Open-source TypeScript session library, deprecated in March 2025 and replaced by a single-file code example you copy into your app
Lucia was auth stripped down to its essentials: a TypeScript library for session management, with helpers for password hashing, OAuth and token generation. There was no hosted service and no per-user pricing, just code running in your app and storing sessions in your own database.
The author deprecated the npm package in March 2025. The Lucia site and repository now offer a complete single-file session implementation to copy into your project instead, along with the Auth Book as a guide to building auth yourself. That route still suits developers who want full control, but it means owning the security of that code. For auth done in an afternoon, Clerk or Firebase Auth handle it as a managed service, and SuperTokens is an open-source option you can self-host.
Pros
- The replacement is plain code: one session file you own, with no package to update
- Free, no MAU limits, and your auth data stays in your own database
- The author's Auth Book explains sessions, passwords and OAuth in depth
Cons
- The npm package is deprecated: no fixes or security updates
- You build everything yourself: no pre-built login UI, no hosted dashboard
- Requires solid understanding of sessions, cookies, and auth security
Compare
Verified