Lucia vs SuperTokens
Pricing
Lucia: Free and open source, deprecated since March 2025
SuperTokens: Free self-hosted, managed from $0 (up to 5k MAU)
Description
Lucia: Open-source TypeScript session library, deprecated in March 2025 and replaced by a single-file code example you copy into your app
SuperTokens: Open-source authentication you can self-host for free or use their managed service
Pros
- The replacement is plain code: one session file you own, with no package to update
- Free, no MAU limits, and your auth data stays in your own database
- The author's Auth Book explains sessions, passwords and OAuth in depth
- Fully open source (Apache 2.0): inspect every line, fork it, no vendor lock-in
- Self-hosted option means zero recurring cost for auth, ever
- Pre-built login UI with session management, MFA, and social login
Cons
- The npm package is deprecated: no fixes or security updates
- You build everything yourself: no pre-built login UI, no hosted dashboard
- Requires solid understanding of sessions, cookies, and auth security
- Self-hosting requires running a Java backend service alongside your app
- Smaller community and fewer integrations compared to Auth0 or Clerk
- Documentation covers the basics but thins out for advanced customization
Details
Lucia was auth stripped down to its essentials: a TypeScript library for session management, with helpers for password hashing, OAuth and token generation. There was no hosted service and no per-user pricing, just code running in your app and storing sessions in your own database.
The author deprecated the npm package in March 2025. The Lucia site and repository now offer a complete single-file session implementation to copy into your project instead, along with the Auth Book as a guide to building auth yourself. That route still suits developers who want full control, but it means owning the security of that code. For auth done in an afternoon, Clerk or Firebase Auth handle it as a managed service, and SuperTokens is an open-source option you can self-host.
SuperTokens is an open-source auth provider that gives you a real alternative to paying per-user fees. Self-host the SuperTokens core (a Java service) alongside your app, and you get email/password, social login, passwordless, session management, and MFA without paying anyone anything. The managed version is free up to 5,000 MAU if you do not want to run infrastructure.
The tradeoff is operational complexity. Self-hosting means you own the auth infrastructure: updates, monitoring, backups. The core service runs on Java, which adds a dependency some teams would rather avoid. If you are building a product where long-term auth costs matter (high user count, thin margins), SuperTokens can save you thousands per year. If you just want auth working in an afternoon and do not mind paying Clerk or Auth0 later, those are faster to set up.
Lucia verified
SuperTokens verified
