Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
For years the complaints about Cognito were consistent: a hosted UI that looked dated and could barely be styled, no passkeys, painful migrations in (you could not bring password hashes) and out, a single Region with no good answer for regional outages, and rough edges around machine-to-machine and federation. Many teams paid Auth0 or built their own to avoid it. Most of those reasons are now gone.
Cognito moved to three feature tiers. Lite keeps the basics at the lowest price. Essentials — the default for new user pools — adds managed login (a new, properly brandable hosted sign-in experience), passwordless sign-in with passkeys and email or SMS one-time codes, and access-token customisation. Plus adds threat protection: compromised-credential detection and adaptive authentication.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
From AWS What's New announcements, 2026.
Lite and Essentials: the first 10,000 monthly active users free. Essentials is $0.015 per MAU after that; Lite $0.0055, falling to $0.0046 above 100,000.
Plus: $0.020 per MAU, no free tier.
Users who sign in through SAML or OIDC federation: 50 free, then $0.015 per MAU.
Multi-Region replication: an extra $0.0045 per MAU per replica on Essentials, and 30% more on machine-to-machine token requests.
Replication keeps users, credentials, configuration and federation set-up in sync with a standby pool, and both Regions stay active. You decide when to fail over — with your own health checks and DNS — and during failover existing users sign in normally but new registrations and profile updates are unavailable. Lambda triggers, email and SMS sending, WAF rules and log streaming must be set up in the second Region yourself before you need them. It is a real answer to "what happens to sign-in if us-east-1 has a bad day", provided you rehearse it.
If you are on AWS and building a consumer or prosumer product, yes: Essentials with managed login and passkeys is a credible default, and password-hash import makes moving in a data job rather than a forced password reset. If you sell to enterprises and need self-service SSO configuration and SCIM, a B2B-focused provider still does more for you out of the box. Either way, keep your own user IDs as the primary key so the choice stays reversible.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Rolling Out Passkeys in 2026: A Practical Guide, Including the Decision You Cannot Undo
Passkeys are now supported by every major platform and can move between password managers. How to roll them out without locking anyone out: enrolment prompts, recovery, the relying-party ID you must choose correctly the first time, and what Cognito, Auth0 and the rest do for you.
Read
Migrating Authentication Providers Without Forcing Everyone to Reset Their Password
Moving from Auth0, Firebase, a home-grown system or anything else to Cognito or another provider: bulk import with password hashes (Cognito accepts bcrypt, scrypt, Argon2id and PBKDF2 since July 2026), lazy migration at sign-in, what cannot move, and a cut-over plan with a way back.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.