Self-hosted auth: $0 per user, but what you pay instead
Answer: Better Auth (MIT) and Auth.js (ISC) charge $0 per user, but you pay for email, SMS, database/hosting and engineer time. With our stated assumptions (1 transactional email per user per month on Amazon SES at $0.10 per 1,000, no SMS, existing database), the cash cost is $1/mo at 10k users and $10/mo at 100k. The cheapest hosted plan in our ledger lists $0/mo at 10k (Clerk Hobby) and $0/mo at 100k (WorkOS AuthKit), so on cash alone self-hosting does not beat free tiers. Against paid plans it can: at 100k users Clerk Pro lists $1,025/mo and Firebase / Identity Platform $275/mo, so at an assumed $100/hour self-hosting saves money only while upkeep stays under 10.2 h/mo (vs Clerk Pro) or 2.6 h/mo (vs Firebase).
Do teams still build authentication from scratch, or is there a fair indie alternative?
Few write it from scratch. Open-source libraries run inside your app and database with no per-user fee: Better Auth (MIT license) and Auth.js (ISC license; the Auth.js project is now part of Better Auth). The fair trade: no MAU bill, but you own the email, SMS, database and upkeep costs below. Sources: Better Auth on GitHub (MIT), authjs.dev.
“$0 per user”: what do you pay instead?
| Line item | Published rate (source) | How we count it |
|---|---|---|
| License / per-user fee | $0: Better Auth MIT, Auth.js ISC (GitHub) | $0 |
| Transactional email (verify, reset, magic link) | Amazon SES $0.10 / 1,000 outbound (aws.amazon.com/ses/pricing) · Better Auth infra $0.001/email (better-auth.com/pricing) | users × emails per user × rate. Assumption: 1 email per user per month |
| SMS OTP / SMS MFA | Identity Platform US $0.01/SMS, first 10/day not billed (cloud.google.com/identity-platform/pricing) · Better Auth infra $0.09/SMS. Rates vary widely by country. | SMS per month × rate. Assumption: 0 (email, passkeys or social only) |
| Database + hosting | Not a published auth price: depends on your stack | Assumption: $0 extra (user/session tables in a database you already run) |
| Engineer hours (upgrades, security patches, support) | Not published anywhere: yours to estimate | Shown as break-even hours at an assumed $100/hour, not added to the cash cost |
Auth0 / Clerk pricing “scales horribly”: the numbers at 10k, 50k and 100k users
| Monthly users | Self-host cash cost* | Cheapest hosted | Clerk (cheapest · Pro) | Auth0 (cheapest · B2C Essentials) | Firebase / Identity Platform | Break-even upkeep vs Clerk Pro · vs Firebase |
|---|---|---|---|---|---|---|
| 10k users | $1 | $0 Clerk Hobby | $0 · $25 | $0 · $700 | $0 | 0.2 h/mo · 0 h (hosted is cheaper) |
| 50k users | $5 | $0 Clerk Hobby | $0 · $25 | $3,500 · $3,500 | $0 | 0.2 h/mo · 0 h (hosted is cheaper) |
| 100k users | $10 | $0 WorkOS AuthKit | $1,025 · $1,025 | — · Enterprise (contact sales) | $275 | 10.2 h/mo · 2.6 h/mo |
* Cash cost = email + SMS + extra infrastructure using the assumptions above; engineer time excluded. Hosted columns: monthly USD list price from the AuthCost ledger (no SSO, no MFA), checked 2026-10-31. Break-even = (hosted − self-host cash cost) ÷ $100/h: the monthly upkeep hours at which self-hosting stops saving money. Free hosted tiers have feature limits (e.g. Clerk Hobby has no MFA), so we also show Clerk Pro and Auth0 B2C Essentials. How we calculate this.
Clerk vs Better Auth: when does self-hosting actually save money?
Up to 25k–50k users, Clerk Hobby (50k MRU), Auth0 Free (25k MAU) and Firebase (50k MAU) all list $0, and WorkOS AuthKit lists free to 1M MAU (SSO billed per connection), so self-hosting can’t save cash there. Its case is control, data location, and free-tier feature limits (e.g. Clerk Hobby lists no MFA). Once you need a paid plan, the gap opens: Clerk Pro goes from $25/mo at 50k to $1,025/mo at 100k, and Auth0 B2C Essentials lists $3,500/mo at 50k. That is where self-hosting can earn its upkeep, if your team’s hours stay under the break-even in the table. Compare: Clerk pricing · Auth0 pricing · Firebase / Identity Platform pricing · Descope pricing.
Every auth provider raises prices if you require SSO. Does self-hosting avoid the SSO tax?
Better Auth’s SSO plugin supports OIDC, OAuth2 and SAML 2.0, so there is no per-connection license fee when you self-host; you still carry setup and support for each customer’s IdP. Its optional managed infrastructure lists self-service SSO at 1 connection, then $50/month per connection (on the $20/mo Infrastructure Pro plan). Hosted per-connection list prices in our ledger: Clerk Pro $75, Auth0 Essentials (B2B) $100, WorkOS AuthKit $125, Descope Pro $50. Sources: Better Auth SSO plugin docs, better-auth.com/pricing; hosted rates from each vendor’s page via our SSO cost guide.
Run your own numbers
Loading ledger…
Every default marked “assumption” is ours, not a published price: change it to your numbers. Hosted prices are live from /api/plans.json.
What this page doesn’t price
Security incident response, compliance audits (e.g. SOC 2 evidence for your auth layer), migrations between libraries, and bot/abuse protection are real costs with no published rate, so we leave them out rather than guess. Hosted vendors bundle some of these; check each vendor’s page.
See also: cheaper hosted alternatives · every vendor by MAU · calculator · Clerk vs Auth0
Hear when hosted auth prices move
Weekly: every auth price change we confirmed, SSO fee moves, and the cheapest verified plan for 10k and 50k users. Free; unsubscribe in one click. Sent via Kit · Privacy.