Better Auth vs Clerk (2026): Pricing, Lock-in, Which to Pick

Better Auth vs Clerk is the auth decision most Next.js and Expo teams actually face in 2026. Better Auth is an open-source library that keeps users in your database. Clerk is a hosted product that sells you finished UI and a dashboard, billed per retained user. This guide puts the two head to head with pricing checked against the official pages as of October 2026, then covers where NextAuth (Auth.js) and Supabase Auth still make sense.

Quotable definition: Better Auth is a self-hosted, MIT-licensed TypeScript auth framework you run inside your app. Clerk is managed authentication and user management delivered as a SaaS. Auth.js (NextAuth) is the older library now maintained by the Better Auth team. Supabase Auth is platform auth bundled with a Supabase project.

Better Auth vs Clerk: head-to-head (October 2026)

The table below compares what you get and what you pay. Every price comes from clerk.com/pricing and better-auth.com/pricing; feature claims link to official docs further down.

Sources: Clerk pricing, Better Auth pricing, better-auth on npm, Clerk Expo quickstart, Better Auth installation (Workers flags), Clerk backend SDK.

The pattern is consistent: Clerk charges for convenience and for the features that make auth production-grade (MFA, passkeys, SSO, larger orgs). Better Auth gives you those features as code, and the cost shows up as engineering time instead of an invoice.

What Clerk costs at 10k, 50k and 100k MAU

Clerk does not bill classic MAU. A Monthly Retained User is someone who comes back at least one day after signing up, so a signup that never returns is never billed ("First Day Free"). Your MRU count will be at or below your MAU, which makes the numbers below a ceiling, not a floor.

Volume tiers as published: 50,001 to 100,000 MRU at $0.02 each, 100,001 to 1,000,000 at $0.018, then $0.015 and $0.012 above that. Going over 50k on Hobby gives you a one-month grace period before you must upgrade (Clerk pricing FAQ).

Add-ons stack on top of those figures:

• Enhanced B2B Authentication: $100/mo ($85 annual) once you need more than 20 members per org, custom roles, or verified domains. Retained orgs past 100 cost $1/mo each.
• Enhanced Administration: $100/mo for unlimited user impersonation (5 per month are free).
• Extra SSO connections: $75/mo each after the first one on Pro.
• Business plan: $300/mo if procurement needs Clerk's SOC 2 report.

Two things comparison posts often get wrong. First, Clerk at 100k retained users is about $1,025/mo on list price, not $2,000. Second, the free tier is not the whole story: if your product needs MFA or passkeys on day one, your real Clerk floor is $25/mo at any user count.

Is Better Auth free?

The library is. Better Auth is MIT-licensed and has no per-user pricing. The team also sells optional Infrastructure that connects to your self-hosted instance: a dashboard for users, sessions, and orgs, audit logs, threat detection ("Sentinel"), transactional email and SMS, and self-service SSO. Starter is $0, Pro is $20/mo with metered overages (audit log events, security detections, $0.001 per email, $0.09 per SMS), and Enterprise is custom (Better Auth pricing). None of those meters is a user count.

What you pay instead is your database and your time. As one concrete reference point, Supabase lists a database-only Pro project on Micro compute at $25/mo before usage overages (Supabase pricing). You also own the ops work Clerk would otherwise do: email deliverability, rate limits, abuse handling, migrations, and monitoring.

Better Auth 2FA, TOTP and passkeys

This is the clearest feature gap between the two on cost. Clerk keeps MFA and passkeys behind Pro. In Better Auth they are plugins you add in a few lines.

The two-factor plugin supports TOTP (authenticator apps like Google Authenticator, 1Password, or Bitwarden), OTP codes sent by email or SMS through your own sender, backup codes, and trusted devices. The passkey plugin adds WebAuthn sign-in, built on SimpleWebAuthn.

import { betterAuth } from "better-auth";
import { twoFactor } from "better-auth/plugins";
import { passkey } from "@better-auth/passkey";

export const auth = betterAuth({
  appName: "My App", // used as the TOTP issuer
  plugins: [twoFactor(), passkey()],
});

import { createAuthClient } from "better-auth/react";
import { twoFactorClient } from "better-auth/client/plugins";
import { passkeyClient } from "@better-auth/passkey/client";

export const authClient = createAuthClient({
  plugins: [twoFactorClient(), passkeyClient()],
});

// returns a totpURI for the QR code plus backup codes
await authClient.twoFactor.enable({ password, method: "totp" });

Then run npx auth migrate (or npx auth generate for Drizzle/Prisma schemas) to add the tables. Practical details from the docs that bite people:

1. Enabling TOTP is a two-step flow. 2FA only becomes active after the user verifies a first code from their app.
2. Passwordless users are blocked by default. Users who signed up with OAuth, passkeys, or magic links cannot enable 2FA unless you set allowPasswordless: true.
3. OTP needs a sender. The otp method requires you to implement otpOptions.sendOTP with your email or SMS provider.
4. Show backup codes once and make users save them. They are the recovery path when a phone is lost.

TurboStarter ships this already wired on web and mobile, including the QR enrollment screen, the sign-in challenge, and backup codes. See web 2FA docs and the auth overview for passkeys, magic links, OTP, and anonymous sign-in.

Better Auth with Expo

Better Auth supports Expo native and web through the @better-auth/expo integration. The current guide targets Expo SDK 55 (New Architecture only). You add a server plugin, a client plugin, and your app scheme as a trusted origin:

import { betterAuth } from "better-auth";
import { expo } from "@better-auth/expo";

export const auth = betterAuth({
  plugins: [expo()],
  trustedOrigins: ["myapp://"],
});

import { createAuthClient } from "better-auth/react";
import { expoClient } from "@better-auth/expo/client";
import * as SecureStore from "expo-secure-store";

export const authClient = createAuthClient({
  baseURL: "https://api.example.com",
  plugins: [
    expoClient({
      scheme: "myapp",
      storagePrefix: "myapp",
      storage: SecureStore,
    }),
  ],
});

What to know before you ship:

• Sessions live in SecureStore. The client caches the session there, so reloads do not flash a loading spinner. Calls to your own API need the cookie from authClient.getCookie() in the headers.
• OAuth returns through deep links. Social sign-in opens the system browser and comes back on your scheme. Native Google, Apple, and Facebook sign-in can pass an idToken instead.
• Dev builds use exp://. Allow exp:// patterns in trustedOrigins only in development.
• Passkeys on Expo: if you rename the passkey challenge cookie, add its prefix to the Expo client's cookiePrefix, or the flow fails.

Clerk's Expo story is smoother if you want prebuilt UI: @clerk/expo offers hosted auth that works in Expo Go, or native components that need a dev build. Biometric sign-in for native apps is a Pro feature.

One Better Auth backend can serve Next.js and Expo from the same tables. That is how TurboStarter's mobile app works, with mobile auth and mobile 2FA sharing the web app's sessions. If you want that setup ready-made, see the Expo Better Auth template or the React Native Better Auth starter kit.

Lock-in and migration: leaving Clerk later

Lock-in is the part you pay for later. Clerk lets you export user data from the dashboard on every plan. Better Auth publishes an official Clerk migration guide that imports users, bcrypt password hashes (by switching Better Auth's hasher to bcrypt), social accounts, phone numbers, and TOTP secrets.

The costs are real, though:

• Every active session is invalidated. All users sign in again.
• Organizations are not covered by the official script. You map them to the organization plugin yourself.
• UI, middleware, and webhooks all get rewritten.

If you might end up on Better Auth anyway, starting there is cheaper than migrating at 80k users. Our Clerk to Better Auth migration guide walks through the full cutover, including mobile clients.

Where NextAuth and Supabase Auth fit

Better Auth vs Clerk is the main fork. The other two names still matter in specific situations.

Sources: Supabase pricing, Auth.js migration guide.

NextAuth / Auth.js: keep it if it works

On September 22, 2025, Auth.js (formerly NextAuth.js) moved under the Better Auth team (announcement). Auth.js is not deleted or formally deprecated. The team keeps shipping security patches and fixes for urgent issues, and the official Auth.js docs say there is no urgent need to migrate a working app. For new projects, they strongly recommend Better Auth, and the migration guide notes Better Auth now supports stateless sessions without a database, which was the main gap.

Supabase Auth: right when Supabase is the platform

Supabase Auth stores users in your project's Postgres auth schema and issues JWTs that your Row Level Security policies can read. If RLS is your authorization model, that integration is the reason to pick it. On cost it beats Clerk at scale: 100k MAU fits inside the $25/mo Pro plan, and 250k MAU adds 150,000 × $0.00325 = $487.50 (Supabase pricing). Organizations and tenancy are still your schema and your policies.

You can also use Supabase only as a Postgres host and keep Better Auth as the identity layer. That is how TurboStarter connects to it: see connect TurboStarter to Supabase.

Decision rules: which auth should you pick?

Go in order and stop at the first yes.

How TurboStarter uses Better Auth

TurboStarter standardizes on Better Auth across its kits because one library covers web, mobile, and edge without a per-user bill. Core Kit wires email and password, magic links, OTP, passkeys, anonymous sign-in, OAuth, 2FA, and organizations with RBAC in a shared package used by the Next.js app and the Expo app. The Next.js Better Auth template shows the web side, and Better Auth UI for Next.js covers the screens if you are building them yourself. Edge Kit runs the same library on TanStack Start and Cloudflare Workers with D1 (see Edge Kit auth).

Clerk is still the faster path if you need a polished login page today and do not need MFA, mobile, or scale yet. We just would not start a product we expect to grow there.

Common mistakes when comparing Better Auth and Clerk

1. Quoting the old 10k MAU free tier. Clerk's Hobby and Pro plans include 50,000 retained users per app.
2. Assuming Clerk's free tier covers MFA. MFA, passkeys, and native biometrics are Pro features.
3. Overstating Clerk's scale cost. 100k retained users is about $1,025/mo on list price before add-ons.
4. Calling Better Auth zero-cost. The library is free, but you pay for the database, email, SMS, and the ops work.
5. Comparing "Clerk in 15 minutes" to "raw Better Auth with no screens." Budget for UI or start from a kit.
6. Ignoring migration cost. Moving off Clerk logs every user out and leaves orgs to you.

Frequently asked questions

Final verdict: Better Auth vs Clerk

Better Auth vs Clerk comes down to who owns the user table and who pays for growth. As of October 2026, Clerk is free up to 50k retained users but charges $25/mo the moment you need MFA or passkeys and about $1,025/mo at 100k. Better Auth gives you 2FA, passkeys, organizations, SSO, and Expo support as free plugins in your own database, and you take on the ops.

• Choose Better Auth for new TypeScript SaaS, B2B apps with orgs, and anything with a mobile client.
• Choose Clerk when prebuilt UI and a hosted dashboard are worth MRU pricing and a future migration.
• Choose Supabase Auth when Supabase and RLS are already your backend.
• Keep NextAuth / Auth.js while it works, and start new projects on Better Auth.

If auth is one blocker among billing, orgs, and admin, start from the Next.js Better Auth template or TurboStarter and ship with production auth already configured.