What is the top free pick among auth tools?

Auth.js leads the Stack Gems list for auth tools. Verdict: Maximum control for teams willing to own their auth.

How many auth tools does Stack Gems review?

25: 16 free or open source, 3 hosted with a real free tier, 6 paid or paid-led. Each review has a verdict and an honest Catch; no tool pays for its spot.

Which auth tools can I self-host for free?

Auth.js, Logto, authentik, ZITADEL, Authelia, Keycloak, Dex, Kanidm and 7 more.

Which auth tools have the most GitHub stars?

Keycloak (37.4k), Better Auth (30.4k), Authelia (29.3k), per GitHub on 2026-10-19. Stars measure attention, not fit; read the Catch.

What is the catch with Auth.js?

You are building the UI, handling edge cases, and managing the infrastructure.

Best of · Auth / Next.js

Best auth tools (2026)

Stack Gems reviews 25 auth tools: 16 free or open source, 3 hosted with a real free tier, 6 paid or paid-led. These are the top 10, each with its verdict and the Catch we would want to know before installing it.

Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.

25 reviewed · 10 shown in full

1.Auth.jsAuthentication for the web, framework-agnostic
Free / OSS · ISC · 28.4k GitHub stars
VerdictMaximum control for teams willing to own their auth.
CatchYou are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.
2.Better AuthTypeScript auth that lives in your app, not a rented IdP
Free / OSS · Freemium · 30.4k GitHub stars
VerdictThe MIT auth library to reach for before Clerk. Framework is free; the dashboard is the upsell.
CatchThe library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.
3.LogtoMPL-2.0 identity platform with a 50k-MAU free Cloud
Free / OSS · Freemium · 14.7k GitHub stars
VerdictThe MPL-2.0 Auth0-shaped stack. Use it when Clerk MAUs are the product.
CatchCloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.
4.authentikMIT-core self-hosted IdP; enterprise/ is not MIT
Free / OSS · OSS/MIT · 26k GitHub stars
VerdictMIT-core IdP. Self-host is the free path; there is no authentik Cloud.
Catchenterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.
5.ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU
Free / OSS · Freemium · 15.3k GitHub stars
VerdictAGPL identity with a real $0 Cloud. 100 DAU is the meter; self-host if that is a joke.
Catchthe wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.
6.AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik
Free / OSS · Apache-2.0 · 29.3k GitHub stars
VerdictApache-2.0 proxy SSO. Free as in you operate the reverse proxy.
CatchYou run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.
7.KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP
Free / OSS · Apache-2.0 · 37.4k GitHub stars
VerdictApache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.
CatchCNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.
8.DexApache-2.0 federated OIDC IdP that owns no user state
Free / OSS · Apache-2.0 · 11.2k GitHub stars
VerdictApache-2.0 OIDC facade. Connectors in, standards out, no user table.
CatchProtocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.
9.KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak
Free / OSS · Apache-2.0 · 5.5k GitHub stars
VerdictMPL-2.0 Rust IdP. Self-host free. Not Keycloak.
CatchRust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.
10.CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
Free / OSS · Freemium · 14.6k GitHub stars
VerdictApache-2.0 IdP. Self-host primary; Hosted Free 25k MAU.
CatchUI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.

Also reviewed (15)

SimpleWebAuthn — MIT passkeys ceremony library — not an IdP
Ory Open Source — Apache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Pocket ID — BSD-2-Clause passkey-only OIDC IdP; self-host only
Tinyauth — AGPL-3.0 one-binary proxy auth + Certified OIDC
OAuth2 Proxy — MIT CNCF Sandbox reverse-proxy auth gate vs external IdPs
Rauthy — Apache-2.0 Rust passkey-forward OIDC+OAuth2 IdP with PAM/NSS
SuperTokens — Apache-2.0 session auth you can self-host with no MAU cap
Hanko — AGPLv3 passkeys-first auth with a 10k-MAU free Cloud
Hexclave — MIT clients / AGPLv3 server auth; Cloud Free ≤10k forever
Clerk — Auth that actually ships with your UI
Kinde — Hosted auth plus billing, $0 forever, 10,500 MAU, no OSS
WorkOS — Proprietary AuthKit: first 1M MAUs Free, not OSS
Descope — Proprietary auth: Free Forever 7500 MAUs / 10 tenants / 3 SSO
FusionAuth — Source-available CIAM; Community self-host free unlimited users
Stytch — Auth SaaS with no feature gates; free to 10k MAU + 5 SSO/SCIM

FAQ

What is the top free pick among auth tools?: Auth.js leads the Stack Gems list for auth tools. Verdict: Maximum control for teams willing to own their auth.
How many auth tools does Stack Gems review?: 25: 16 free or open source, 3 hosted with a real free tier, 6 paid or paid-led. Each review has a verdict and an honest Catch; no tool pays for its spot.
Which auth tools can I self-host for free?: Auth.js, Logto, authentik, ZITADEL, Authelia, Keycloak, Dex, Kanidm and 7 more.
Which auth tools have the most GitHub stars?: Keycloak (37.4k), Better Auth (30.4k), Authelia (29.3k), per GitHub on 2026-10-19. Stars measure attention, not fit; read the Catch.
What is the catch with Auth.js?: You are building the UI, handling edge cases, and managing the infrastructure.

Alternatives

Tags in this list

Related lists

JSON: /api/gems?subcategory=auth · MCP: best_for on /api/mcp