EAuth compared
The figures are from each provider's own pricing page or documentation, read on 28 September 2026; the link after every row is the page they came from. Prices change, so check the page before you decide. Why EAuth comes first; what it does not have yet is at the end.
To price your own setup, with the rule behind every figure, use the cost page.
Why EAuth
You do not want a bill that scales with success. The commercial providers are inexpensive until you grow, at which point the cost per user is a meaningful line item.
You sell to companies. Your second enterprise customer costs $75 a month at Clerk, $125 at WorkOS and Stytch beyond the fifth, and your sixth moves you to an Enterprise contract at Auth0. Here every organisation can bring its own IdP, and it is not a line on an invoice.
You want the option to self-host. One Go binary, PostgreSQL, Redis. The same code runs both hosted and on your own machine.
You want to be able to leave. The export contains password hashes, and it takes a click rather than a signature from a vice-president.
At a glance
| EAuth | Auth0 | Clerk | WorkOS | Zitadel | Supabase Auth | |
|---|---|---|---|---|---|---|
| Free user limit | none | 25,000 MAU | 50,000 MRU | 1,000,000 | 100 daily active | 50,000 MAU |
| Self-hostable | yes | no | no | no | yes | yes |
| MFA on the free plan | yes | no | yes | yes | yes | yes |
| Organisations | included | 5 free, 10 on paid plans | $100 a month add-on | included | included | build your own |
| Enterprise SAML | included, per organisation | 1 free; Enterprise above 5 | 1 included, then $75 each | $125 each | included | per SSO user |
| Custom domain | included | 1 included | included on Pro | $99 a month | Pro ($100) | $10 a month |
| Password hash export | self-service | support case with executive signature | self-service CSV | not documented | through the API | direct database access |
| Swiss region | yes, and the EEA | no | not stated | no | Google Cloud Zurich | AWS Zurich |
| Independent audit | no | SOC 2, ISO 27001 | SOC 2 | SOC 2 | ISO 27001, SOC 2 | SOC 2 |
| Prebuilt UI components | not yet | yes | yes | yes | partial | partial |
Sources: Auth0, Clerk, WorkOS, Zitadel, Supabase.
Where the money goes
At most hosted providers the bill is not the users. It is the second enterprise customer, the organisations add-on and the custom domain. The table lists those lines as published; "contact sales" means the page gives no number.
| Provider | Base plan | Each enterprise SAML connection | Organisations | Custom domain | Where self-service ends |
|---|---|---|---|---|---|
| EAuth | $0 | included | included | included | it does not |
| Auth0 | Free; Essentials $35 for 500 MAU; Professional $240 | 1 free, 3 on Essentials, 5 on Professional | 5 free, 10 paid | 1 included | above 25,000 MAU or 5 connections: Enterprise, contact sales |
| Clerk | Pro $25 (50,000 MRU, then $0.02) | 1 included, then $75 a month each | $100 a month add-on | included | above 15 connections |
| WorkOS | AuthKit free to 1,000,000 users | $125 a month each (1 to 15), $100 (16 to 30) | included | $99 a month | Enterprise with 99.99 percent SLA |
| Stytch | free to 10,000 MAU | 5 included, then $125 each | included | branding removal $99 once | the per-user rate above 10,000 is not published |
| Logto | free to 50,000 MAU; Pro $24 | $48 a month each | $48 a month | $48 a month | Enterprise for a custom data region |
| Hanko | free to 10,000 MAU; Pro $29 + $0.01 per user above | $49 a month each | not listed | included | Enterprise |
| Descope | free to 7,500 MAU; Pro $249 (10,000 MAU, then $0.05) | 3 free, 5 on Pro, then $50 each | 10 free tenants, 35 on Pro | included | Growth $799 for EU residency |
| Kinde | free to 10,500 MAU; Plus $75 | 1 on Free and Pro, unlimited on Plus | 5, 50, unlimited | included | Scale $250 |
| Zitadel | free with 100 daily active users; Pro $100 | included | included | Pro | Enterprise for 99.99 percent |
| Supabase Auth | free to 50,000 MAU; Pro $25 | $0.015 per SSO user after 50 | not a feature | $10 a month | Team $599 |
Sources: Auth0, Clerk, WorkOS, Stytch, Logto, Hanko, Descope, Kinde, Zitadel, Supabase.
Two notes on the table. Auth0's B2B Professional price left the pricing page in November 2023 and is invoice-only since; a competitor cites $800 a month for 1,000 MAU, which we cannot verify. Zitadel's Pro plan states its included daily-active-user quota in a way we could not read unambiguously; ask them before relying on it.
Leaving
What it takes to get your users out, password hashes included, so nobody has to reset a password.
| Provider | Hash export | How |
|---|---|---|
| EAuth | yes | Self-service in the console, any time, argon2id and imported hashes in their original form. Migrating |
| Clerk | yes | CSV from the dashboard, for admins. Clerk docs |
| Supabase Auth | yes | Direct SQL access to auth.users. Supabase |
| Zitadel | yes | Through the API; self-hosted, it is your database. Zitadel |
| Auth0 | yes, by request | A support case with a 4096-bit PGP key, confirmation by a second administrator and a signed acknowledgment from a CISO or a vice-president; the link expires after three days. The self-service bulk export has no hashes. Auth0 docs |
| Amazon Cognito | no | Migration out runs through a Lambda trigger at each user's next sign-in. AWS docs |
| Keycloak, Authentik, FusionAuth, Logto, Hanko (self-hosted) | yes | Your database. |
| WorkOS, Stytch, Kinde, Descope | not documented | We found no export process on their pages; ask before you sign. |
Where your data is
| Provider | Region for a Swiss or EU customer | Legal entity |
|---|---|---|
| EAuth | Switzerland and the EU, at European hosting providers; mail sent by Resend, Inc. (US) from its EU region | Elchi Studios, a brand of Krauss Software, the sole proprietorship of Samuel Krauss, Oberägeri ZG, Swiss law |
| Zitadel | Switzerland (Google Cloud Zurich), EU, US, Australia, on every plan; data in transit not guaranteed to stay in region | CAOS AG, St. Gallen, with a San Francisco presence and US investors |
| Supabase | Zurich (AWS eu-central-2) and several EU regions | Supabase Inc., US |
| Hanko | Germany (AWS Frankfurt) only | Hanko GmbH, Kiel |
| Auth0 | US, EU, Australia, Japan; no Swiss region listed | Okta, US |
| Clerk, WorkOS, Stytch | US; WorkOS argues sign-in may run through the US while your data stays in the EU | US companies |
| Descope | EU residency from Growth ($799 a month) | US |
| Logto | custom data region on Enterprise | US |
| Kinde | choice of residency on every plan; regions not listed | Australia |
Sources: Zitadel, Supabase, Hanko, WorkOS, Descope, Logto, Kinde.
A US company answers to US law wherever the servers stand (the CLOUD Act); a Swiss region at a US cloud does not change that. EAuth is operated by Elchi Studios, a Swiss sole proprietorship, and runs at European hosting providers without a US parent. Its mail is the exception: Resend, Inc., a US company, sends the address confirmations, password resets and invitations from its EU region (Sub-processors). Whether that matters is your buyer's question, not ours to answer.
Availability
No provider in this list publishes its measured uptime. They publish service-level agreements: 99.5 percent at Zitadel by default, 99.99 on the enterprise plans of Clerk, WorkOS, Stytch, Ory and Hanko, with credits you claim within a deadline. Clerk publishes postmortems, including four days of intermittent sign-in failures in September 2025.
The hosted EAuth promises no availability. Every incident is on the status page at status.elchi.dev, which also publishes the measured availability. That is honest, and for some products it is also disqualifying.
Sources: Zitadel SLA, Clerk postmortem, September 2025.
What EAuth does not have yet
Prebuilt UI components. The SDKs for React, Svelte and Nuxt handle the whole sign-in flow; the button and the page around it are yours. Ready-made components are planned.
An independent audit. There has been no SOC 2 or ISO 27001 audit yet. What we publish instead, how passwords are stored, where every server stands and every outage at its real length, is on the security page.
Directory sync. SAML single sign-on works per organisation, with accounts created at the first sign-in. SCIM, which creates and removes accounts when the customer's directory changes, is planned.
An availability guarantee. The hosted EAuth publishes measured availability and promises none. Where that is required, self-host it: the same binary runs on your own machines.