Firebase Auth vs Lucia
Pricing
Firebase Auth: Free up to 50k MAU (phone auth: 10k/mo free)
Lucia: Free and open source, deprecated since March 2025
Description
Firebase Auth: Google's authentication service with generous free limits and tight integration across the Firebase ecosystem
Lucia: Open-source TypeScript session library, deprecated in March 2025 and replaced by a single-file code example you copy into your app
Pros
- 50,000 monthly active users free: most solo products never hit that ceiling
- Google, Apple, GitHub, and 10+ social providers work out of the box
- Plugs directly into Firestore, Cloud Functions, and other Google Cloud services
- The replacement is plain code: one session file you own, with no package to update
- Free, no MAU limits, and your auth data stays in your own database
- The author's Auth Book explains sessions, passwords and OAuth in depth
Cons
- Tied to the Google ecosystem: using Firebase Auth without other Firebase services feels awkward
- Custom UI required: no pre-built login components like Clerk offers
- Migrating user password hashes out of Firebase is possible but painful
- The npm package is deprecated: no fixes or security updates
- You build everything yourself: no pre-built login UI, no hosted dashboard
- Requires solid understanding of sessions, cookies, and auth security
Details
Firebase Auth handles email/password, social login, phone auth, and anonymous users with minimal setup. Google gives you 50,000 MAU free for most auth methods, which is five times what Clerk or Auth0 offer. If you are already using Firestore or Cloud Functions, Auth plugs in with a single line of config.
The downside is that Firebase Auth is designed to keep you inside Google’s ecosystem. Using it as a standalone auth service (say, with a Postgres database and a Next.js app on Vercel) is doable but clunky compared to Clerk or Supabase Auth. You also need to build your own login UI, since Firebase only provides a basic drop-in widget (FirebaseUI) that looks dated. For solo founders already committed to Firebase, Auth is the obvious choice. For everyone else, evaluate whether you want that Google dependency.
Lucia was auth stripped down to its essentials: a TypeScript library for session management, with helpers for password hashing, OAuth and token generation. There was no hosted service and no per-user pricing, just code running in your app and storing sessions in your own database.
The author deprecated the npm package in March 2025. The Lucia site and repository now offer a complete single-file session implementation to copy into your project instead, along with the Auth Book as a guide to building auth yourself. That route still suits developers who want full control, but it means owning the security of that code. For auth done in an afternoon, Clerk or Firebase Auth handle it as a managed service, and SuperTokens is an open-source option you can self-host.
Firebase Auth verified
Lucia verified
