Life & fun · alternatives · 2026
24 alternatives to Minimal NIST/OWASP-compliant auth implementation for Cloudflare Workers
This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers. Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking. It's deliberately minimal — no OAuth, no passkeys, no magic links, no rate limiting — because the goal is clarity and auditability. I wrote it mainly to deeply understand edge-runtime auth constraints and to have a clean Apache-2.0 example that…
This educational reference implementation demonstrates how to build standards-compliant authentication on Cloudflare Workers using Hono and Turso. It implements NIST and OWASP-aligned security practices including… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
- 2OS
I've been working on this for some time now, starting with vm2, then deno-core for 2 years, and recently rewrote it on rusty_v8 with Claude's help. OpenWorkers lets you run untrusted JS in V8 isolates on your own infrastructure. Same DX as Cloudflare Workers, no vendor lock-in. What works today: fetch, KV, Postgres bindings, S3/R2, cron scheduling, crypto.subtle. Self-hosting is a single docker-compose file + Postgres. Would love feedback on the architecture and what feature you'd want next.
Jan 2026 · openworkers.com · its alternatives →
- 3
Platform-Agnostic Security Tokens. Contribute to paragonie/paseto development by creating an account on GitHub.
2018 · github.com · its alternatives →
- 4
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com · its alternatives →
- 5ID
Hi everyone, I am Bojta Lepenye, and first of all, I want to thank the core developers of Hashcat. In my experience, it is quite literally the most capable tool available for offline password cracking across a wide range of use cases. I have spent the last 4 years (from age 14 to 18) extensively working with Hashcat and the tools surrounding it, and I have documented what I have learned throughout that time (since January 18, 2022) in my first book. During that period, I also had to continuously update and rewrite major sections as the field evolved. One example was the introduction of GPU…
May 2026 · its alternatives →
- 6
You can get a 2h free trial by solving a proof-of-work captcha when topping up your account for the first time. If you'd like to learn more, an independent interview was posted a couple of weeks ago [1], and the FAQ [2] has a lot of information as well. For the source code sharing, we've talked with lawyers and are inclined to no longer require the NDA/NCC for privacy reasons shared with us before (signing requires identification), but instead use a source-available permissive license that doesn't allow competition, like PolyForm Shield [3] (we do still have about 6 months before…
Jun 2026 · uruky.com · its alternatives →
- 7
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
2023 · github.com · its alternatives →
- 8
Hey HN! Happy to finally launch Stack. We made it because we like to put apps into production quickly, and authentication & user management was taking up way too much time. We have components like and that automatically adapt to whatever theme & design system you're using. Check the blog post to see the example with Radix UI and Joy UI. Also, there's an admin dashboard for monitoring and editing accounts. Stack is 100% AGPL/MIT-licensed, so you can self-host it. Cheers!
2024 · stack-auth.com · its alternatives →
- 9
Nango (https://github.com/NangoHQ/nango) provides pre-built OAuth flows, secure token storage and automatic refreshes for 40+ APIs and counting. Why we built Nango: We built Nango to solve the pain of accessing OAuth APIs. Despite OAuth being a standard protocol in theory, it remains a major burden to implement it, even with the help of a library. You still need to add endpoints and logic to your app for the server-side dance, implement token refreshes, build & secure your token storage, deal with redirects on the frontend etc. But the worst part is that (almost) every…
2023 · nango.dev · its alternatives →
- 10
A Virtual FIDO2 USB Device. Contribute to bulwarkid/virtual-fido development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 11RT
Every privacy-focused DNS service requires an account: NextDNS, Cloudflare for Families, Apple's iCloud Private Relay (paid, iOS-only). The protocol that doesn’t require one - ODoH - had basically one well-known public relay operator (Frank Denis on Fastly Compute, default in dnscrypt-proxy). I built a second one and the client to talk to it.
May 2026 · numa.rs · its alternatives →
- 12
I've built this to make it easy to host your own infra for lightweight VMs at large scale. Intended for exec of AI-generated code, for CICD runners, or for off-chain AI DApps. Mainly to avoid Docker-in-Docker dangers and mess. Super easy to use with CLI / Python SDK, friendly to AI engs who usually don't like to mess with VM orchestration and networking too much. Defense-in-depth philosophy. Would love to get feedback (and contributors: clear & exciting roadmap!), thx
2025 · github.com · its alternatives →
- 13
StackPatch▲116Patch authentication into your Next.js app with one command
Jan 2026 · its alternatives →
- 14
Last week Cloudflare released Cap'n Web [1], a schema-free capability-based RPC protocol. I built capn-rs this week - a Rust implementation with full wire protocol compatibility. Links: GitHub: https://github.com/currentspace/capn-rs Crates: https://crates.io/crates/capnweb-server API docs: https://docs.rs/capnweb-server What's working: Wire compatibility verified via integration tests against TypeScript reference Multi-transport: HTTP batch, WebSocket, WebTransport (HTTP/3) Complete IL (intermediate language) expression evaluator…
2025 · github.com · its alternatives →
- 15
A simple to use text only blog using CloudFlare Workers and KV - jonfraser/simpletext
2024 · github.com · its alternatives →
- 16
AuthPass▲75Simple, open source, cross platform password manager 😅️
2020 · authpass.app · its alternatives →
- 17
- 18
A full featured, stand-alone, high-performance HTTP server and client written entirely in plain Java - FusionAuth/java-http
2022 · github.com · its alternatives →
- 19
Using serverless functions to provide an API for checking potential passwords against an enormous corpus of passwords leaked from security breaches. - jthomas/serverless-pwned-passwords
2017 · github.com · its alternatives →
- 20
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
2024 · github.com · its alternatives →
- 21AL
Hi HN, I’m one of the maintainers of Bridge Anonymization. We built this because the existing solutions for translating sensitive user content are insufficient for many of our privacy-concious clients (Governments, Banks, Healthcare, etc.). We couldn't send PII to third-party APIs, but standard redaction destroyed the translation quality. If you scrub "John" to "[PERSON]", the translation engine loses gender context (often defaulting to masculine), which breaks grammatical agreement in languages like French or German. So we built a reversible, local-first pipeline for Node.js/Bun. Here…
Dec 2025 · medium.com · its alternatives →
- 22
An admin-friendly, User Management Server (with Passkeys & JWTs) - for seamless and secure integration of user authentication - authcompanion/authcompanion2
2023 · github.com · its alternatives →
- 23
I, like Andrej Karpathy, became super frustrated by how annoying it was to deploy projects that were previously an absolute joy to make with Claude Code. That is why I made open-passkey, an MIT licensed passkey repo with support for 33 languages and frameworks (examples included) that makes adding simple secure auth to a project easy. We are also releasing gateway (https://gateway.locke.id) a "backendless" hosted auth server that frontend apps can consume for free so that you can ship a React or Angular app using a CDN like Netlify without needing to configure a server at all. We…
Apr 2026 · github.com · its alternatives →
- 24
Can be deployed to Cloudflare or fully selfhosting. A simple demo site available with only Password Sign-in/Sign-up, OTP MFA, Passkey enrollment features enabled, no real email needed: https://auth-demo.valuemelody.com/
2025 · github.com · its alternatives →
Also compare
- Stack Auth (YC S24) alternatives
- OpenWorkers – Self-hosted Cloudflare workers in Rust alternatives
- PAST, a secure alternative to JWT alternatives
- I built an HTTP client that perfectly mimics Chrome 142 alternatives
- I Dedicated 4 Years to Mastering Offline Password Cracking alternatives
- Uruky (EU-based Kagi alternative) now has Image Search and URL Rewrites alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →