Lucia
Lightweight TypeScript auth library. Library-not-framework, minimal opinions, BYO everything.
VISIT LUCIAKey takeaway: Reach for Lucia only if you want session primitives rather than an auth product. Bring your own database adapter, password hashing and every screen, and you get a small, readable, fully understood auth layer. If your timeline is tight or you want auth solved rather than composed, Better Auth or Auth.js will get you further faster.
Quick facts
- CategoryLibrary / OSS
- LanguageTypeScript
- PricingOpen source
- LicenseMIT
- Created2021
- GitHub stars9.7k
- HIPAA-eligibleNo
- SSO / SAMLLimited / paid
What it is
Lucia is the lightweight library-not-framework alternative. Session-based auth primitives, BYO database adapter, BYO password hashing, BYO UI. The opposite of Clerk in design philosophy, minimal opinions, maximum flexibility, much smaller surface area.
Best for
- Teams that want auth as a library, not a service
- Apps with non-standard requirements (custom session shapes, custom hashing)
- TypeScript developers who prefer composing primitives
When not to pick it
Skip Lucia for teams that want auth solved as a product. Skip for projects with a tight timeline; you build a lot yourself.
My take
Lucia is the right pick when you want auth primitives, not an auth product. Smaller community than Auth.js, cleaner internals.
Minimal by intent
Lucia's philosophy is the inverse of Clerk's. It gives you session creation, validation and invalidation against a database adapter of your choosing, and then it stops. There is no provider registry, no plugin marketplace, no opinion about what a user record contains. The consequence is that you understand your entire authentication path, which is genuinely valuable when requirements are unusual: custom session shapes, sessions attached to something other than a user, a hashing scheme your compliance regime dictates, or a database the bigger libraries have no adapter for. It is also a good teaching tool. Reading Lucia and its accompanying guidance is one of the better ways to actually learn how session-based authentication works rather than treating it as magic. The trade is volume of work: OAuth flows, password reset, email verification and rate limiting are all yours to write.
Project direction and how to evaluate the risk
Lucia's community is smaller than Auth.js or Better Auth, and its maintainer has been openly reflective about the project's direction and scope, so read the current state of the repository before you adopt it. That is not a reason to panic. Small readable libraries fail more gracefully than large ones, and code you can read in an afternoon is code you can maintain yourself if you have to. But it does change the calculation: with Lucia you are partly betting on your own team to own the auth layer, rather than on an ecosystem to carry it for you. Ask honestly whether that is what you want. Teams who chose it for the philosophy and read the source are usually happy. Teams who chose it because it looked lightweight, then wanted organisation support, are the ones who end up migrating to Better Auth.
Frequently asked questions
Does Lucia handle OAuth and password reset for me?
No. Lucia focuses on sessions: creating, validating and invalidating them against your database. OAuth flows, password hashing, reset emails and verification are your responsibility, using separate libraries or your own code. That minimalism is deliberate and it is the whole reason to pick Lucia, but it means real work before you have a usable sign-in.
Lucia or Better Auth?
Better Auth for almost every product team: it gives you providers, organisations, MFA and passkeys without giving up your own database. Lucia when you specifically want to compose auth from primitives you fully understand, or when your requirements are unusual enough that a batteries-included library would spend all its time fighting you.
Is Lucia still maintained?
It is a small project with a small community, and its scope and direction have been openly discussed by its maintainer, so check the current state of the repository before adopting it. The mitigating factor is size: the codebase is small enough that a competent team could maintain a fork if it came to that, which is not true of larger alternatives.
Links
Compare Lucia side-by-side
Similar tools you should also consider
If Lucia is your pick, the next conversation is short
The 30-min call is where your auth choice becomes a real architecture, a migration plan if you are switching, and a price range you can take to your stakeholders. Describe your stack, your scale, your compliance constraints. I tell you whether Lucia is genuinely your fit.