Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Auth

Better Auth alternatives (2026)

Better Auth: The MIT auth library to reach for before Clerk. Framework is free; the dashboard is the upsell.

Its Catch: The library is free; dashboards, audit, and SSO add-ons are the paid wedge.

Below: 8 free or free-tier tools from the same category (auth tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.Auth.jsAuthentication for the web, framework-agnostic

    Free / OSS · ISC · 28.4k GitHub stars

    VerdictMaximum control for teams willing to own their auth.

    CatchYou are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.

  2. 2.authentikMIT-core self-hosted IdP; enterprise/ is not MIT

    Free / OSS · OSS/MIT · 26k GitHub stars

    VerdictMIT-core IdP. Self-host is the free path; there is no authentik Cloud.

    Catchenterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.

  3. 3.ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU

    Free / OSS · Freemium · 15.3k GitHub stars

    VerdictAGPL identity with a real $0 Cloud. 100 DAU is the meter; self-host if that is a joke.

    Catchthe wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.

  4. 4.AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik

    Free / OSS · Apache-2.0 · 29.3k GitHub stars

    VerdictApache-2.0 proxy SSO. Free as in you operate the reverse proxy.

    CatchYou run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.

  5. 5.KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP

    Free / OSS · Apache-2.0 · 37.4k GitHub stars

    VerdictApache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.

    CatchCNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.

  6. 6.DexApache-2.0 federated OIDC IdP that owns no user state

    Free / OSS · Apache-2.0 · 11.2k GitHub stars

    VerdictApache-2.0 OIDC facade. Connectors in, standards out, no user table.

    CatchProtocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.

  7. 7.KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak

    Free / OSS · Apache-2.0 · 5.5k GitHub stars

    VerdictMPL-2.0 Rust IdP. Self-host free. Not Keycloak.

    CatchRust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.

  8. 8.CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary

    Free / OSS · Freemium · 14.6k GitHub stars

    VerdictApache-2.0 IdP. Self-host primary; Hosted Free 25k MAU.

    CatchUI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.

FAQ

What are the best free alternatives to Better Auth?
Auth.js, authentik, ZITADEL, Authelia, Keycloak. All are reviewed on Stack Gems in the same category (auth tools); 8 free or open source.
What is the catch with Better Auth?
The library is free; dashboards, audit, and SSO add-ons are the paid wedge.
Is there an open-source alternative to Better Auth?
Yes: Auth.js (ISC), authentik (OSS/MIT), ZITADEL (Freemium), Authelia (Apache-2.0).

More