Updated October 26, 2026
· ~2 min read
Amazon Cognito was reorganised into three tiers in November 2024 (Lite, Essentials and Plus) with Essentials the default for new user pools: managed login pages, passwordless sign-in with passkeys and one-time codes, and access token customisation. Lite and Essentials include 10,000 monthly active users free; Essentials costs $0.015 per MAU above that, Lite $0.0055 for the first tier above the free allowance. Plus adds threat protection and has no free tier. Through 2026 Cognito closed more of the old gaps: multi-Region replication in June, importing users with bcrypt, scrypt, Argon2id or PBKDF2 password hashes in July, client-secret rotation, federation attribute triggers and machine-to-machine tokens without a user pool domain.
Keycloak, the CNCF identity project behind Red Hat's build of Keycloak, is the most common self-hosted alternative: free to run, endlessly configurable, and yours to operate.
At 50,000 monthly active users Cognito Essentials is about $600 a month; at 500,000 it is about $7,350. A highly available Keycloak on Kubernetes with a managed Postgres costs a few hundred dollars a month in infrastructure at either size — but add the engineering time to keep a security-critical service patched, upgraded and monitored, and the honest crossover for most teams sits somewhere in the hundreds of thousands of users, not the tens.
Question 1 of 2
Do you need identity flows Cognito cannot express, or must it run outside AWS?
Use Cognito when identity is a means to an end and your users number in the tens or low hundreds of thousands — the free 10,000 MAUs and the managed login cover most products, and nothing about it needs patching. Choose Keycloak when you need deep customisation of flows and themes, many tenants each with their own identity providers, an on-premises or multi-cloud deployment, or very large user counts where per-MAU pricing becomes significant — and when you are willing to operate a security-critical system yourself, including upgrades and its database.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.