Better Auth vs next-auth: 1.8x the Downloads, v5 Still Beta

8 min read · Last updated: October 24, 2026

Better Auth vs next-auth is no longer a close race. The first next-auth v5 beta reached npm on October 24, 2023, and v5 is still a beta today, while npm's latest tag points to v4.24.15. Better Auth, whose team has run Auth.js since September 2025, has out-downloaded next-auth on every day npm reported since August 7, 2026, at about 1.8x in October.

Came here from Instagram, LinkedIn, X or YouTube? Here is the full source list you came for. Everything below is built from these, nothing else.

The receipts (npm)

• next-auth daily downloads, July 25 to October 23, 2026 (npm API)
• better-auth daily downloads, July 25 to October 23, 2026 (npm API)
• next-auth release history and dist-tags (npm registry, read October 24, 2026)

The announcements

• Auth.js is now part of Better Auth, Better Auth blog, September 22, 2025
• Better Auth is joining Vercel, Better Auth blog, July 7, 2026

The docs

• Auth.js: Migrating to v5
• Better Auth: NextAuth migration guide
• Better Auth: Next.js integration
• Better Auth: Session management (stateless mode)

Key takeaways

• The first next-auth v5 beta, 5.0.0-beta.0, was published on October 24, 2023. The newest is 5.0.0-beta.32, from July 20, 2026. There is no stable v5.
• The last day next-auth beat Better Auth on npm was August 6, 2026, by under 5,000 downloads. Better Auth has won every reported day since.
• Across the 10 days npm reported between October 7 and 22, Better Auth had 20.2 million downloads to next-auth's 11.1 million: 1.83x.
• next-auth is not shrinking. Its Thursday downloads grew 54% from August 13 to October 22. Better Auth's grew 139%.
• Better Auth's team has maintained Auth.js since September 22, 2025, and recommends Better Auth for new projects. Better Auth itself joined Vercel on July 7, 2026.

What does a 3-year beta actually look like?

A 3-year beta looks like a renovation that never gets its final sign-off. The old building (v4) is still open and still gets repairs. The new wing (v5) has been open to visitors since 2023, many people already live in it, but it never got the certificate that says "finished".

Now add the twist. In 2025, the company that built the newer tower next door took over the old building. They kept fixing the pipes in both wings. They also put up a sign in the lobby that says, roughly, "moving in? Try next door."

That is next-auth in October 2026.

The Auth.js v5 docs still tell you to install it with the beta tag:

npm install next-auth@beta

And the top of that same docs page now carries a banner: "The Auth.js project is now part of Better Auth."

None of this means v5 is broken. A beta tag is a promise the maintainers have not made yet, not a bug report. But when you pick an auth library, that promise matters, because auth is the one dependency you really do not want to migrate twice.

How did next-auth v5 end up in beta for 3 years?

next-auth v5 stayed in beta because its release pace slowed while ownership changed hands. It shipped 33 beta versions in three years: 26 of them by October 2024, then long gaps, then a handover to the Better Auth team in September 2025. Here is the sequence, from the npm registry and the two announcements.

1. October 24, 2023. 5.0.0-beta.0 is published. Betas 1, 2 and 3 follow within three days.
2. November 2023 to October 2024. Steady work. By 5.0.0-beta.25 on October 19, 2024, v5 has had 26 releases in under a year.
3. October 2024 to April 2025. Six months with no beta. 5.0.0-beta.26 lands on April 20, 2025.
4. September 22, 2025. Better Auth announces that Auth.js, "formerly known as NextAuth.js", is "now being maintained and overseen by Better Auth team." They "strongly recommend new projects to start with Better Auth unless there are some very specific feature gaps."
5. October 2025 to July 2026. Three betas in nine months: beta.30 (October 27, 2025), beta.31 (April 14, 2026) and beta.32 (July 20, 2026). Each one ships within an hour of a v4 patch (4.24.12, 4.24.14 and 4.24.15).
6. July 7, 2026. Better Auth announces it is joining Vercel. The post says it will keep "continuing to maintain Auth.js and fix security issues and other bugs."
7. October 24, 2026. Three years to the day after beta.0. npm's latest tag is still 4.24.15. The beta tag is 5.0.0-beta.32.

That pairing in step 5 tells you how the project runs now. v4 and v5 get patched together, on the same day. That is maintenance mode. It is careful and it is responsible, but it is not a push toward a stable v5.

Better Auth vs next-auth: what do the npm numbers show?

npm's public downloads API shows Better Auth ahead of next-auth on every reported day from August 7 to October 22, 2026, and the gap is widening. On Thursdays it went from 1.13x in mid-August to 1.75x by October 22. Over the 10 reported days from October 7 to 22, the ratio was 1.83x.

I used Thursdays so weekends do not skew the comparison. Every number below comes straight from the two npm API links at the top.

Date (Thursday)	next-auth	better-auth	Better Auth / next-auth
August 6, 2026	850,361	845,449	0.99x
August 13, 2026	993,390	1,119,059	1.13x
September 10, 2026	1,137,336	1,448,529	1.27x
September 24, 2026	1,154,487	1,795,451	1.56x
October 1, 2026	1,310,263	2,069,556	1.58x
October 8, 2026	1,392,847	2,306,938	1.66x
October 22, 2026	1,529,104	2,674,555	1.75x

Three things are worth knowing before you quote this table.

npm has gaps. In the 91 days from July 25 to October 23, 13 days came back as zero for both packages. Those are holes in npm's reporting, not days nobody installed anything. That is why the claim is "every day npm reported", not "every day".

Weekends are even more lopsided. On Saturday October 17 and Sunday October 18, the ratio was about 2.05x and 2.10x.

Downloads are not users. CI pipelines, Docker builds and fresh installs all count. The numbers show momentum, not how many apps run each library.

You can check all of this yourself in one line:

curl -s https://api.npmjs.org/downloads/range/2026-10-01:2026-10-22/better-auth
curl -s https://api.npmjs.org/downloads/range/2026-10-01:2026-10-22/next-auth

The response is JSON with a downloads array of { day, downloads } objects. Swap the dates for any range you want.

Is next-auth dead?

No. next-auth is shrinking in share, not in volume. Its Thursday downloads rose from 993,390 on August 13 to 1,529,104 on October 22, 2026, a 54% jump. It still gets security patches from the Better Auth team. It is simply growing much more slowly than the library its own maintainers recommend.

This is the detail most hot takes miss. The 1.8x is not next-auth collapsing. It is Better Auth growing about 2.6 times faster over the same ten weeks: up 139% against next-auth's 54%.

A lot of existing apps still run next-auth, and those apps keep running npm install in their builds. That base will not vanish because a newer library exists. If your app is on next-auth today, nothing breaks tomorrow.

When should you use Better Auth, and when should you stay on next-auth?

Use Better Auth for any new project. That is the official recommendation from the team that maintains both. Stay on next-auth if you have a working app, no feature you need is missing, and a migration would cost more than it saves. Plan a move if your database schema or session logic is about to change anyway.

Your situation	My recommendation	Why
Starting a new Next.js app	Better Auth	The Auth.js maintainers "strongly recommend new projects to start with Better Auth"
Working app on next-auth v4 or v5 beta	Stay for now	Security patches still ship for both versions
You were holding out for stable v5	Stop waiting	Three betas in the past 12 months, no stable date announced
You need sessions with no database	Either	Better Auth's docs now say it "supports stateless session management without any database"
You use credentials (email and password) on next-auth	Migrate carefully	Better Auth stores passwords in the account table, not on user
You are already reworking your auth tables	Migrate now	You pay the schema cost once

One row needs context. When Better Auth took over Auth.js in September 2025, the gap it named was "stateless session management without a database." Its session docs now say: "If you don't pass a database configuration, Better Auth will automatically enable stateless mode." The same docs list the trade-off honestly: "you can't invalidate session easily."

If you are early in your career and wondering which one to learn, learn the one new projects will use. Auth is a small slice of the stack, though. Our AI-first roadmap for learning programming in 2026 covers where it fits.

What does moving from next-auth to Better Auth look like in code?

A basic GitHub sign-in moves in four steps: replace the config file, rename the route folder from [...nextauth] to [...all], add a client, and swap auth() for auth.api.getSession() on the server. Database users also rename tables and fields. Here is the smallest version, based on Better Auth's migration guide and Next.js docs.

Before: Auth.js v5 (auth.ts)

import NextAuth from "next-auth"
import GitHub from "next-auth/providers/github"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [GitHub],
})

After: Better Auth (lib/auth.ts)

import { betterAuth } from "better-auth"
import { nextCookies } from "better-auth/next-js"

export const auth = betterAuth({
  socialProviders: {
    github: {
      clientId: process.env.GITHUB_CLIENT_ID!,
      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
    },
  },
  plugins: [nextCookies()], // keep this last in the array
})

There is no database config in that snippet, so per the session docs Better Auth runs in stateless mode.

The route handler (app/api/auth/[...all]/route.ts)

import { auth } from "@/lib/auth"
import { toNextJsHandler } from "better-auth/next-js"

export const { GET, POST } = toNextJsHandler(auth)

The client (lib/auth-client.ts)

import { createAuthClient } from "better-auth/react"

export const authClient = createAuthClient()

Reading the session in a server component

import { headers } from "next/headers"
import { auth } from "@/lib/auth"

export default async function Page() {
  const session = await auth.api.getSession({
    headers: await headers(),
  })
  if (!session) return <p>Please sign in</p>
  return <p>Hi {session.user.name}</p>
}

The migration guide recommends checking the session in each page or route, not in Middleware or layouts.

If you used database sessions, the table changes are where the time goes:

Auth.js	Better Auth	What changes
User	user	emailVerified goes from a timestamp to a boolean
Session	session	sessionToken becomes token, expires becomes expiresAt
Account	account	snake_case to camelCase, provider becomes providerId, providerAccountId becomes accountId
VerificationToken	verification	single id key, token becomes value

The one that bites people: if you stored passwords on the User model, you must create an account row for each of those users with providerId set to credential. The guide is blunt about it. Without that row, password sign-ins fail.

My honest take: the code change is an afternoon. The data change is the real project. Writing the code was never the hard part, as I argued in code was never the hard part.

FAQ

Is next-auth v5 stable yet?

No. As of October 24, 2026, npm's beta tag points to 5.0.0-beta.32, published July 20, 2026, and the latest tag is still v4.24.15. The Auth.js docs still install v5 with npm install next-auth@beta. No stable release date has been announced.

Who maintains next-auth now?

The Better Auth team. On September 22, 2025, Better Auth announced that Auth.js, formerly NextAuth.js, is "now being maintained and overseen by Better Auth team." Better Auth then joined Vercel on July 7, 2026, and said it would keep fixing Auth.js security issues and bugs.

Does Better Auth really get more downloads than next-auth?

Yes, on npm's public data. Better Auth had more downloads than next-auth on every day npm reported from August 7 to October 22, 2026. Across the 10 reported days from October 7 to 22, it had 20,179,937 downloads to next-auth's 11,056,472, which is 1.83x.

Should I migrate my existing next-auth app to Better Auth?

Not urgently. Both next-auth v4 and the v5 beta still receive security patches. Migrate when you are starting a new project, when you need something next-auth lacks, or when you are already changing your auth tables, since the database rename is the biggest part of the work.

Run the two curl commands above against your own date range before you decide, then grab the free tools on Art of Code for the rest of your setup. If you are setting up a fresh editor for that new project, start with 10 VS Code extensions every developer needs in 2026.

Written by Adithya Guttha, Founder of Art of Code.