Hanko

Judgement

What it is

Complete system

What it does

An authentication server and web components for passkeys, passwords, OAuth, SAML SSO and MFA, as an open alternative to Auth0 or Clerk.

Adopt it when

You want passkey-first login with drop-in UI components and the option to self-host.

Watch out

AGPL license on the backend, and some enterprise features are reserved for Hanko Cloud.

Ready for

Usable

Runs as

Self-hosted server and cloud service

Built with

Go and TypeScript

How established

Established: started 4 years ago, latest release backend/v3.1.0.

What the license allows

Use inside your business is unrestricted. If you change it and let customers use it over the internet, you must publish your changes.

Judged on 2026-11-03 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Hanko → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Hanko

1. 1
   Better Auth better-auth

   The most comprehensive authentication framework

   Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.

   ★ 31k MIT TypeScript Active, pushed yesterday
2. 2
   Authelia authelia

   The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

   Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.

   ★ 29k Apache-2.0 Go Active, pushed today
3. 3
   Devise heartcombo

   Flexible authentication solution for Rails with Warden.

   Building block Production-ready You are building a Rails app with conventional email and password accounts.

   ★ 24k MIT Ruby Active, pushed 27 days ago
4. 4
   openGym DuarteSantos8

   Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

   Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

   ★ 19k AGPL-3.0 JavaScript Active, pushed today
5. 5
   Casdoor casdoor

   An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

   Complete system Production-ready You want a self-hosted SSO and user management server that is simpler to run than Keycloak.

   ★ 15k Apache-2.0 Go Active, pushed today
6. 6
   Django-allauth pennersr

   Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

   Building block Production-ready You build a Django site that needs user accounts and social or SSO login.

   ★ 10k MIT Python Active, pushed 3 days ago
7. 7
   Oauth2-server thephpleague

   A spec compliant, secure by default PHP OAuth 2.0 Server

   Building block Production-ready You need to issue OAuth tokens from a PHP application; Laravel Passport is built on it.

   ★ 6.7k MIT PHP Active, pushed 9 days ago
8. 8
   Next-auth nextauthjs

   Authentication for the Web.

   Building block Production-ready You maintain an existing Next.js app on NextAuth or need stateless sessions without a database.

   ★ 28k ISC TypeScript Slowing, pushed 3 months ago

Commercial authentication libraries and frameworks

1. 1
   Amazon Cognito Amazon Web Services

   Implement customer identity and access management (CIAM) that scales to millions of users with Amazon Cognito, fully managed authentication service.

   Building block Production-ready An application already on AWS needs cheap customer sign-in at scale.

   Commercial
2. 2
   Firebase Authentication Google

   Descubre Firebase, la plataforma de Google para el desarrollo de apps web y para dispositivos móviles que ayuda a los desarrolladores a compilar apps y juegos que les fascinarán a los usuarios.

   Building block Production-ready A mobile or web app built on Firebase needs simple sign-in quickly.

   Commercial
3. 3
   Clerk Clerk

   The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.

   Building block Production-ready A React or Next.js team wants polished sign-in and user management working in an afternoon.

   Commercial
4. 4
   WorkOS WorkOS

   Developer APIs/SDKs for Enterprise Ready features like Single Sign-On, Directory Sync, Audit Logging, and more. Get started for free.

   Building block Production-ready A B2B SaaS product needs to add SSO and SCIM for enterprise customers quickly.

   Commercial
5. 5
   Stytch Stytch

   APIs and SDKs to integrate authentication and security into your app.

   Building block Production-ready A product team wants passwordless or passkey login with device fingerprinting against fraud.

   Commercial