Auth.js, which many developers still know as NextAuth.js, and Better Auth both add sign-in to a TypeScript web app, and both keep your users in your own database. Since September 2025, the same team looks after both. So which one should you use? This guide compares them side by side and gives a clear answer for new and existing projects.
The short answer: start new projects with Better Auth, as the team that maintains both recommends. If you already have an Auth.js app that works, it keeps getting security fixes, and you can move it to Better Auth later with the official migration guide.
What Is Auth.js?
Auth.js is an open-source authentication library, formerly known as NextAuth.js. Its documentation describes it as “a runtime agnostic library based on standard Web APIs”. Its Next.js package is still called next-auth, and the packages for other frameworks use the @auth name.
Its documentation lists four ways to sign users in:
- OAuth, with providers such as GitHub and Google
- magic links, sent by email
- credentials, such as a username and a password
- WebAuthn, which covers passkeys
By default, Auth.js keeps each session in an encrypted JWT inside a cookie, so it doesn’t need a database for sessions. With a database adapter, it can store sessions in your database instead.
For passwords, the Credentials provider passes what the user typed to an authorize function that you write. Auth.js doesn’t hash or store passwords for you, and its documentation recommends OAuth, magic links or passkeys where possible.
On npm, the newest stable next-auth is 4.24.15. Version 5, which the Auth.js documentation describes, is still published as a beta.
What Is Better Auth?
Better Auth is an open-source authentication framework for TypeScript. It has email and password sign-in built in, with password hashing, email verification and password reset, and it stores sessions in your database. Social sign-in is built in too, and plugins add two-factor authentication, passkeys, magic links, organizations, admin tools, API keys and single sign-on. Part 1 of the Better Auth Tutorial explains how it works.
Auth.js Is Now Part of Better Auth
On 22 September 2025, the Better Auth team announced that it now maintains and oversees Auth.js. Existing Auth.js users can carry on without disruption: the team said it will keep addressing security patches and urgent issues.
For new projects, the announcement is direct: the team strongly recommends starting with Better Auth, unless a project depends on a specific feature Better Auth doesn’t have. The gap it named at the time was sessions without a database. Better Auth’s documentation now describes a stateless mode without a database, although most of its plugins need one.
Better Auth vs Auth.js at a Glance
| Better Auth | Auth.js | |
|---|---|---|
| Email and password | Built in, with password hashing, email verification and password reset | Credentials provider: your own authorize code checks the password |
| Social sign-in | Built in, with many providers | Built in, with many OAuth providers |
| Passkeys | Passkey plugin | WebAuthn provider |
| Sessions | Stored in your database, with an optional cookie cache | Encrypted JWT cookie by default, or the database with an adapter |
| Frameworks | Next.js, Nuxt, SvelteKit, Astro, Hono, Express and more | Next.js, Qwik, SvelteKit, Express and more |
| Licence | MIT | ISC |
| Maintained by | The Better Auth team | The Better Auth team, since September 2025 |
| Newest stable release (13 November 2026) | 1.7.22 | next-auth 4.24.15; version 5 is a beta |
Which Should You Choose?
- A new project: choose Better Auth. It’s what the team behind both libraries recommends, and features such as email verification, two-factor authentication and organizations are already there when you need them.
- An Auth.js app that works today: keep it running. It still receives security fixes, so there’s no need to rush. Plan a move when you need something Better Auth gives you, such as two-factor authentication or organizations.
- Moving an existing app: follow the official guide, Migrating from Auth.js to Better Auth. Part 29 of the Better Auth Tutorial walks through a migration step by step.
FAQ
Is NextAuth.js the same as Auth.js?
Yes. Auth.js is the newer name of NextAuth.js, and its Next.js package is still called next-auth.
Is Auth.js shut down?
No. Existing apps can keep using it, and the Better Auth team keeps addressing security patches and urgent issues. For new projects, the same team recommends Better Auth.
Do both keep users in my own database?
Yes. Both are libraries that run inside your app, not hosted services. Better Auth stores users and sessions in your database. Auth.js stores users through a database adapter, and keeps sessions in a JWT cookie unless you choose database sessions.
Are they free?
Yes. Better Auth uses the MIT License, and next-auth uses the ISC License. Both are free for personal and commercial use.
Conclusion
Auth.js and Better Auth are both free libraries that run inside your app, and since September 2025 the Better Auth team maintains both. Auth.js covers OAuth, magic links, credentials and passkeys, and leaves password handling to your code. Better Auth handles passwords, email verification and sessions for you, and adds two-factor authentication, organizations and much more as plugins. For a new project, start with Better Auth.
Additional Resources
- Auth.js, the official website
- Getting Started in the Auth.js documentation
- Session Strategies in the Auth.js documentation
- Credentials in the Auth.js documentation
- Auth.js is now part of Better Auth, the announcement
- Better Auth documentation
- Migrating from Auth.js to Better Auth
Related
- Better Auth Tutorial — Part 1: What Is Better Auth?
- Better Auth vs Clerk: What’s the Difference?
- Is Better Auth Free? The Better Auth License Explained
Better Auth, Auth.js, Next.js and other names mentioned are trademarks of their respective owners. JD Bots isn’t affiliated with or endorsed by Better Auth, Inc. or Vercel.
Leave a Reply