Auth0
The value is the network, the data or the infrastructure. Keep paying.
Hosted identity: sign-in, social and enterprise connections, multi-factor authentication and the rules around them, as a service your application redirects to.
Self-host an identity server. Do not write authentication from scratch. THE RULE - Never write your own session, password hashing and token logic. Use a reviewed implementation STACK - Keycloak, Ory or Logto, self-hosted, speaking OpenID Connect to your application WHAT TO CONFIGURE - Argon2id for password hashing, with sensible parameters - Refresh token rotation with reuse detection; a reused refresh token revokes the family - Short access tokens, long refresh tokens, both revocable WHAT YOU NOW OWN - Patching the identity server promptly, which is not optional - Breached password checking through the Have I Been Pwned k-anonymity API - Rate limiting on sign-in by account and by address BEFORE YOU START - If you need SAML for enterprise customers, price the effort honestly. It is where most of the fee goes Include the deployment, the token rotation settings and the breach check.
What you lose
- SAML and enterprise directory connections, which is what unlocks larger customers and is genuinely tedious
- Attack protection — credential stuffing detection, breached password checks, bot defence
- A security posture somebody else is accountable for
If you would rather not build
- Ory Hydra and Kratos, if you want components
The escape hatch
open source · no votes, no paid placement
Keycloak
$0A mature open identity server with OIDC, SAML and social connections.
keycloak/keycloakfree · open source
Logto
$0A modern self-hostable identity service with a usable admin console.
logto-io/logtofree · open source
Why this verdict
our own opinion · changed only by a person
26/100
Verdict no at 26. Self-hosting an identity server is legitimate; writing authentication is not. The enterprise connections are what the price really buys.
History
tracked since 10 Aug 2026 · nothing is ever overwritten
Questions about Auth0
answered from the record above
Is Auth0 free?
No — the plan we track is $35 a month. Essentials from around $35/month billed monthly for 500 monthly active users, rising steeply with usage.
Can you replace Auth0 by building your own?
KEEP IT. The value is the network, the data or the infrastructure. Keep paying. Replacement score 26 out of 100, build time longer than it saves. Read what you lose before you decide.
How much does Auth0 cost?
$35 a month on Essentials — $420 a year. Recorded 10 Aug 2026.
What do you lose by replacing Auth0?
SAML and enterprise directory connections, which is what unlocks larger customers and is genuinely tedious; Attack protection — credential stuffing detection, breached password checks, bot defence; A security posture somebody else is accountable for. If any of those carry weight for you, keep paying.
Is there an open-source alternative to Auth0?
Yes: Keycloak, Logto. The prompt on this page is for when you want it your way instead.
Related entries
same category first, most replaced first
Headway
iLovePDF
HoppscotchEvery week, something stops being worth paying for.
New verdicts, prices that moved, entries added. One email a week. Unsubscribe in one click.
free forever · no tracking pixel · every prompt stays free on the site