What Is Hanko and What Does It Do?

Hanko is an open-source authentication and user management platform for modern applications. It gives developers a way to add passkeys, multi-factor authentication (MFA), SSO, and other login methods to an app while keeping control over user data. It is positioned as a developer-friendly alternative to Auth0, Clerk, Firebase Auth, AWS Cognito, or Keycloak, and it supports moving between self-hosted and Hanko Cloud deployments without vendor lock-in.

What problem Hanko solves

Most apps need the same core auth capabilities: account creation, sign-in, session handling, and stronger security options like MFA. Building these from scratch is slow and easy to get wrong, while adopting a hosted auth provider can mean handing over user data and accepting long-term lock-in.

Hanko targets that trade-off. It provides ready-made authentication flows and a user management layer, but keeps the deployment model flexible. According to its site, it is "open source, privacy-first, and built to scale," with "full control over your data."

Core capabilities

Based on the product pages and interface examples, Hanko covers:

• Multiple login methods — password, passcode (a one-time code sent to email), and passkey (WebAuthn).
• MFA setup — users can protect accounts with security keys or an authenticator app, or skip the step.
• Account creation and sign-in — email-based registration, plus "Continue with Google" as a social option.
• User management — the platform handles users alongside authentication, not just login.
• SSO — listed among the supported methods in the product description.

The interface examples show these as discrete, composable steps. For instance, a "Select login method" screen offers Password, Passcode, and Passkey as separate actions, and an MFA screen offers Security Keys, Authenticator app, or Skip.

How it fits into an app

Hanko exposes authentication as flows that your frontend can call. The page evidence shows component-style markup where a button triggers an action, such as verifying a passcode:

<button onSubmit={() => flowstate.actions.verify_passcode.run({ code: passcode })}>
  Continue
</button>

This suggests the model: you render your own UI, and Hanko handles the underlying auth logic and state. That is different from a drop-in hosted login page — it gives you control over the look and feel while Hanko manages the security-critical parts.

Self-hosted vs. Hanko Cloud

Hanko's stated design allows you to "move between self-hosted and Hanko Cloud anytime." In practice this means:

The key claim is that neither choice traps you. If you start self-hosted and later want managed infrastructure, or the reverse, the platform is built to allow that switch.

Who Hanko is for

Hanko suits developers and teams who:

• Want passkeys, MFA, and SSO without building them from scratch.
• Care about data ownership and avoiding vendor lock-in.
• Prefer to control their own UI rather than use a fully hosted login page.
• Are evaluating Auth0, Clerk, Firebase Auth, AWS Cognito, or Keycloak as alternatives.

It is less relevant if you want a completely no-code auth solution or have no interest in managing any part of the authentication stack.

Trying it

The site offers a free trial with no credit card required, and a "Talk to us" option for teams that want to discuss their setup. Pricing details are available on the pricing page; the free-trial note does not by itself confirm what paid tiers include, so check that page for current terms.