Lucia
A TypeScript auth library that keeps you in full control of your users.
2026 verdict
Best self-hosted auth library for full control and zero per-MAU cost
Best for: Teams with strict data residency requirements, or engineers who want to own auth as a first-class internal system with no per-user cost
Not for: Teams who want auth shipped in an afternoon, or projects that need organizations and multi-tenancy out of the box
Overview
Lucia occupies a specific niche: teams that want to own their auth implementation without starting from scratch. It is not a managed service like Clerk or Auth0 — you host it yourself, your data stays in your database, and you write the code that Lucia helps you structure correctly.
The library handles session management, which is the part of auth that developers most often get wrong. It creates, validates, and invalidates sessions using a database adapter that connects to whatever database you are already using — Postgres, MySQL, SQLite, MongoDB. The session tokens are stored in your database.
What Lucia does not do is handle OAuth out of the box (you use the companion \`rctic\`library for that), provide pre-built UI components (you build those), or manage infrastructure. You are responsible for every piece of the implementation, and Lucia ensures the session management logic is correct and secure.
This model has significant advantages. Your user data lives in your own database — queryable with your ORM, joinable with your other tables, migratable however you want. There is no monthly active user cost. GDPR compliance is simpler because you control the data. There is no vendor to change pricing on you.
In 2026, Lucia is the right choice for teams with regulatory requirements preventing user data from living in third-party infrastructure, or engineering teams who prefer owning auth as a core competency.
Pros and cons
Pros
- +No MAU pricing — auth cost never scales with user growth
- +Data lives in your database — full control over user records
- +Framework and database agnostic
- +Simpler GDPR compliance — no third-party data processor
- +No vendor lock-in risk
Cons
- −No pre-built UI components — you design and build the auth screens
- −OAuth requires the separate `arctic` library
- −More implementation work than Clerk — budget at least 1–2 days
- −You are responsible for keeping auth logic secure and updated
Pricing in 2026
Open Source
Free
- ·MIT license
- ·Bring your own database
- ·Bring your own UI
- ·No MAU limits ever
Fully open source and free. You pay for your own database and hosting only.
View current pricing at Lucia →Tips for using Lucia in production
Use `arctic` for OAuth flows — it is maintained by the same team and works identically
Store session data in your primary database — Lucia adapters for Drizzle and Prisma are mature
Compare Lucia against alternatives
Alternatives to Lucia
editors pick
Clerk
The fastest way to add auth to a web app in 2026.
Auth0
Enterprise-grade identity with a decade of production track record.
editors pick
Supabase
Postgres with auth, storage, realtime, and an auto-generated API — all open source.
Last updated 2026-01-15 · Data sourced from official documentation and independent benchmarks