SaaS Radar

What Are the Best AWS Cognito Alternatives in 2026?

Published 2026-08-29 · Researched and price-checked on official sources

Looking for AWS Cognito alternatives? Auth0 gives 25,000 free monthly active users, Clerk counts 50,000 retained users free, WorkOS stays free to one million, and Supabase and Firebase cover smaller apps at $0. Cognito itself now charges $0.015 per MAU above a 10,000-user free tier on its default Essentials plan.

Key facts

What matters

Cognito's free tier for new user pools is 10,000 MAU per month on Lite or Essentials; the 50,000 MAU free tier quoted in the viral blog post applies only to pools created on or before November 22, 2024.
Verified August 2026 pricing: Auth0 free at 25,000 MAU then $35/mo, Clerk free at 50,000 retained users then $20/mo billed annually, WorkOS free to 1,000,000 MAU, Supabase Pro $25/mo with 100,000 MAU included, Firebase free for standard auth.
At 100,000 MAU, Cognito Essentials costs about $1,350 per month (90,000 users at $0.015 each), while Supabase's $25 Pro plan includes 100,000 MAU.
Clerk bills Monthly Retained Users: a user only counts if they return 24+ hours after signup, so one-time signups never hit the invoice.
Self-hosted option: Keycloak is Apache-2.0 licensed and free to operate yourself, with over 36,000 GitHub stars, at the cost of running an identity server.

Why developers are leaving AWS Cognito

On July 10, 2026, developer Josh Karamuth published "I Used AWS Cognito for a Startup. I Wouldn't Do It Again," a post that reached the top of Hacker News this week with more than 160 points. It is not a pricing complaint. The post documents four concrete problems with Cognito as a product.

Breaking upgrades: moving from Amplify v5 to v6 "fundamentally rearchitected" the API, and Karamuth says he had to rewrite working authentication code instead of refactoring it.
Immutable attributes: a misconfigured custom attribute cannot be changed after the user pool exists. The options are deleting the pool or scripting a user migration.
No local development: Cognito runs only in the cloud, so offline testing depends on community emulators with imperfect fidelity.
Limited hosted UI: you can change the logo and tweak CSS in the console, but the layout and structure stay Amazon's.

None of this shows up in a price comparison. The post's conclusion is the useful part: "the time we lost debugging Cognito issues could have paid for several years of a paid auth provider." The engineering cost, not the per-user fee, is the real bill.

The AWS Cognito alternatives worth evaluating

Six options cover the same job with verified pricing as of August 29, 2026: Auth0, Clerk, WorkOS, Supabase Auth, Firebase Auth, and Keycloak for self-hosting. One billing detail matters before comparing them. Providers count users differently: Auth0, WorkOS, Supabase, and Cognito bill monthly active users (MAU), a user who authenticates in a calendar month, while Clerk bills monthly retained users (MRU), a user who returns at least 24 hours after signing up. MRU is usually the smaller number.

Another detail most roundups miss: the 50,000 MAU free tier in the viral blog post is outdated for new deployments. Amazon's pricing page states the free tier for new user pools is 10,000 MAU per month on the Lite or Essentials tiers, with no free tier on Plus. The 50,000 MAU figure survives only for pools created on or before November 22, 2024.

Auth0: the mature managed platform

Auth0, owned by Okta, is the most complete managed identity platform of the group. Its free plan covers 25,000 monthly active users at $0, with a custom domain, passwordless login via SMS, email, passkey or OTP, unlimited social connections, and five organizations. Paid plans start at $35 per month for Essentials and $240 per month for Professional, each with a 500 MAU base; Enterprise pricing is custom with a 99.99% SLA. The startup program grants 100,000 external MAU for a year plus $5,000 in AWS credits.

Essentials adds Pro MFA (OTP and Duo), role-based access control per organization, audit log streaming to Datadog, Splunk, AWS or Azure, and separate production and development environments. Professional adds enterprise MFA via phone, email, WebAuthn or the Guardian app, plus enhanced attack protection and machine-to-machine tokens as an add-on.

Who it fits: teams that want the widest feature set and accept paying per user. Data is portable: Auth0 documents a user import/export extension and a management API that can export the full user database.

Clerk: billed on retained users, not MAU

Clerk prices on monthly retained users, which changes the economics. A user only counts if they return at least 24 hours after signing up, so trial users and one-time signups never appear on the bill. The free Hobby plan allows 50,000 MRU per app with unlimited applications. Pro costs $20 per month billed annually ($25 monthly), includes 50,000 MRU per app and one enterprise connection, and charges $0.02 per additional MRU up to 100,000, with volume discounts above that. Additional enterprise connections are $75 per month each.

Pro also removes Clerk branding and enables MFA, satellite domains, and bot protection. The Business tier is $250 per month billed annually.

Who it fits: B2B SaaS and subscription products where retained users track revenue. The catch: a free ad-supported app with a huge one-time signup base can outgrow the model, because every returning user counts.

WorkOS: free to one million users, enterprise SSO per connection

WorkOS splits the problem in two. User Management (sign-up, sign-in, profiles, and the AuthKit prebuilt UI) is free for up to 1,000,000 monthly active users, which makes it the cheapest route to scale in this list. The paid part is enterprise: Enterprise SSO and Directory Sync cost $125 per connection per month, with 20% off from 16 to 30 connections. A connection is one enterprise customer you support with SAML or OIDC SSO.

Who it fits: B2B apps whose buyers demand enterprise SSO. If your roadmap has a "we support SAML" checkbox, WorkOS prices that as a product line: free until the first enterprise customer, then per customer. For B2C-only apps the model is overkill.

Supabase Auth: authentication bundled with Postgres

Supabase Auth is the auth layer of the Supabase platform, which also provides Postgres, storage, and edge functions. The Free plan includes 50,000 MAU. The Pro plan at $25 per month includes 100,000 MAU and then $0.00325 per MAU, plus 8 GB disk, 250 GB egress, and seven days of daily backups. Team is $599 per month with SOC2 and ISO 27001 reports, dashboard SSO, and a HIPAA add-on.

The pricing math is striking next to Cognito. At 100,000 MAU, a Cognito Essentials pool costs about $1,350 per month (90,000 users at $0.015 each, per Amazon's worked example), while Supabase Pro includes the same 100,000 MAU in its $25 monthly price. The trade-off: you are buying into the Supabase stack, and dashboard SSO only arrives at the Team tier.

Firebase Auth and Keycloak: the free paths

Firebase Auth keeps standard methods free on both plans. Google's pricing page lists phone authentication as the only charged item, billed per SMS sent on the Blaze plan; email, password, and social sign-in carry no per-user fee. That makes it the cheapest option for mobile-first apps that stay inside Google's ecosystem. The limits are real: there is no enterprise SSO product in Auth itself, and the surrounding console and security rules tie you to Google Cloud.

Keycloak is the self-hosted answer. The project is Apache-2.0 licensed, free to run, and has over 36,000 GitHub stars. You operate the identity server yourself, which means no per-user bill and full control, at the price of upgrades, patching, and availability. It fits compliance-driven teams and anyone who wants user data off a vendor platform.

How to choose an AWS Cognito alternative

Staying on AWS but want fewer surprises: keep Cognito, create new pools on the Essentials tier, and budget engineering time. The free tier is 10,000 MAU, not 50,000.
B2B SaaS selling to companies that demand SSO: WorkOS, free user management plus $125 per enterprise connection.
B2C app that needs a polished sign-in: Auth0 (25,000 MAU free, deepest feature set) or Clerk (50,000 retained users free).
Startup that also needs a database: Supabase Pro at $25 per month with 100,000 MAU included.
Mobile-first or zero budget: Firebase Auth, free for standard methods.
Full control or compliance: self-host Keycloak.

Karamuth's advice applies no matter which provider you pick: build a nontrivial proof of concept first, with custom attributes, email verification, and a password reset flow. Time that experiment and count the documentation tabs you open. The provider that stays under twenty is the one to buy.

At a glance

Provider	Free tier	Paid pricing	User counting	Best for
Amazon Cognito	10,000 MAU/mo on Lite or Essentials; legacy pools keep 50,000	Essentials $0.015/MAU; Plus $0.020/MAU; Lite $0.0055/MAU	MAU	Teams already on AWS
Auth0	25,000 MAU	Essentials $35/mo; Professional $240/mo (500 MAU base)	MAU	Feature-complete B2C or B2B identity
Clerk	50,000 MRU per app	Pro $20/mo billed annually (50,000 MRU included); overage $0.02/MRU	MRU (retained users)	B2B SaaS, prebuilt UI, developer experience
WorkOS	1,000,000 MAU	Enterprise SSO and Directory Sync $125/connection/mo	MAU plus per-connection	B2B apps selling enterprise SSO
Supabase Auth	50,000 MAU on Free plan	Pro $25/mo includes 100,000 MAU, then $0.00325/MAU	MAU	Startups that also need Postgres
Firebase Auth	Free standard auth	Blaze pay-as-you-go; phone auth billed per SMS	No per-user fee for standard methods	Mobile apps in the Google ecosystem
Keycloak (self-hosted)	Free, Apache-2.0	Your own infrastructure cost	Unlimited	Compliance and full control

AWS Cognito alternatives: verified pricing as of August 29, 2026, from official pricing pages.

FAQ

Is AWS Cognito free?

Yes at small scale. New user pools get 10,000 MAU per month free on the Lite or Essentials tiers, and there is no free tier on Plus. Pools created on or before November 22, 2024 keep the older 50,000 MAU free tier. Above the free tier, Essentials costs $0.015 per MAU.

Which is cheaper, Clerk or Auth0?

For the same app, usually Clerk. Clerk Pro is $20 per month billed annually with 50,000 retained users included, while Auth0 Essentials is $35 per month with a 500 MAU base. Clerk also bills retained users only, so its invoice number is typically lower than a raw MAU count.

Can I migrate from AWS Cognito to another auth provider?

Yes. Auth0 documents a user import/export extension and a management API for exporting the full user database. Plan early: Cognito custom attributes cannot be changed after creation, so a migration script that moves users to a new pool or provider is the only path when the configuration was wrong.