Better Auth vs Clerk vs NextAuth: 5ms vs 67ms [2026]

September 8, 2026

22 min read

On July 7, 2026, Vercel announced it was acquiring Better Auth, the open-source TypeScript authentication library that a growing share of new Next.js projects now ship with by default. Founder Bereket Engida and the rest of the Better Auth core team joined Vercel to work on what the companies are calling Agent Auth, an identity layer built for AI agents rather than just human logins. The deal, confirmed by law firm Cleary Gottlieb and covered across developer press including Reddit’s r/webdev and Hacker News, landed at a moment when Better Auth’s growth was already accelerating — DevToolPicks counted roughly 28,000 GitHub stars in July 2026, a figure that climbed to roughly 29.9K within two months, alongside more than 4.6 million weekly npm downloads.

That timing matters, because it forces a question a lot of teams have been putting off: does Better Auth actually beat Clerk and NextAuth (now called Auth.js) for a production app in September 2026, or is this just acquisition-news hype? This comparison pulls version numbers, GitHub metrics, npm download counts, pricing tiers, and independent latency benchmarks for all three, then walks through a real migration path and a use-case-by-use-case verdict.

The stakes are higher than a typical library swap. Authentication sits underneath every other feature a product ships, so the choice made here determines how much engineering time gets spent on session handling, how a security incident gets triaged, and how much of the monthly infrastructure bill scales with user count rather than usage. Between a self-hosted open-source library, a fully managed SaaS platform, and a legacy incumbent that is quietly being folded into the newer option, the right answer genuinely depends on team size, budget, and how many frameworks a given product needs to support at once — which is exactly what the data below is built to sort out.

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Better Auth, Clerk, and NextAuth Actually Are

All three solve the same core problem — verifying who a user is and keeping them signed in — but they take structurally different approaches to where the code and the data live.

Better Auth: self-hosted, framework-agnostic TypeScript auth

Better Auth is an MIT-licensed authentication and authorization framework written in TypeScript. It runs entirely inside your own application and database rather than calling out to a third-party auth service. The core library ships with email/password auth, social sign-on, and plugin-based extensions for two-factor authentication, passkeys, magic links, single sign-on, SAML 2.0, SCIM directory sync, and organizations with role-based access control. Better Auth 1.6, which MakerKit documented as launching in May 2026, laid the groundwork before Better Auth 1.7, released August 17, 2026, added what the project’s blog post described as major improvements across OAuth and OpenID Connect, enterprise identity, MCP authorization, SCIM groups and role projections, unified identity, and device authorization — a release the team called one of its largest yet. The current GitHub release is 1.7.5, tagged September 2026, and the framework’s open-source core has remained free at $0/month throughout, per Better Auth’s own August 2026 pricing page.

Clerk: managed authentication as a service

Clerk is a hosted, proprietary SaaS platform that overhauled its underlying infrastructure with the Clerk Core 3 launch in March 2026, according to Clerk. Instead of running auth code and a user table inside your own stack, you install Clerk’s SDKs and drop-in UI components, and Clerk stores and manages the user and session data on its own infrastructure. That trade removes a category of engineering work — session security, password hashing, provider OAuth flows — in exchange for a recurring bill tied to Monthly Retained Users (MRU). Clerk ships React, Next.js, Remix, and Astro components, and added SvelteKit 3 support during the week of August 3-9, 2026, according to Clerk’s changelog digest for that period.

NextAuth / Auth.js: the open-source incumbent

NextAuth has been the default self-hosted auth library for Next.js apps for years. The project rebranded its framework-agnostic core as Auth.js, while the npm package most production Next.js apps still install is named next-auth. The stable next-auth package sits at version 4.24.14 (released April 14, 2026), while the newer Auth.js v5 core remains in beta, with 5.0.0-beta.32 published July 20, 2026. GitHub’s own “used by” counter lists roughly 481,000 repositories depending on the library. Notably, since the Vercel deal closed, Auth.js’s security maintenance has moved under the Better Auth team, which issued a joint security update for both projects in July 2026.

Better Auth vs Clerk vs NextAuth: Full Specs Comparison

The table below lines up the technical specifications that matter most when picking an auth layer for a production TypeScript app in late 2026.

Specification	Better Auth	Clerk	NextAuth / Auth.js
Latest version	1.7.5 (Sep 2026 on GitHub)	Frequent SDK releases; stack build v16.3.4 as of early Sep 2026	next-auth 4.24.14 (Apr 14, 2026); Auth.js v5 at 5.0.0-beta.32
License / model	MIT, open source, self-hosted	Proprietary, managed SaaS	MIT, open source, self-hosted
Owner / backer	Vercel (acquired Jul 7, 2026)	Clerk Inc., VC-backed	Auth.js team; security now under Better Auth’s team
GitHub stars	≈29.9K	No public core-SDK repo star count	≈28.3K-28.4K
Weekly npm downloads	≈4.6M-4.76M	Not publicly disclosed	≈3.17M (Snyk); some trackers cite ≈4.24M via direct npm API
Contributors	850+	Closed source, internal team	Large open community over years
Primary frameworks	Next.js, Nuxt, SvelteKit, Astro, Hono, 20+ others	React, Next.js, Remix, Astro, TanStack, SvelteKit (added Aug 2026)	Next.js (primary), SvelteKit via Auth.js core
Database adapters	Prisma, Drizzle, Kysely, MongoDB	None — Clerk owns the user store	Prisma, TypeORM (MySQL, Postgres, MSSQL, SQLite, MongoDB), custom
Social login providers	40+ (Google, GitHub, Apple, Discord, Microsoft, X, WeChat, and more)	20+	Wide OAuth provider list via community providers
2FA / MFA	Built-in TOTP plugin	Built-in TOTP, SMS, backup codes	Requires custom or third-party integration
Passkeys / WebAuthn	Built-in plugin	Built-in; can satisfy MFA alone since Jul 8, 2026	Not first-class; custom implementation needed
Organizations / multi-tenancy	Built-in plugin with RBAC and invites	Built-in with SCIM sync (added Apr 2026)	App-level only; no built-in Organizations product
Client bundle size (gzip)	≈162.2 KB main package; smaller with the /minimal build	Not published as a standalone client bundle metric	9.8 KB (Auth.js core) to 14.2 KB (NextAuth) in one 2026 benchmark
Auth check latency	Under 5ms (direct DB query, no network hop)	≈67ms p95 in a Next.js-specific benchmark; 80ms average / 350ms p99 in aggregated API monitoring	Comparable to Better Auth since it is also self-hosted
Pricing model	Free core (MIT); optional $20/mo Pro cloud dashboard	Free up to 50,000 MRU/app; $25/mo Pro, $300/mo Business	Free, no vendor billing at all

Two rows deserve a flag. Clerk’s own SDK repositories do not publish a single combined GitHub star count the way Better Auth and next-auth do, since Clerk’s core auth engine is closed source and only supporting docs/tooling repos are public. And on weekly downloads, figures for both Better Auth and next-auth vary by a few hundred thousand depending on whether the source is Snyk’s scraped snapshot or a direct npm registry API query taken on a different day — treat the numbers above as a late-August/early-September 2026 range rather than a single frozen figure.

Pricing: Free Core vs Metered SaaS

This is the sharpest divide between Clerk and the two open-source options. Clerk overhauled its pricing in February 2026, raising its free Hobby tier from the older 10,000 Monthly Active Users limit to 50,000 Monthly Retained Users per application, while setting Pro at $25/month billed monthly (or $20/month billed annually) and Business at $300/month billed monthly (or $250/month annually), per Clerk’s own pricing page — but every user past that free allotment (and every SSO connection) starts adding to a monthly bill, with Pro-tier overage priced at $0.02 per additional retained user past 50,000 as of February 2026. Better Auth and NextAuth/Auth.js are both MIT-licensed, so the library itself never bills per user — your only cost is whatever database and compute you already run, and Better Auth’s own optional Pro cloud dashboard still runs a flat $20/month as of August 2026.

Tier	Better Auth	Clerk	NextAuth / Auth.js
Free tier	Unlimited self-hosted use, $0	50,000 MRU/app, $0, no SSO included	Unlimited self-hosted use, $0
Entry paid tier	$20/month optional Pro cloud dashboard (audit logs, security detection)	$25/month (monthly billing) or $20/month (annual), 50,000 MRU included, $0.02 per additional MRU, 1 SSO connection	No paid tier exists
Team / business tier	Enterprise, custom pricing	$300/month (monthly) or $250/month (annual), 5 SSO connections	Not applicable
Enterprise	Custom pricing, negotiated	Custom pricing; HIPAA, SAML/SCIM, audit logs	Not applicable — self-managed compliance
Who pays for infrastructure	You (your database and hosting)	Included in Clerk’s subscription	You (your database and hosting)

The practical math: a consumer app with 200,000 monthly active users sits comfortably inside Better Auth’s or NextAuth’s free tier because the library itself never meters usage, while the same app on Clerk would land well into the Business tier’s per-MRU overage once past the 50,000-user free allotment. Conversely, a five-person B2B SaaS company with 300 total users and a hard requirement for SSO and SCIM out of the box may find Clerk’s $25 to $300 monthly range cheaper than the engineer-hours it would take to build SAML and SCIM support on top of Better Auth’s enterprise plugins in-house, even though those plugins exist and are free.

Cost Modeling: Three Real Scenarios

Pricing tables only tell part of the story, since the actual monthly bill depends entirely on user count, SSO requirements, and how much engineering time a team is willing to spend building features the SaaS option gives away for free. Running the numbers on three common scenarios makes the trade-off concrete.

Scenario 1: A solo-founder consumer app at 15,000 monthly active users. On Clerk, this stays entirely inside the free 50,000 MRU allotment, so the direct cost is $0 — the same as Better Auth or NextAuth, which never bill per user regardless of scale. At this size, the deciding factor is not price but engineering time: a solo founder with limited backend experience will likely ship faster on Clerk’s pre-built components, while a founder comfortable with TypeScript and a database schema will find Better Auth’s setup time comparable and end up with 2FA and passkeys already built in.

Scenario 2: A funded B2B SaaS company at 8,000 users needing SSO for three enterprise customers. Clerk’s Business tier at $300/month (or $250/month billed annually) covers five SSO connections out of the box, putting the annual cost at roughly $3,000 to $3,600. Building equivalent SAML/SSO and SCIM support on Better Auth’s enterprise plugins is free in licensing terms, but realistically consumes one to three weeks of a backend engineer’s time for the initial implementation plus ongoing maintenance — at a loaded engineering cost of $150-plus per hour, that easily exceeds a year of Clerk’s Business tier, which is why well-funded B2B teams on a deadline frequently choose Clerk even though the underlying library cost is not the largest line item.

Scenario 3: A high-growth consumer platform crossing 500,000 monthly active users. This is where the model inverts hardest. On Clerk’s per-MRU overage pricing of $0.02 per additional Monthly Retained User past the included allotment, 450,000 overage users alone would add roughly $9,000 per month, or upward of $100,000 annually, on top of the base subscription tier. Better Auth and NextAuth both remain $0 in licensing cost at any user count, with the only added expense being additional database read replicas or connection pooling to handle the higher query volume — typically a fraction of what the equivalent Clerk bill would run.

Framework and Language Support

Better Auth markets itself as framework-agnostic and lists Next.js, Nuxt, SvelteKit, Astro, and Hono among first-class integrations, with documentation claiming compatibility across 20-plus frameworks total, plus explicit confirmation of Next.js 16 support. Clerk covers React, Next.js, Remix, Astro, and TanStack-based apps out of the box, plus a dedicated mobile SDK, and closed a notable gap by shipping SvelteKit 3 support in early August 2026. NextAuth’s stable 4.x line remains tightly coupled to Next.js, while the newer Auth.js v5 core is explicitly framework-agnostic and adds native App Router support, edge runtime compatibility, and SvelteKit compatibility.

For teams standardizing on a single meta-framework, all three work. The differentiator shows up for teams running a mixed stack — a Next.js marketing site, a SvelteKit dashboard, and an Astro docs portal sharing one identity provider. Better Auth’s broader framework list and self-hosted model make that kind of cross-framework session sharing more straightforward than routing every framework through a SaaS API, while Clerk’s newly added SvelteKit support closes some of that gap for teams willing to pay per user across every property.

Database and Adapter Support

Because Better Auth and NextAuth both store session and user data in your own database, adapter support determines which databases and ORMs you can actually use.

Better Auth ships official adapters for Prisma, Drizzle, Kysely, and MongoDB, which in practice covers PostgreSQL, MySQL, and SQLite through Prisma or Drizzle, plus native MongoDB support. The docs recommend the smaller better-auth/minimal build when using Prisma, Drizzle, or MongoDB adapters, since it drops the bundled Kysely dependency and shrinks the client bundle.
NextAuth / Auth.js supports PostgreSQL, MySQL, MSSQL, SQLite, and MongoDB through its TypeORM adapter, with a separate Prisma adapter covering MySQL, PostgreSQL, and SQLite, plus historical support for FaunaDB and the ability to write fully custom adapters for anything else.
Clerk has no database adapter layer at all, because it is not a library that talks to your database — Clerk hosts its own user and session store, and your application database stays completely separate, connected only if you choose to mirror user records for your own business logic.

For teams already running Drizzle or Prisma in production, Better Auth slots in without introducing a second ORM, while NextAuth’s TypeORM-first adapter model can mean adding a dependency purely for auth if the rest of the app uses Prisma or Drizzle.

Built-In Features: 2FA, Passkeys, Magic Links, and Organizations

Feature completeness out of the box is where Better Auth and Clerk pull ahead of NextAuth/Auth.js most clearly.

Better Auth’s plugin system covers TOTP-based two-factor authentication, a dedicated passkeys/WebAuthn plugin (updated September 6, 2026 with an optional setting that signs a user in automatically after passkey registration), magic links, API keys, JWT issuance, and an organizations plugin with role-based access control, team invitations, and permissions. The 1.7 release in August 2026 layered on SSO, SAML 2.0, SCIM directory sync, and what the team calls unified identity and device authorization, aimed squarely at replicating enterprise-grade identity management without a SaaS bill.

Clerk’s feature set overlaps heavily: TOTP apps, SMS codes, and backup codes for MFA; passkeys that are strong enough to satisfy MFA requirements on their own for any Clerk instance created on or after July 8, 2026; magic links and SMS one-time passcodes; and an Organizations product with SCIM directory sync that Clerk added in April 2026. The difference is delivery — Clerk ships all of this as managed infrastructure and pre-built UI components, so a team can wire up organizations and SSO in an afternoon without writing session-handling code.

NextAuth and Auth.js remain comparatively bare-metal. Social login and JWT or database-backed sessions are core strengths, and magic-link patterns are well documented, but 2FA, passkeys, and a dedicated Organizations product are not first-class, built-in features the way they are in Better Auth or Clerk — teams typically bolt on a third-party TOTP library or a custom WebAuthn implementation if they need those capabilities.

Benchmarks: Bundle Size and Latency Across Three Sources

Three independently sourced 2026 benchmarks give a consistent picture: self-hosted auth checks are faster because they skip a network hop, but SaaS auth is not far behind for most real-world request budgets.

Source 1 — Next.js App Router auth-check benchmark (August 2026). A focused comparison measuring time from request to authenticated response inside a Next.js App Router app found Better Auth fastest because its checks are direct database queries with no external API call, typically completing in under 5ms in production. Clerk showed the highest latency in the same test due to its managed-API architecture, though the benchmark noted its 67ms p95 result was still acceptable for most applications.

Source 2 — aggregated Clerk API monitoring. Independent uptime and latency tracking for Clerk’s production API reported an average latency of 80ms, a p50 of 55ms, a p95 of 190ms, and a p99 of 350ms, alongside 99.95% observed uptime — broadly consistent with the “network hop adds real but bounded latency” conclusion from the Next.js-specific benchmark above.

Source 3 — NextAuth 5.0 vs Auth.js 5.0 setup and runtime benchmark. A separate 2026 benchmark comparing the stable NextAuth 5.0 branch against the newer Auth.js 5.0 core measured initial OAuth-plus-JWT setup time at 12 minutes 38 seconds for NextAuth versus 21 minutes 52 seconds for Auth.js, a p99 authentication latency at 10,000 requests per second of 142ms for NextAuth versus 116ms for Auth.js, and gzipped client bundle sizes of 14.2 KB for NextAuth versus 9.8 KB for Auth.js.

On bundle size specifically, Better Auth’s main package measures roughly 162.2 KB minified and gzipped on Bundlephobia — notably heavier than either NextAuth or Auth.js — though the project’s own performance documentation recommends the better-auth/minimal entry point paired with the Prisma, Drizzle, or MongoDB adapters to strip out the bundled Kysely dependency and reduce that footprint for latency-sensitive edge deployments.

Security Considerations

Self-hosted libraries put the patching burden on your team. Better Auth published a security update in June 2026 addressing vulnerabilities across packages including @better-auth/oauth-provider and @better-auth/sso, and Patchstack’s vulnerability database tracks disclosures for those same packages — a reminder that self-hosting means you are responsible for tracking and applying security releases the moment they ship, not whenever your next deploy happens to land.

One direct consequence of the Vercel acquisition is that Auth.js’s security maintenance has moved under the Better Auth team, which issued a coordinated security update covering both projects in July 2026. That consolidation is good news for teams still running legacy NextAuth in production, since it means the library is no longer relying on a smaller, separately resourced maintenance group.

Clerk’s security model shifts differently: rather than patch cadence, the relevant question is how much you trust a third party with your entire user credential store, and how tightly you can configure MFA policy. Clerk’s July 8, 2026 policy change — letting passkeys satisfy MFA requirements on their own for new instances — is a meaningful security posture shift that self-hosted teams running Better Auth’s own passkey plugin can replicate manually but do not get automatically the way Clerk customers do.

The Vercel Acquisition: What It Actually Changes

Vercel’s stated rationale, per its own announcement and Better Auth’s blog post titled “Better Auth is joining Vercel,” centers on what the companies call Agent Auth — giving AI agents their own verifiable identity rather than having every autonomous coding or workflow agent borrow a human user’s session token. That’s a distinct problem from traditional login flows, and it explains why an infrastructure company that does not otherwise sell authentication products bought an auth startup in 2026: as agentic tooling (Claude Code, Codex, and similar coding agents) increasingly makes API calls and database writes on a developer’s behalf, someone needs to answer “which agent did this, and what is it allowed to do.”

For existing Better Auth users, the practical short-term impact is minimal. Vercel and Better Auth have both stated the library remains open source, MIT-licensed, and framework-agnostic — not locked to Vercel’s hosting platform — and existing self-hosted applications do not need to migrate anything because of the deal itself. The financial terms of the acquisition were not disclosed in any of the coverage from Cleary Gottlieb, SaaSRise, or The Stack. What did change is resourcing: Better Auth’s core team, contributor base of 850-plus, and the newly consolidated Auth.js security maintenance now sit inside a company with Vercel’s engineering and infrastructure budget behind them, which is a meaningfully different trajectory than an independently funded two-year-old startup.

Real-World Examples and Adoption Patterns

Concrete usage data helps separate marketing claims from what teams are actually shipping with each tool.

Vercel’s Agent Auth acquisition rationale. Vercel explicitly bought Better Auth to build identity infrastructure for AI coding agents and autonomous workflows, not just human end users — a use case none of the other two tools currently address.
Next.js and Nuxt SaaS starter kits. Multiple open-source boilerplate galleries in 2026 list Better Auth integrations for Next.js SaaS templates, Nuxt SaaS starters, and Cloudflare Workers-based auth templates, alongside a documented Convex database integration — evidence it has become a default choice for greenfield TypeScript projects rather than a niche library.
481,000 GitHub repositories depending on next-auth. GitHub’s own dependency graph “used by” counter puts next-auth’s install base in the hundreds of thousands of repositories, underscoring how deeply embedded the legacy NextAuth package still is across the existing Next.js ecosystem, even as new projects increasingly start elsewhere.
Documented download growth for Better Auth. Developer tools review site StarSling documented Better Auth’s weekly npm downloads climbing from roughly 1.2 million to 3.3 million between February and mid-2026, months before the Vercel deal was even announced — a trajectory that suggests the acquisition followed organic adoption rather than manufacturing it.
Clerk’s SvelteKit 3 rollout. Clerk’s own changelog for the week of August 3-9, 2026 confirms SvelteKit 3 support shipped in production, a direct response to demand from teams that wanted Clerk’s managed model outside the React/Next.js ecosystem it originally targeted.

Migration Guide: Moving From NextAuth to Better Auth

Teams running legacy NextAuth 4.x who want Better Auth’s built-in 2FA, passkeys, and organizations without waiting on Auth.js v5 to leave beta typically follow this path.

Step 1: Install Better Auth alongside your existing ORM adapter

npm install better-auth
# Pick the adapter matching your existing ORM
npm install @better-auth/prisma-adapter
# or: @better-auth/drizzle-adapter, @better-auth/mongo-adapter

Step 2: Define your Better Auth server instance

import { betterAuth } from "better-auth";
import { prismaAdapter } from "@better-auth/prisma-adapter";
import { prisma } from "./db";

export const auth = betterAuth({
  database: prismaAdapter(prisma, { provider: "postgresql" }),
  emailAndPassword: { enabled: true },
  socialProviders: {
    google: {
      clientId: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
    },
  },
});

Step 3: Migrate your database schema

Better Auth’s user, session, and account tables do not share NextAuth’s schema field-for-field. Run Better Auth’s schema generator against a staging database, diff it against your existing NextAuth tables, and write a migration that copies user IDs, email addresses, and hashed credentials across rather than dropping and recreating the tables, so existing users are not forced to re-register.

Step 4: Replace session checks in middleware and server components

// Before (NextAuth)
import { getServerSession } from "next-auth";
const session = await getServerSession(authOptions);

// After (Better Auth)
import { auth } from "@/lib/auth";
const session = await auth.api.getSession({ headers: req.headers });

Step 5: Run both systems in parallel behind a feature flag

Route a small percentage of traffic through Better Auth’s session checks while NextAuth continues handling the rest, compare session validity and error rates for at least a full week of production traffic, then cut over fully once the two systems agree consistently. This staged rollout is the same pattern most teams use for a major dependency swap on a live application, and it applies just as well to replacing the auth layer underneath one.

Step 6: Add the plugins NextAuth never had

import { betterAuth } from "better-auth";
import { twoFactor, passkey, organization } from "better-auth/plugins";

export const auth = betterAuth({
  // ...existing config
  plugins: [twoFactor(), passkey(), organization()],
});

Only after the base session migration is stable and verified should teams layer on two-factor authentication, passkeys, or the organizations plugin — bundling a full auth-provider migration with new feature rollout in a single deploy is the most common cause of production incidents in this kind of change.

Common migration pitfalls

Skipping the password hash migration. NextAuth and Better Auth do not use identical password hashing schemes by default. Forcing every user to reset their password on cutover is the safest fallback if the hash formats cannot be verified as compatible during the schema migration in Step 3.
Forgetting OAuth callback URLs. Each social provider (Google, GitHub, and similar) has its callback URL registered against the old NextAuth route. Update every provider’s developer console with the new Better Auth callback path before cutting traffic over, not after.
Cutting over before session expiry testing. Users with an active NextAuth session cookie at the moment of cutover will be logged out unless the migration includes a session-bridging step. Testing this against a staging environment with real session cookies avoids a support-ticket spike on launch day.
Deploying plugins and the base migration together. As noted above, adding 2FA, passkeys, or organizations in the same release as the core session swap makes it far harder to isolate the root cause if something breaks in production.

Pros and Cons

Better Auth

Free and open source with no per-user billing at any scale
Built-in 2FA, passkeys, magic links, SSO, SAML, SCIM, and organizations without third-party add-ons
Fastest auth checks in the Next.js App Router benchmark, since there is no network hop to a third-party API
Now backed by Vercel’s engineering resources following the July 2026 acquisition
Larger client bundle than NextAuth or Auth.js at roughly 162.2 KB before trimming with the /minimal build
You own patching, uptime, and database operations — there is no managed SLA

Clerk

Fastest path to production for teams that do not want to write or operate auth infrastructure
Pre-built, polished UI components across React, Next.js, Remix, Astro, and now SvelteKit
Enterprise SSO and SCIM available without engineering it yourself
Billing scales with users — costs can climb quickly once past the 50,000 free MRU allotment
No database adapter model, since Clerk owns the user store rather than your own database
Higher measured latency (67ms to 350ms p99 depending on the benchmark) than a direct database query

NextAuth / Auth.js

Free, open source, and deeply embedded across roughly 481,000 GitHub repositories
Smallest client bundle of the three in benchmark testing, at 9.8 KB to 14.2 KB gzipped
Auth.js v5 core is framework-agnostic with native App Router and edge runtime support
No built-in 2FA, passkeys, or Organizations product — these require custom or third-party work
Auth.js v5 remains in beta as of September 2026, which gives some teams pause for production use
Security maintenance now shared with the Better Auth team, which is new as of mid-2026 and still building a track record

Use-Case Recommendations

Solo founders and indie hackers building a new SaaS product: Better Auth. Zero recurring cost, built-in 2FA and organizations, and a self-hosted model that avoids per-user billing while the product is still finding traction.
B2B teams that need enterprise SSO and SCIM shipped this quarter: Clerk. Paying $25 to $300 a month is usually cheaper than the engineering time required to build and maintain SAML/SCIM in-house on a tight deadline, even though Better Auth’s plugins offer the same capability for free.
Products building AI agent or MCP-driven workflows: Better Auth. It is the only one of the three with an explicit Agent Auth protocol under active development, backed directly by Vercel’s investment in agent identity.
Multi-framework shops running Next.js, Nuxt, and SvelteKit under one identity system: Better Auth, given its broader framework-agnostic adapter list, though Clerk’s newly added SvelteKit support narrows the gap for teams willing to pay per user across every property.
High-traffic consumer apps where auth-check latency directly affects page load: Better Auth or NextAuth/Auth.js, since both post sub-millisecond-to-low-single-digit-millisecond database query times versus Clerk’s 67ms-plus network round trip in the Next.js-specific benchmark.
Teams with no dedicated backend engineer who want a fully managed product: Clerk. The trade-off of higher long-term cost for near-zero auth-related DevOps is the entire value proposition.
Existing NextAuth 4.x apps not ready to migrate: Stay put. NextAuth 4.24.14 is stable, widely deployed, and now benefits indirectly from the Better Auth team’s security oversight of the broader Auth.js project — there is no urgent forcing function to migrate immediately.

The Verdict

The data points in one direction for new, self-hosted TypeScript projects in September 2026: Better Auth is the strongest default. It combines a free, MIT-licensed core with the feature completeness that used to require a paid SaaS — 2FA, passkeys, magic links, SSO, SCIM, and organizations are all built in — and its sub-5ms auth checks in the Next.js App Router benchmark beat both Clerk’s 67ms p95 and general expectations for a network-dependent service. The Vercel acquisition adds a resourcing tailwind that neither Clerk’s VC funding nor NextAuth’s community-driven maintenance model can fully match on its own.

That said, Better Auth’s advantage is not universal. Clerk remains the correct choice whenever a team’s real constraint is engineering time rather than cost — a well-funded B2B startup racing to close enterprise deals that require SSO and SCIM this month will usually come out ahead paying Clerk’s $25-to-$300 monthly tiers rather than diverting a backend engineer to implement and maintain the equivalent in Better Auth. And NextAuth 4.x remains a perfectly defensible choice for existing production apps with no acute need for passkeys or organizations, especially now that its security maintenance sits under the same team steering Better Auth forward. The honest framing: Better Auth wins on cost, feature completeness, and latency; Clerk wins on time-to-production for teams that can afford the bill; NextAuth wins on inertia for the 481,000-plus repositories that already depend on it.

Frequently Asked Questions

Is Better Auth actually free, or does the Vercel acquisition change that?

The core library stays MIT-licensed and free, and both Vercel and Better Auth have stated it remains open source and framework-agnostic after the acquisition. Better Auth also offers an optional hosted dashboard starting at $20/month for teams that want audit logs and security detection layered on top of their self-hosted instance, but that tier is opt-in, not required to use the library in production.

Does Clerk’s free tier actually cover 50,000 users now?

Yes, as of 2026 Clerk’s free/Hobby tier covers up to 50,000 Monthly Retained Users per application, up from the older 10,000 Monthly Active Users limit, though the free tier does not include SSO connections, which require the paid Pro or Business tiers.

Should I migrate an existing NextAuth 4.x app to Better Auth?

Only if you need a feature NextAuth lacks out of the box, such as built-in passkeys, 2FA, or organizations, or you want to consolidate onto a more actively resourced project following the Vercel acquisition. If your app has no immediate feature gap, NextAuth 4.24.14 remains stable and does not require an urgent migration.

What is Auth.js and how is it different from NextAuth?

Auth.js is the framework-agnostic rebrand of the NextAuth project’s core. The npm package next-auth (currently 4.24.14 stable) is what most production Next.js apps still install, while the newer Auth.js v5 core remains in beta as of September 2026, at version 5.0.0-beta.32, with support extending to SvelteKit and other frameworks beyond Next.js.

Which option is fastest for authentication checks?

In a Next.js App Router benchmark from August 2026, Better Auth measured under 5ms for auth checks because it queries your own database directly with no network hop. Clerk measured a 67ms p95 in the same test due to its managed-API architecture, while aggregated Clerk API monitoring separately reported an 80ms average and 350ms p99 across broader production traffic.

Does Better Auth support enterprise features like SAML and SCIM?

Yes. Better Auth 1.7, released August 17, 2026, added SSO, SAML 2.0, and SCIM directory sync alongside role projections and device authorization, putting its enterprise identity feature set close to parity with Clerk’s paid tiers, at no additional license cost beyond your own hosting.

What is Agent Auth and why did it drive Vercel’s acquisition?

Agent Auth is the identity protocol Vercel and Better Auth are building to give AI agents — coding assistants, autonomous workflow tools, and similar systems — their own verifiable identity separate from the human user’s session. As agentic tools increasingly make API calls and database writes on a developer’s behalf, Vercel’s stated goal is establishing which agent performed a given action and what permissions it should have, a problem neither Clerk nor NextAuth currently addresses directly.

Can I use Clerk and Better Auth together, or switch back and forth?

Running both simultaneously in production is possible during a staged migration — routing a percentage of traffic through each system behind a feature flag is the standard approach — but maintaining both long-term adds real complexity, since Clerk owns its own user store while Better Auth expects to own your database’s user table. Most teams treat this as a temporary migration state rather than a permanent architecture.

Does Better Auth work outside the Next.js ecosystem?

Yes. Better Auth is explicitly framework-agnostic and documents first-class integrations with Nuxt, SvelteKit, Astro, and the Hono server framework in addition to Next.js, with the project’s own materials claiming compatibility across 20 or more frameworks total. That breadth is one of the clearer differentiators versus NextAuth, whose stable 4.x branch remains tightly coupled to Next.js specifically.

How big is the client bundle size difference in practice?

In gzipped terms, one 2026 benchmark measured Auth.js’s core at 9.8 KB and NextAuth at 14.2 KB, both meaningfully smaller than Better Auth’s main package at roughly 162.2 KB minified and gzipped. For latency-sensitive edge deployments, Better Auth’s documentation recommends the trimmed better-auth/minimal entry point when pairing it with the Prisma, Drizzle, or MongoDB adapters, which removes the bundled Kysely dependency and narrows that gap considerably.

Related Coverage

Nadia Dubois

AI & Innovation Editor

Nadia Dubois is the AI & Innovation Editor at Tech Insider, where she tracks the rapid evolution of artificial intelligence, from foundation models to real-world enterprise deployment. She previously covered AI and startups for La Tribune and contributed to MIT Technology Review's European coverage. Nadia specializes in generative AI, AI regulation, and the intersection of technology and European industrial policy. She holds a dual degree in Computational Linguistics and Journalism from Sciences Po Paris.

View all articles