Better Auth vs Auth.js vs Supabase Auth: open-source authentication for a Next.js SaaS (2026)

Quick Answer

For a new Next.js SaaS in 2026, the strongest open-source authentication picks are Better Auth, Auth.js (formerly NextAuth), and Supabase Auth. Better Auth is the default when you want a TypeScript-native library that keeps users in your own Postgres with built-in multi-tenancy. Supabase Auth fits teams already on Supabase who want Row Level Security to carry part of their authorization. Auth.js still works for simple session-based sign-in, but since September 2025 it has been in security-patch-only maintenance under the Better Auth team, so it is rarely the pick for a greenfield build.

Three shelves in the gallery, three different answers to one question: where do your users actually live?

Better Auth, Auth.js, and Supabase Auth are the three open-source names I keep pinning back up whenever a founder asks what to bolt onto a fresh Next.js app. All three are self-hostable, all three read your Postgres, and all three will get a user logged in by Friday. The taste question is what happens after that: multi-tenancy, teams, SSO, and who owns the session table.

The one axis that decides it

Skip the feature bingo for a second. The choice really comes down to where your identity data sits.

• Library, in your app, your database. Better Auth and Auth.js both run inside your Next.js server and write to a table you own. No third service to page at 2am.
• Platform, next to your data. Supabase Auth is a piece of the wider Supabase platform. You get auth, Postgres, storage, and realtime as one managed thing, and your policies live in the database as Row Level Security.

If you already run Supabase, the platform answer is almost free. If you are assembling your own stack piece by piece, a library keeps the surface small. Everything below is downstream of that one call.

The three, up close

Better Auth: the 2026 default

Better Auth is the shelf most of the gallery traffic walks toward now. It is a TypeScript-first framework that runs inside your app and stores users in your own database, and it reached v1.6 in May 2026 with more than 900 contributors behind it. It works across Next.js, Nuxt, SvelteKit, Astro, Hono, and 20-plus other frameworks, so it is not a React-only bet.

What earns it the default slot for a SaaS specifically is what ships in the box: email and password, 34-plus social providers, passkeys, magic links, MFA, and JWT support, plus a plugin system (50-plus plugins) that covers the parts most auth libraries make you hand-roll. Multi-tenancy is first-class here, with teams, roles, and invitations built in, and SSO, SAML 2.0, and SCIM available for when you start selling to bigger logos. It is now backed by Vercel, which is a real durability signal for a project this young.

The honest cost: it is newer, so some plugins are still maturing, and the "everything is a plugin" model means you own the assembly. That freedom is the point, but it is not the hand-holding a hosted UI gives you.

Auth.js: the incumbent, now on maintenance

Auth.js, which most people still call NextAuth, is the library that got a generation of Next.js apps their first login screen. It is adapter-based, framework-flexible, and there is a Stack Overflow answer for every corner you can paint yourself into. For a small app that needs session-based OAuth sign-in and nothing fancy, it is still a perfectly reasonable, boring choice, and boring is a compliment in auth.

The reason it drops below Better Auth for new builds is not a bug, it is a roadmap. Since September 2025 the Better Auth team officially maintains Auth.js in security-patch-only mode, and Better Auth ships an official migration guide out of it. Translation: it is stable and safe, but it is not where new capability is landing. If you are starting today, you would be adopting the predecessor and the successor at the same time.

Supabase Auth: free if you are already there

Supabase Auth is the auth layer of the open-source Supabase platform. It is genuinely useful, but its value is conditional: it shines when you are already on Supabase and want Row Level Security in Postgres to do half of your authorization for you. Sign-in, social providers, and a managed users table come with the platform, and the Next.js integration through the JavaScript client is clean.

The trade is coupling. You are adopting a platform, not a library, and your identity model is now tied to how Supabase does things. That is a great deal if Supabase is already your database and storage. If it is not, pulling in the whole platform just for auth is a heavier decision than dropping in a library, and self-hosting the full Supabase stack is real operational work.

Side by side

Years and versions above reflect the state of each project as of August 2026.

How I would pick

• Greenfield Next.js SaaS, you want to own the user table: Better Auth. The built-in teams, roles, and SSO path save you the parts you would otherwise be bolting on for months.
• You are already all-in on Supabase: Supabase Auth. Do not add a second identity system next to a database that already has one.
• Small app, plain OAuth login, no multi-tenant future: Auth.js is fine, or start on Better Auth to skip the eventual migration.
• Legacy app on NextAuth: you do not have to move today, but plan the migration to Better Auth, since Auth.js is in maintenance and Better Auth is the maintained successor.

If you want the managed, ships-a-UI option (Clerk) weighed against these, that comparison lives in our broader Next.js auth roundup.

Where each one loses

No shelf is spotless, and pretending otherwise is how you end up with the wrong login screen in production.

• Better Auth loses on maturity-in-years. It is 2024-young, and if you need a battle-tested plugin that only the ten-year-old ecosystem has, you may hit a gap.
• Auth.js loses on momentum. Maintenance mode means the answer to "does it support X yet" is increasingly "no, and it will not."
• Supabase Auth loses on independence. It is the least portable of the three, and "just the auth" is not really on the menu; you take the platform.

Pick the trade you can live with, not the one that photographs best.