained) and self-hosted "unlimited" aren't directly comparable.
Clerk: drop-in auth for React and Next.js apps
Quickest to wire upWhy move to Clerk. Clerk ships sign-in, sign-up and profile screens as components you place inside your React or Next.js app, instead of redirecting users to a hosted login page. The Hobby plan is free up to 50,000 monthly retained users per app, against 25,000 active users on Auth0 (different units).
Who it's for. Product teams on React or Next.js, B2C or B2B SaaS, who want organizations and roles without building an admin panel.
Who it's not for. Apps whose front end isn't JavaScript, and enterprises that insist on hosting identities themselves.
The catch. Clerk doesn't count users the way Auth0 does. A MRU (monthly retained user) is someone who comes back at least one day after signing up: a sign-up who never returns costs nothing, but your Auth0 and Clerk numbers won't line up. On the B2B side, one enterprise SSO connection is included, then $75 a month each, and an organization caps at 20 members unless you add the $100/month B2B add-on.
How to migrate. Clerk maintains an open source import script that reads JSON or CSV, with a password_hasher field so existing passwords keep working. It also supports a trickle migration where each user moves over on their next sign-in. Plan for one thing: active sessions end at cutover, so everyone logs in once more.
- Free
- 50,000 MRU per app
- Paid
- Pro $25/mo ($20 billed yearly)
- Overage
- $0.02 per MRU
- Our score
- 4.5/5
WorkOS: for SaaS selling to enterprise buyers
Best for B2B SSOWhy move to WorkOS. For B2B SaaS, the number one reason to leave Auth0 is the enterprise SSO line on the invoice. WorkOS splits the two: AuthKit, its login layer, is free up to 1 million monthly active users. You only pay for enterprise connections (SSO and Directory Sync): $125 per connection per month for connections 1 to 15, then $100 for 16 to 30.
Who it's for. A SaaS closing customers who run Okta, Entra ID or Google Workspace and write SAML or SCIM into every contract.
Who it's not for. A consumer app. You'd be ignoring everything WorkOS is good at.
The catch. Every enterprise customer adds a fixed line. Twenty SSO customers come to about $2,375 a month (15 × $125 + 5 × $100). That usually beats Auth0 B2B, but bake it into your enterprise tier price.
How to migrate. Importing accounts is the easy part. The hard part is reconfiguring SSO with each customer, who has to update the callback URL or SAML metadata on their side. Give enterprise accounts a month's notice and book a slot with each one.
- Free
- AuthKit up to 1M MAU
- Paid
- SSO $125/connection/mo (1 to 15)
- Best for
- B2B SaaS with SSO
- Our score
- 4.4/5
Supabase Auth: if your data already lives in Postgres
Cheapest at scaleWhy move to Supabase Auth. If your app already runs on Supabase, auth comes with the same subscription: 50,000 monthly active users on Free, 100,000 on the $25/month Pro plan (per organization), then $0.00325 per extra active user. At 200,000 MAU, overage adds roughly $325 a month. No "Contact us" wall halfway up.
Who it's for. Teams who want users in the same Postgres database as their data, with access rules written in SQL through Row Level Security.
Who it's not for. B2B SaaS built on Auth0 Organizations. Supabase Auth has no equivalent, so you rebuild the team model yourself.
The catch. The migration guide only carries TOTP for MFA, and an idle free project pauses after 7 days. For production, budget Pro from day one. SAML is included for 50 MAU, then $0.015 each.
How to migrate. Supabase publishes a guide written for Auth0. It imports bcrypt and Argon2 hashes, so users keep their passwords, as long as you get the hash export from Auth0 support. MFA factors need re-enrollment, and SAML connections are wired up with Supabase support. More in our Supabase review, and if Supabase isn't a fit, see its alternatives.
- Free
- 50,000 MAU
- Paid
- Pro $25/mo, 100,000 MAU included
- Overage
- $0.00325 per MAU
- Our score
- 4.3/5
Better Auth: own the code, skip the vendor
Open source libraryWhy move to Better Auth. Several Hacker News threads describe teams leaving Auth0 for a library to cut costs, and Better Auth is the TypeScript option that keeps coming up. The library is free under the MIT license and users sit in your own database; Better Auth sells an optional paid infrastructure layer (hosted dashboard, audit logs).
Who it's for. TypeScript teams with a back end they control, who'd rather maintain a dependency than pay a monthly identity invoice.
Who it's not for. Companies whose enterprise buyers send security questionnaires expecting a vendor with its own audit reports. With a library, that compliance work lands on you.
The catch. You become the identity provider. Security patches, rate limiting, breach response and uptime are your job now, not a vendor's.
How to migrate. Manual. Write a script that reads your Auth0 export and inserts users into your tables, and check that your password verification handles the bcrypt hashes from the export. Run it on a staging copy first.
- Price
- free, MIT license
- Hosting
- your stack
- Best for
- TypeScript teams
- Our score
- 4.2/5
Firebase Authentication: for mobile apps on Google
Generous free tier for B2CWhy move to Firebase. Firebase Authentication gives you 50,000 monthly active users free, on both Spark and Blaze. For a consumer mobile app, the math is blunt: one Hacker News commenter says moving from Auth0 to Firebase was "2 orders of magnitude cheaper".
Who it's for. iOS and Android apps, and teams already on Firestore, Cloud Functions or Google Cloud.
Who it's not for. B2B SaaS needing organizations, roles and per-customer SSO out of the box.
The catch. SAML and OIDC are free for only 50 MAU; past that, Identity Platform pricing on Google Cloud applies.
How to migrate. Confirm in Firebase's import docs that your Auth0 hash algorithm is supported, then run the import on a dozen accounts before the real thing. If you ever leave Firebase too, our Firebase switching guide covers the reverse route.
- Free
- 50,000 MAU (Spark and Blaze)
- SAML / OIDC
- 50 MAU free
- Best for
- B2C mobile apps
- Our score
- 4.0/5
Amazon Cognito: if your whole stack is on AWS
AWS per-MAU pricingWhy move to Cognito. The lowest per-user price on this page among services billed per MAU alone, with no subscription. On the Lite tier: 10,000 MAU free, then $0.0055 each, then $0.0046 at the next band. One Hacker News developer moved to Cognito after enterprise connectors pushed their Auth0 bill from free to $15k a year.
Who it's for. Teams already on AWS (Lambda, API Gateway, IAM) who are comfortable with infrastructure as code.
Who it's not for. Teams who want polished login screens without effort. Cognito's UI customization trails Auth0 and Clerk.
The catch. Three tiers that behave differently: Lite, Essentials (10,000 free then $0.015) and Plus ($0.020, no free tier). SAML and OIDC are free for 50 users, then $0.015. User pools created before the late-2024 pricing change keep 50,000 free MAU, so don't delete an old pool casually.
How to migrate. Cognito's "Migrate user" Lambda trigger checks the password against Auth0 on first sign-in and creates the user in Cognito. Nobody resets anything, but Auth0 must stay live for the whole window. Users who hit "forgot password" during that window end up in a reset flow. For automation around it, there's an AWS Cognito node in n8n.
- Free
- 10,000 MAU (Lite and Essentials)
- Overage
- from $0.0055 per MAU (Lite)
- Best for
- AWS teams
- Our score
- 3.8/5
Keycloak: the open source server you run yourself
Free, self-hostedWhy move to Keycloak. No more per-MAU invoice. Keycloak is an Apache 2.0 identity server with over 37,000 GitHub stars: SSO, SAML, OIDC, LDAP federation and MFA all ship in the box. SaaS teams paying $100 a month per enterprise connection often end up here.
Who it's for. Teams with ops skills (Kubernetes, databases, backups), or organizations that must keep identities in-house.
Who it's not for. A three-person startup with nobody on call. The license is free; running it isn't.
The catch. Upgrades. Managed-Keycloak vendors count about four minor releases a year, and each one needs preparing. If your identity server goes down, every login in your product goes with it.
How to migrate. Keycloak imports users from JSON, and a custom user storage SPI can verify legacy passwords on the fly. That's more code than Clerk or Cognito: plan a few days of Java work.
- License
- Apache 2.0, free
- Hosting
- your infrastructure
- Best for
- ops-heavy teams
- Our score
- 4.1/5
FusionAuth: self-host for free or buy a dedicated cloud
Self-host or dedicatedWhy move to FusionAuth. It sits between Keycloak and a pure SaaS. The Community edition is free with unlimited users when you self-host, and the same vendor sells hosted plans if you'd rather not run servers.
Who it's for. Teams who want to self-host today with a commercial vendor behind them, or who need single-tenant hosting for compliance.
Who it's not for. Small teams wanting a cheap managed service: hosted plans climb fast.
The catch. Price of the cloud. Starter begins at $162 a month and Essentials at $2,970 a month, both billed annually.
How to migrate. Before you commit, check FusionAuth's own Auth0 migration docs for how it handles bcrypt hashes from the export, and run a pilot import on the free Community edition.
- Free
- Community, self-hosted, unlimited users
- Paid
- Starter from $162/mo (annual)
- Best for
- self-hosting with a vendor
- Our score
- 4.0/5
The 8 alternatives compared
Our default pick: Clerk for B2C or an early-stage JavaScript SaaS, WorkOS once customers ask for SSO. For scale, take 100,000 B2C monthly active users: Supabase Auth stays inside the $25 Pro plan and Cognito Lite stays under $500, while Auth0's Professional and B2B plans move to custom quotes well before that volume.
| Free plan | First paid tier and migration | |
|---|---|---|
| Auth0Where you start | 25,000 MAU, 1 enterprise connection | Essentials from $35/mo (B2C) or $150 (B2B); hashes by ticket, paid plans only |
| ClerkReact, Next.js | 50,000 MRU per app | Pro $25/mo; JSON or CSV import, trickle migration |
| WorkOSB2B SSO | AuthKit up to 1M MAU | $125/mo per SSO connection (1 to 15) |
| Supabase AuthPostgres | 50,000 MAU, pauses after 7 idle days | Pro $25/mo (100,000 MAU); bcrypt and Argon2 import |
| Better AuthLibrary | Free, open source | Your hosting; manual import script |
| Firebase AuthMobile | 50,000 MAU, SAML for 50 MAU | Identity Platform pricing beyond |
| Amazon CognitoAWS | 10,000 MAU (Lite, Essentials) | $0.0055/MAU on Lite; Lambda migration trigger |
| KeycloakSelf-hosted | Free, Apache 2.0 | Your hosting and ops cost |
| FusionAuthSelf-host or cloud | Community, unlimited users self-hosted | Starter from $162/mo, billed annually |
Entry prices before tax, as listed by vendors in 2026, subject to change. Always rerun the math on your own usage.
Migrating off Auth0 in eight steps
Order matters. Each step protects something: your users' passwords, their sessions, your enterprise customers, and your ability to roll back if a detail breaks.
List everything Auth0 does for you
Week 1Write down every connection (database, Google, Apple, each enterprise SAML or OIDC connection), every Action plus any legacy Rules or Hooks still running, user_metadata and app_metadata, roles, Organizations, MFA factors, your custom domain, and each app's callback URLs.
Actions are what teams forget. They add claims to tokens (a role, a tenant ID) that your back end reads without anyone remembering where they come from. Open each Action and note what it writes into the token.
- Time
- half a day to two days
- Output
- one row per item
Ask for a discount before you leave
Week 1Before you commit six weeks of engineering, call Auth0. One Hacker News commenter says Okta/Auth0 pricing is negotiable: they went from paying per customer connection to a flat fee. Show up with a priced competing offer (WorkOS, Clerk, Cognito) and your real usage.
Even if the discount falls short, the call is useful: request the password hash export (next step) and check your renewal date. Yearly billing costs 11 times the monthly price, so don't renew for a year right before leaving.
- Time
- one week
- Goal
- discount or export date
Get the password hash export
Weeks 1 to 3This is what most guides skip. Auth0's Management API exposes everything about your users except password hashes. To get those, you open a support ticket, and the export is only available on paid plans. Auth0 doesn't guarantee a delivery date.
On the free plan? In Auth0's community forum, staff suggest upgrading temporarily for the export. Budget at least one month of Essentials ($35 for B2C) into the migration, and file the request in week one.
- Lead time
- not guaranteed
- Requirement
- paid plan
Choose bulk import, lazy migration, or both
Week 2Bulk import moves every account at once, hashes included: fast, but you need the hash export. Lazy migration (a Lambda trigger on Cognito, trickle mode on Clerk) creates each account when the user signs in again, checking the password against Auth0. No hashes needed, but Auth0 stays live and billed for the whole window.
What works: lazy migration for 4 to 8 weeks, then a bulk import of inactive users, who would otherwise never come back to be migrated.
- Window
- 4 to 8 weeks
- Inactive users
- bulk import at the end
Rebuild tokens and Action logic
Weeks 2 to 4Using your inventory, recreate every custom claim, role and org ID in the new provider. Decode an Auth0 token and a new one for the same user and compare them field by field before touching production.
Update API validation too: new issuer (iss), new audience, new signing keys. During the migration window, your back end has to accept both issuers.
- Checkpoint
- tokens diffed field by field
- During window
- accept both issuers
Reconnect each enterprise customer
Weeks 3 to 6A SAML or OIDC connection takes two parties: your customer set up Auth0 inside their Okta or Entra ID, and they have to redo it for your new provider. Send each customer the new metadata, a time slot and a named contact.
Start with the smallest account. Never disable the old connection until the customer confirms at least one of their users signed in through the new one.
- Per customer
- 30 minutes to an hour
- Order
- smallest to largest
Cut over, warn users, re-enroll MFA
Day oneOn cutover day, open sessions end and everyone signs in once more. Email users two days ahead with one plain sentence about what changes. TOTP authenticator factors don't carry over, so affected users re-enroll on first sign-in.
Watch failed logins and password reset requests for 48 hours. A spike almost always means a hash or redirect issue, not careless users.
- Monitoring
- 48 hours
- Notify
- every user
Shut Auth0 down at the right time
After the windowKeep the Auth0 tenant until the lazy migration window closes and inactive users are imported. Pull a final export of logs and metadata you need for legal retention, drop to the free plan, then delete the tenant.
Finally, strip Auth0 env vars, SDKs and URLs from your code. A forgotten library still calling Auth0 fails silently the day the tenant disappears. Check your automations as well, such as the Auth0 module in Make.
- When
- window closed + inactive import done
- Check
- no remaining Auth0 calls
Is your tool missing from this page? Email us: hello@hackceleration.com
What makes an Auth0 migration fail
The same mistakes show up in forum threads and in vendors' own migration guides. None of them is hard code. They're scheduling and scope misses.
Asking for hashes too late
The export ticket has no guaranteed turnaround. File it in cutover week and you may switch without passwords, forcing a reset on your whole user base. File it in week one.
Forgetting inactive users
Lazy migration only moves people who come back. Everyone else stays in Auth0, and if you shut it down without a final import, they lose their account. Always end with a bulk import.
Comparing different units
25,000 MAU on Auth0, 50,000 MRU on Clerk, unlimited on self-hosted Keycloak: the same headcount bills very differently. Pull your login stats and convert before comparing prices.
Breaking an enterprise login unannounced
A broken SAML connection locks out every employee of a customer at once, often your biggest contract. Each customer rewires on their side, on an agreed date, with the old connection still live.
Leaving orphaned claims
An Action that injected a role into the token vanishes with Auth0. Your API then denies access with no clear error. Diff tokens field by field before cutover.
Renewing yearly the week before you leave
Auth0's annual plan costs 11 months of monthly billing. Handy if you stay, expensive if you leave in three months. Switch to monthly as soon as the decision is made.
- Inventory of connections, Actions, metadata, roles and Organizations
- Hash export ticket filed with Auth0 support
- Renewal date checked
- Billing units converted (MAU, MRU)
- Strategy picked: bulk import, lazy migration, or both
- Tokens diffed field by field
- Back end accepts both issuers
- Each SSO customer given a date
- User email sent before cutover
- Inactive users imported at the end
Auth0 alternatives: frequently asked questions
What is the best Auth0 alternative?
There isn't one answer: Clerk for React or Next.js apps, WorkOS for B2B SaaS that sells SSO, Supabase Auth if your data is already in Postgres, Cognito if you live on AWS. Run your own numbers with two finalists, converting units (MAU, MRU) first, before deciding.
Is there a free or open source alternative to Auth0?
Yes. Keycloak is free and Apache 2.0, but you host and upgrade it. Better Auth is a free MIT-licensed TypeScript library, FusionAuth Community is free to self-host with unlimited users. On the SaaS side, WorkOS AuthKit is free up to 1 million MAU and Clerk up to 50,000 retained users.
Which Auth0 alternative is cheapest for B2B SSO?
For a handful of enterprise customers, Clerk includes one SSO connection and charges $75 a month for each extra; WorkOS charges $125 per connection with free core auth. Past 15 connections WorkOS drops to $100. Self-hosted Keycloak has no per-connection fee, but you pay in ops time.
Is Auth0 part of Okta?
Yes. Okta completed its acquisition of Auth0 in 2021. Okta focuses on workforce identity, Auth0 on customer login for apps, so moving from Auth0 to Okta won't fix a pricing problem. Going the other way? Read our Okta switching guide.
How do I migrate users from Auth0 without resetting passwords?
Two routes. Get the hash export through an Auth0 support ticket (paid plans only) and import it into a provider that reads bcrypt, like Supabase. Or migrate lazily: the password is checked against Auth0 on first sign-in. Only users who click "forgot password" during the window pick a new one.
Clerk vs Auth0: which should I pick?
Clerk if your front end is React or Next.js and you want login screens inside your app: its free tier covers 50,000 retained users versus 25,000 active on Auth0. Auth0 if you run many languages, already have dozens of enterprise connections configured, or hold a negotiated contract. Note that a user who never returns doesn't count on Clerk.
Is Auth0 free?
Yes, up to 25,000 monthly active users, with 5 organizations and one enterprise connection. A custom domain requires card verification, and advanced MFA factors aren't included. The trap: the free plan can't export password hashes, which makes leaving harder.
Can I keep user data in the EU after leaving Auth0?
On Auth0 the region is fixed when you create the tenant, so moving to the EU already means a migration. Among alternatives, self-hosted Keycloak or FusionAuth run wherever you deploy them, so the region is your call. Check each vendor's subprocessors too.
Get the next migration guide in your inbox
One tool to leave, one destination, one migration plan. Nothing else.