Authentication and user management

Authentication services handle sign-up, sign-in, MFA, single sign-on and the user records behind them, so you do not build and audit that yourself. They all log users in; the differences are in how they count users, what each plan includes and what the vendor commits to on paper.

We compare them on the same six indicators, read from each vendor's pricing, security and documentation pages:

• Pricing clarity: whether self-serve prices are published at every user count and for extra SSO.
• Free tier: how many users the free plan includes, and whether free projects pause.
• Price at 10,000 users: the cheapest paid self-serve plan at that size.
• Enterprise SSO: where SAML/OIDC SSO starts, and what five enterprise connections add to the bill.
• Compliance documents: the vendor's own SOC 2 Type II, ISO 27001, a HIPAA BAA, an EU hosting region.
• Security on self-serve plans: MFA, passkeys, bot protection, breached-password checks and brute-force protection, by plan.

Vendors count users differently — monthly active users for some, monthly retained users for others — and each review says which. Each review also says which pages it was written from and when. Where we have run a product hands-on, the evidence is on its page.