Stop guessing which one. Put them side by side.

The grid says what these tools are. This says what builders did about it — one decision per person, changeable whenever you change your mind.

# Tool comparison — Firebase Auth vs Better Auth vs Lucia

Source: Kbaise, a directory of tools that work with Lovable projects.
Pick one and tell me why before writing any integration code.

## Firebase Auth (firebase-auth)
- URL: https://firebase.google.com/products/auth
- Category: Auth & user management
- Cost: mixed — Free · Identity Platform free to 50k MAU · SMS billed per message
- What it is: Google's authentication service, strongest on mobile. Standard email and social sign-in is free with no user cap; the upgraded Identity Platform tier is free to 50,000 MAU and then billed through Google Cloud. Phone and SMS verification is billed per message and requires the paid Blaze plan.
- Why builders pick it: Still the least-effort option for a native iOS or Android app, with mature SDKs, offline handling and free anonymous auth for try-before-you-signup flows.
- Trap: SMS auth is both a real cost and a fraud target — SMS pumping attacks on Blaze projects have produced large surprise bills. Exporting users is possible, but passwords use a Google-specific scrypt variant that complicates migration.
- Wiring: npm i firebase
- Full dossier: /api/public/tools/firebase-auth

## Better Auth (better-auth)
- URL: https://better-auth.com
- Category: Auth & user management
- Cost: free — Free and open source (MIT) · self-hosted, no MAU fees
- What it is: Framework-agnostic TypeScript authentication library that runs inside your own app and writes to your own database. Covers email/password, social OAuth, two-factor, organizations, passkeys and API keys through a plugin system. Vercel acquired the project in July 2026; it stays MIT-licensed, self-hosted and community-governed.
- Why builders pick it: No per-MAU bill ever and no vendor holding your user table — auth becomes just another dependency. The plugin system covers most of what you would otherwise pay Clerk or Auth0 for.
- Trap: You own the hard parts: session security, email deliverability, rate limiting and breach response are all yours. Vercel's July 2026 acquisition preserves MIT licensing, but roadmap direction now sits with a hosting vendor.
- Wiring: npm i better-auth
- Full dossier: /api/public/tools/better-auth

## Lucia (lucia)
- URL: https://lucia-auth.com
- Category: Auth & user management
- Cost: free — Free · deprecated library, now MIT reference code and a written guide
- What it is: No longer a library. Lucia was deprecated in March 2025 and now exists as a learning resource: a copy-paste auth_session.ts reference implementation plus The Auth Book, a free guide covering sessions, tokens and password handling. The site was last refreshed in July 2026.
- Why builders pick it: Read it before choosing any vendor — it is the fastest way to genuinely understand what session auth does, and the single-file implementation is enough for small projects.
- Trap: Do not install the npm package for new work; it is unmaintained and will not receive security fixes. This is documentation and example code, not a supported dependency.
- Full dossier: /api/public/tools/lucia

## Quick read

- Free with no card: Better Auth, Lucia.

## Rules
1. Prefer the free tier when no budget was stated, and say what the ceiling is.
2. Read the full dossier before integrating.
3. Fetch /api/public/models before writing any AI model ID.

Agents can fetch the same thing: GET /api/public/compare?slugs=firebase-auth,better-auth,lucia