This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 1, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
Amazon Cognito is often described as "free up to 50,000 users". That number is out of date for new user pools, and the tier you pick changes both the price and the features more than most people expect.
This article explains the three current tiers, the two meters that generate the bill, and where the costs actually grow.
The three tiers
Cognito user pools come in three tiers. Essentials is the default for new pools.
| Tier | Free tier | Price per MAU | Highlights |
|---|---|---|---|
| Lite | 10,000 MAU / month | $0.0055 for the first 90,000 chargeable MAUs, then $0.0046 for the next 850,000 | Basic sign-in, social/SAML/OIDC, TOTP and SMS MFA, Lambda triggers, CSS customization, 99.9% SLA |
| Essentials | 10,000 MAU / month | $0.015 | Lite plus visual login editor, passkeys and passwordless, email OTP MFA, password-reuse prevention, custom claims, refresh-token rotation |
| Plus | none for direct/social users | $0.020 | Essentials plus threat protection, risk-based adaptive auth, compromised-credential detection, threat log export |
Two notes on the free tier:
- Pools created before November 22, 2024 keep the older 50,000 MAU allowance. New pools get 10,000.
- The free tier is not available in AWS GovCloud regions.
The second meter: federated users
SAML and OIDC sign-in work on every tier — that is not a paid upgrade. But federated users are metered separately:
- The first 50 federated MAUs per month are free, per AWS account or organization.
- Beyond that, each federated MAU costs $0.015, regardless of tier.
For a B2B product where every customer signs in through their own IdP, this is the line that matters: the base tier price is per direct/social MAU, and the enterprise users are on a separate meter.
What the tiers actually gate
The differences that change architecture, not just price:
- Passkeys / passwordless — Essentials and above. Lite does not include them.
- Email OTP MFA — Essentials and above. SMS and TOTP are on every tier.
- Refresh-token rotation — Essentials and above.
- Threat protection — Plus only.
If your security requirements include passkeys or refresh-token rotation, Lite is not an option regardless of price.
The costs outside Cognito
- SMS is billed by Amazon SNS per message.
- Email is billed by Amazon SES.
- Machine-to-machine tokens are a paid add-on with no free tier.
- Higher API request rates and multi-region replication are add-ons.
The headline per-MAU price is therefore a floor, not the bill.
How to estimate
- Count direct and social MAU separately from federated MAU.
- Pick the tier by features first — passkeys and refresh-token rotation force Essentials.
- Multiply by the tier rate, subtract the free allowance.
- Add federated MAUs above 50.
- Add SMS, email and M2M if you use them.
A worked example: 100,000 direct MAU on Essentials is roughly 90,000 chargeable MAUs × $0.015, plus SMS. The exact number depends on the tier boundaries AWS applies.
Where a flat-price alternative fits
Cognito's pricing is per MAU and tied to AWS. Casdoor is Apache-2.0 and self-hostable — no per-user meter at all — and the managed cloud is a flat $9, $25 or $59 per month with unlimited MAU and no per-connection fees. For a large user base, the difference is not a discount; it is a different shape of bill.
See Casdoor vs Cognito for the feature comparison.
Related reading: Cognito alternatives and auth pricing compared.
Sources
Product names are trademarks of their respective owners.