Stytch

ALMOST

A weekend of work, and real gaps remain.

Passwordless authentication as an API: magic links, one-time codes, passkeys and device fingerprinting, with fraud detection layered on top.

Promptfree, for everyone, and the only version there is

Build passwordless sign-in. It is smaller than it looks.

STACK
- Postgres, a mail provider, the SimpleWebAuthn library for passkeys

MAGIC LINKS
- A cryptographically random token, hashed in the database, single use, fifteen-minute expiry
- Consume inside a transaction so a link cannot be used twice
- Never put the raw token in a log or a referrer

THE PART THAT DECIDES SUCCESS
- Deliverability. A magic link in a spam folder is a locked-out user
- Use a transactional provider on a subdomain, with SPF, DKIM and DMARC set correctly
- Offer a one-time code as well as a link; some mail clients rewrite links and break them

PASSKEYS
- Use SimpleWebAuthn; do not implement WebAuthn yourself
- Always keep a second factor available, or a lost device is a lost account

Include the token flow, the mail setup and the passkey registration.

What you lose

Bot and fraud detection built on signals from many applications, which one application cannot reproduce
Passkey implementation across every platform quirk
Deliverability for magic links, which decides whether anyone can sign in at all

If you would rather not build

Your framework's own session handling plus a mail provider

The escape hatch

open source · no votes, no paid placement

SuperTokens

Self-hosted authentication with passwordless and session management.

supertokens/supertokens-corefree · open source

SimpleWebAuthn

Handles the WebAuthn ceremony correctly on both server and browser.

MasterKale/SimpleWebAuthnfree · open source

Why this verdict

our own opinion · changed only by a person

56/100

Verdict kinda at 56. Magic links are an evening; deliverability and the passkey edge cases are the weekend, and fraud detection is what you leave behind.

History

tracked since 10 Aug 2026 · nothing is ever overwritten

Interest · last 30 days

Nothing recorded yet. This chart fills in once the page has visitors, votes or prompt copies — it will not draw a flat line to look busy.

Questions about Stytch

answered from the record above

Is Stytch free?

No — the plan we track is $249 a month. From around $249/month billed monthly above the free tier, priced on monthly active users.

Can you replace Stytch by building your own?

ALMOST. A weekend of work, and real gaps remain. Replacement score 56 out of 100, build time a weekend. Read what you lose before you decide.

How much does Stytch cost?

$249 a month on Growth — $2,988 a year. Recorded 10 Aug 2026.

What do you lose by replacing Stytch?

Bot and fraud detection built on signals from many applications, which one application cannot reproduce; Passkey implementation across every platform quirk; Deliverability for magic links, which decides whether anyone can sign in at all. If any of those carry weight for you, keep paying.

Is there an open-source alternative to Stytch?

Yes: SuperTokens, SimpleWebAuthn. The prompt on this page is for when you want it your way instead.

Related entries

same category first, most replaced first

All 36 in Dev tools

Coming soon

Every week, something stops being worth paying for.

New verdicts, prices that moved, entries added. One email a week. Unsubscribe in one click.

free forever · no tracking pixel · every prompt stays free on the site