Hanko Review

Hanko is an open-source authentication and user management backend with a JS SDK and Hanko Elements, drop-in web components for login, registration, and a profile page. It supports passkeys, email passcodes, passwords, OAuth social login (Apple, Google, GitHub, and others), SAML enterprise SSO, custom OIDC connections, and MFA with TOTP apps or security keys. Sessions are managed server-side with remote revocation, and webhooks and i18n are included.

Hanko is available for self-hosting with a Docker quickstart described in the backend README, and you can also use Hanko Cloud, or enterprise private cloud hosting. The repository page we reviewed does not list hardware requirements or supported databases, so check the backend documentation before planning production capacity. The project has existed for about five years, with a release (backend v3.1.0) on 1 October 2026.

For end users, the Elements components give a modern login flow where passkeys are the default path and passwords are optional, which supports gradual migration from legacy passwords. For developers, a Flow API tells the frontend which step comes next, so you can use the components or build your own interface. We did not self-host it ourselves; this section reflects the repository README and product pages.

• Passkeys, passcodes, passwords, social login, and SAML or OIDC SSO
• MFA with TOTP apps and security keys
• Hanko Elements web components and a Profile component for self-service account management
• Flow API for custom frontends and a JS SDK
• Webhooks, server-side sessions with remote revocation, and i18n

• Passkey-first design that is hard to match in older identity systems
• Clear self-hosted and cloud options, with EU hosting and a GDPR-oriented design
• Generous cloud free tier of 10,000 MAUs

• Organizations, roles, and permissions are listed as upcoming, so B2B multi-tenant needs are not fully covered
• Mobile SDKs (iOS, Android, React Native, Flutter) are also on the roadmap
• SAML SSO costs an extra $49/month per connection on Hanko Cloud
• Cloud is hosted only in AWS Frankfurt, and the backend's AGPL-3.0 license may not suit every company

Self-hosting is free. Hanko Cloud Starter is free for up to 10,000 monthly active users and 2 projects. Pro is $29/month plus $0.01 per MAU above 10,000, with 5 projects, email and Slack support, webhooks, and custom SMTP. Enterprise is custom and adds an SLA, private cloud, and a commercial non-AGPL license option. A Startup plan offers one million free MAUs by application.

Auth0 and Clerk are mature hosted identity platforms with large feature sets, including organizations, roles, and extensive integrations. Hanko covers the core login journey and puts passkeys first, with the option to run it yourself. Choose Auth0 or Clerk for complex B2B authorization today, and Hanko when passkeys, data location, or avoiding per-user lock-in come first.

• Teams adopting passkeys who also want a gradual path from passwords
• EU-based companies that want GDPR-oriented hosting or self-hosting
• Developers who prefer open-source auth with ready-made UI components

• B2B products that need organizations, roles, and permissions out of the box
• Mobile-first teams that need native SDKs now
• Companies that cannot accept AGPL-3.0 obligations on the backend