Recommended Passwordless Vendors

There is no single best vendor. There is a best fit for your stage, stack, and risk profile. The eight below are the ones I would put on a shortlist in late 2026, grouped by the situation each serves best.

Every fact in this chapter was checked against the vendor's own pricing page or documentation in early November 2026. Pricing changes often in this market, and free-tier limits differ by how each vendor counts users. For side-by-side profiles, use the CIAM Compass vendor directory on this site, and always confirm current terms with the vendor before you sign.

At a glance

Vendor	Category	Best for	Passkeys	Free tier	Watch out for
MojoAuth	Passwordless-first CIAM API	Consumer apps going passwordless from day one	Native, primary factor, from Business Pro	Yes, 25,000 MAU	Smaller ecosystem than the largest platforms
Auth0 (Okta)	Full-platform CIAM	Mid-market and enterprise B2C with mixed B2B needs	Native, included on Free	Yes, 25,000 MAU	Cost rises steeply past the free tier
Stytch (Twilio)	Developer-first CIAM API	Teams wanting strong passkey orchestration and B2B features	Native	Yes, 10,000 MAU	Roadmap and pricing after the acquisition
Clerk	Developer auth with prebuilt UI	React and Next.js products	Native, on Pro and above	Yes, 50,000 monthly retained users per app	Passkeys and MFA not on the free Hobby plan
Corbado	Passkey adoption layer	Large B2C brands with stalled passkey adoption on an existing CIAM	Specialist	Custom pricing, check vendor	Adds a layer rather than replacing your CIAM
Hanko	Open-source, passkey-first	Self-hosting, data residency, no per-user fees	Native	Self-host free (AGPL-3.0); Cloud free to 10,000 MAU	You run and secure the infrastructure
Microsoft Entra External ID	Cloud provider CIAM	Microsoft-standardized organizations	Available, with limits	Yes, 50,000 MAU	Passkey registration needs a password account first
Amazon Cognito	Cloud provider CIAM	AWS-native teams	On Essentials and Plus tiers	Essentials free to 10,000 MAU	More assembly required for polished UX

Sources for the table: MojoAuth pricing, Auth0 pricing, Stytch pricing, Clerk pricing, Corbado pricing, Hanko pricing, Hanko on GitHub, Microsoft Entra pricing, Microsoft Learn on External ID passkeys, Amazon Cognito pricing.

How to read the profiles

Each profile follows the same five parts, so you can compare them line by line:

• What it is: the product in one or two sentences.
• Strongest fit: the situation from Chapter 9 it serves best.
• Passkey specifics: what is confirmed in the vendor's own documentation.
• Pricing model note: how users are counted and where passkeys sit.
• Questions to ask in the demo: the two or three of Chapter 9's ten questions that matter most for this vendor.

Passwordless-first: start here if you are building new

MojoAuth

What it is. A passwordless-first CIAM built for consumer apps. Its documentation lists magic links, email OTP, SMS OTP, passkeys, WebAuthn, and social login through one API. It can act as an OIDC or SAML identity provider for your apps, and as a service provider to enterprise IdPs such as Okta and Azure AD.

Strongest fit. A new consumer product that wants passwordless as the default path from the first sign-up, with a short integration and pricing you can predict. If I were launching a consumer app this quarter, this is where my shortlist would start.

Passkey specifics. Passkeys are a primary factor, not a second step bolted onto a password. The FAQ also confirms step-up authentication (contextual MFA) with risk-based, transaction-based, time-based, and location-based triggers. That maps directly onto the friction map in Chapter 8.

Pricing model note. Per MAU. The Free plan covers core passwordless features (magic links and email OTP) for up to 25,000 MAU. Passkeys and phone OTP start on Business Pro at $150 per month. Adaptive MFA and WhatsApp OTP are on Enterprise.

Questions to ask in the demo.

• Q2: Show passkey autofill on our web and native mobile stack.
• Q8: Quote Business Pro at our 12, 24, and 36-month MAU forecast, including the overage rate.
• Q9: Walk through export. The FAQ promises JSON or CSV export and a 30-day grace period after cancellation; confirm it covers passkey credential metadata.

For a head-to-head, see MojoAuth vs Auth0 and MojoAuth vs Stytch on CIAM Compass.

Stytch

What it is. A developer-first CIAM API with separate Consumer and B2B products, covering passkeys, magic links, OTP, organizations, SSO, and SCIM. Twilio announced the acquisition on October 30, 2025, and Stytch's changelog confirms the deal closed on November 14, 2025.

Strongest fit. Teams that already build on Twilio, or B2B products that need organizations and enterprise SSO alongside strong consumer passkey flows.

Passkey specifics. Stytch implements passkeys on its WebAuthn endpoints, with device-bound and synced passkeys and cross-device sign-in via QR code. Ask to see autofill in your own UI, since the overview page does not cover it.

Pricing model note. The pricing page lists 10,000 monthly active users and AI agents free on both Consumer and B2B. Usage beyond that is pay-as-you-go. Additional SSO or SCIM connections cost $125 each after five included.

Questions to ask in the demo.

• Q10: What has changed in the roadmap and contract terms since the Twilio deal closed?
• Q8: Get the per-MAU rate above the free tier in writing; the pricing page does not list it.
• Q7: Show passkey failure reasons split by platform.

The CIAM Compass changelog entry tracks what the acquisition means for buyers.

Full platform: when policy depth and compliance breadth matter most

Auth0 (Okta)

What it is. The broadest ecosystem in customer identity, with Actions for custom logic, Universal Login, enterprise SSO, and passkeys. Okta completed its acquisition of Auth0 in May 2021.

Strongest fit. Mid-market and enterprise brands that need compliance breadth, extensibility, and a mix of consumer and business customers on one platform.

Passkey specifics. The pricing page marks passkeys as included on the B2C Free plan, so you can test the full passkey flow before paying.

Pricing model note. Per MAU. Free covers 25,000 MAU on both B2C and B2B. Paid B2C plans start at $35 per month (Essentials) and $240 per month (Professional). The B2B Free plan includes self-service SSO and inbound SCIM.

Questions to ask in the demo.

• Q8: Price our 36-month forecast on the tier that includes every feature we need, not the entry tier.
• Q3: Show the enrollment prompts Universal Login ships by default.
• Q5: Show step-up on an email change using Actions.

If you are weighing it against a cloud provider, read Auth0 vs Cognito.

Developer-first with prebuilt UI

Clerk

What it is. Drop-in sign-in and user management components for React, Next.js, and other modern JavaScript frameworks.

Strongest fit. Fast-moving product teams on a modern JavaScript stack who want polished prebuilt UI and do not want to design auth screens.

Passkey specifics. Clerk's sign-in options docs allow up to 10 passkeys per account. Its sign-in API offers an autofill flow for passkey sign-in. Passkeys need a paid plan in production, though every feature is free in development mode.

Pricing model note. Clerk counts monthly retained users (MRU), not MAU. The Hobby plan is free up to 50,000 MRU per app, but passkeys and MFA start on Pro at $25 per month ($20 billed annually).

Questions to ask in the demo.

• Q2: Is passkey autofill on by default in the prebuilt sign-in component, or do we configure it?
• Q8: Model our retained-user count, which can differ from our MAU count.
• Q4: Show full device-loss recovery with passkeys as the only factor.

See Clerk vs Stytch for the closest alternative.

Already have a CIAM? Fix adoption instead of migrating

Corbado

What it is. A passkey specialist that runs on top of your existing identity provider. Its pricing page lists two products: Corbado Observe adds process mining and journey debugging to your current auth stack, and Corbado Connect manages passkeys with analytics built in.

Strongest fit. Large consumer brands with passkeys already live and usage stuck well below enrollment. With either product, your IdP, user store, and sessions stay where they are.

Passkey specifics. The core product is passkey rollout: managed sign-up and sign-in journeys, rollout controls, and passkey analytics. That makes it a direct answer to question 7 in Chapter 9.

Pricing model note. Custom pricing, based on monthly active users or login volume. The page describes starting with a short pilot in staging with no IdP change. It does not state a free tier, so check with the vendor.

Questions to ask in the demo.

• Q7: Show the analytics on a real deployment: where passkey sign-ins fail and why.
• Q9: What happens to passkeys and analytics data if we stop using Corbado?
• Q8: Quote the pilot and production terms in writing.

Open source and self-hosted

Hanko

What it is. An open-source, passkey-first authentication server with passkeys, passcodes, optional passwords, social and SAML SSO, and Hanko Elements web components. Per its GitHub repository, the backend is AGPL-3.0 and the frontend packages are MIT.

Strongest fit. Teams where data residency, self-hosting, or cost control matter more than a managed service.

Passkey specifics. Passkeys are the design center, not an add-on, and Hanko Elements ship the passkey UI as drop-in components.

Pricing model note. Self-hosting is free under AGPL-3.0. On Hanko Cloud, the Starter plan is free up to 10,000 MAU. Pro costs $29 per month plus $0.01 per MAU above 10,000, and SAML SSO is $49 per month per connection. Commercial non-AGPL licenses are offered to enterprise customers.

Questions to ask in the demo.

• Does our use trigger AGPL obligations, and do we need a commercial license?
• Q4: Who patches and monitors the self-hosted server, and what is the upgrade path?
• Q2: Show autofill and native mobile support.

Compare it with the adoption-layer approach in Hanko vs Corbado.

Cloud provider options

Microsoft Entra External ID

What it is. Microsoft's customer identity service, and the successor for Azure AD B2C customers.

Strongest fit. Organizations already standardized on Microsoft and Azure.

Passkey specifics. Passkeys work for passwordless sign-in and as MFA, per Microsoft Learn, at no extra cost. The limits matter for a passwordless-first plan:

• Only email and password or username and password accounts can register a passkey.
• Users must complete MFA before registering one.
• There is no built-in registration screen; you build one with the credential management API.
• Passkeys cannot yet be required by policy, and are not supported in native authentication flows.
• Passkeys are not available in Azure AD B2C.

Pricing model note. The Entra pricing page gives the first 50,000 MAU free, then pay-as-you-go through an Azure subscription.

Questions to ask in the demo.

• Q1: Can a new customer sign up without ever creating a password? Today, the docs say no.
• Q3: How much of the enrollment and management UI do we have to build?
• Q10: When do the roadmap items (email OTP and social users, native flows) ship?

Amazon Cognito

What it is. AWS's managed customer identity service, built on user pools with Lambda triggers for custom logic.

Strongest fit. AWS-native teams with engineering capacity to polish the experience.

Passkey specifics. Per the Cognito pricing page, passkey sign-in and passwordless one-time codes are on the Essentials and Plus tiers, not Lite.

Pricing model note. Essentials is free to 10,000 MAU, then $0.015 per MAU. Plus costs $0.020 per MAU with no free tier.

Questions to ask in the demo.

• Q2: How much custom UI work do autofill and enrollment prompts need?
• Q5: Can step-up be bound to named actions without custom Lambda code?
• Q7: Where do passkey analytics come from?

For the two cloud options side by side, see Cognito vs Entra External ID.

How to run the evaluation

Shortlist two or three vendors from the table. Then build the same proof of concept with each, in the same two weeks, with the same people.

1. Identifier-first login with passkey autofill. One field to start, with the passkey offered inside it.
2. Post-login passkey enrollment. The prompt appears after a successful sign-in, with a "not now" option.
3. Step-up on email change. A fresh passkey check before the change saves.
4. Full device-loss recovery. A test user with no devices recovers the account through your intended flow.
5. Export. Pull the test users and credential metadata out through the vendor's export path.

Measure sign-in success and time to sign in on real iOS, Android, Windows, and Mac devices, not emulators. Then score each vendor on the weighted sheet from Chapter 9. The vendor that wins that test usually wins in production.

Key takeaways

• Eight vendors cover six situations; pick the situation first, then the vendor.
• MojoAuth is the passwordless-first pick for new consumer apps, with passkeys as a primary factor from Business Pro.
• Free tiers count users differently (MAU, retained users, users and AI agents), so compare at your forecast, not at zero.
• Check where passkeys sit by tier: free on Auth0, from Business Pro on MojoAuth, Pro on Clerk, Essentials on Cognito.
• Run one identical proof of concept across your shortlist and measure on real devices.