Clerk vs Lucia
Pricing
Clerk: Free up to 10k MAU, from $25/mo
Lucia: Free and open source, deprecated since March 2025
Description
Clerk: Drop-in auth with pre-built UI components: sign-up, sign-in, and user management in minutes
Lucia: Open-source TypeScript session library, deprecated in March 2025 and replaced by a single-file code example you copy into your app
Pros
- Pre-built React components for auth that actually look good out of the box
- 10,000 monthly active users free: most startups run free for months
- Handles the hard stuff: MFA, social login, organization management
- The replacement is plain code: one session file you own, with no package to update
- Free, no MAU limits, and your auth data stays in your own database
- The author's Auth Book explains sessions, passwords and OAuth in depth
Cons
- Vendor lock-in is real: migrating away from Clerk means rebuilding auth
- Pricing jumps at scale (10k+ MAU) can surprise you
- React-focused, less polished for non-React stacks
- The npm package is deprecated: no fixes or security updates
- You build everything yourself: no pre-built login UI, no hosted dashboard
- Requires solid understanding of sessions, cookies, and auth security
Details
Clerk gives you a complete auth system without building one. Install the package, drop in the sign-up component, and you have Google login, email/password, MFA, and user profiles working. The UI components look professional without any styling work.
The 10,000 MAU free tier is genuinely generous: most early startups will not outgrow it for months. The concern is lock-in: once your app is wired to Clerk’s components and APIs, moving to something else is a significant rewrite. If you are validating an idea and need auth fast, Clerk is the fastest path. If you are building something you expect to maintain for years, consider whether the convenience is worth the dependency.
Lucia was auth stripped down to its essentials: a TypeScript library for session management, with helpers for password hashing, OAuth and token generation. There was no hosted service and no per-user pricing, just code running in your app and storing sessions in your own database.
The author deprecated the npm package in March 2025. The Lucia site and repository now offer a complete single-file session implementation to copy into your project instead, along with the Auth Book as a guide to building auth yourself. That route still suits developers who want full control, but it means owning the security of that code. For auth done in an afternoon, Clerk or Firebase Auth handle it as a managed service, and SuperTokens is an open-source option you can self-host.
Clerk verified
Lucia verified
