Typically MAU means "users that logged at some point during that billing month".

That is, when you are billed based on MAU you don't pay for the number of users in your database, only for the ones that actually use your app/service/whatever.

Typically, that makes sense. Specifically, there's nothing on the website to indicate that is how they calculate MAU. The website is missing this critical bit of detail to inform would-be buyers.

The copy was updated to say:

> Our prices are based on your Monthly Active Users (MAUs) and not your entire userbase, so you only pay for logged in users who interact with your website during the course of the month.

Does this help clarify? Sorry for the confusion.

Hey all - looks like there's a lot of confusion on the pricing model here. That's our fault, sorry!

The free plan does not include 2-step verification, and that was the reason for the increase in the paid plan.

We'd love some feedback on how you'd like to see the free plan constructed. What would be most helpful for getting you started with Clerk?

For me to take a company seriously MFA must be in all their plans. MFA is not an enterprise hook for upsell, it is a fundamental requirement for any online service these days.

Agreed, MFA is so important that a company should be willing to pay for it.

I'm not saying companies won't. But if you want me to believe your security is top notch then you need to show me you take it seriously.

Not offering MFA on the free tier tells me you're more interested in making money than in security.

There are plenty of other features that an enterprise will pay for.

Auth0, Microsoft also have MFA as a non-free thing. Probably because they have to pay for an SMS/equivalent.

It would be good to offer SMS MFA in the free tier, providing the dev plugs in valid Twilio credentials.

I and GP comment seem to take the opposite stance: MFA is so important that products like this shouldn't offer a plan that doesn't include it. Either include it in your free plan or don't offer a free plan; don't make security an upsell.

> ...don't make security an upsell.

Especially in a security focused product.

If you are going to offer MFA, it needs to be standard. How would you feel if seatbelts in cars or life jackets on boats were a paid feature? What if your bank charged extra for declining suspicious transactions?

Not the type of behavior you'd expect to see from the company you're handing all your user account data over to.

> What if your bank charged extra for declining suspicious transactions?

They do. There is a pool of money they make that they take from gains made on your money before you get the remainder as interest. That is what pays for that.

You shouldn't make your users choose between MAU supported and features.

Here's how I would do the price tiers, since you asked:

* STARTER - Free up to 5,000 MAU, features as listed.

* STARTER PLUS - Add a credit card and just pay $29 plus $0.05 for each additional MAU over the first 5,000. Same features as listed for STARTER.

In this approach, MAU 0 - 5,000 is free, and MAU 5,001 is $29.05. In the Starter plus tier, 6000 MAU is $29 + $50 = $79 and 10,000 MAU is $29 + $250 = $279

* For the PRO tier, the jump is pretty dramatic between $29 and $249 for the same # of users, so I suggest a 2x rather than a 8x premium. This means that you should price pro at $49 plus $0.02 for all users. This makes 5001 users $49 + $100 = $149

In this arrangement you don't even need to have a 5000 starter cliff for Pro. You can start with pro at even 500 users if you wanted the MFA features and the cost would be just $49 + $10 = $59.

Just my 2 cents.

I feel the same: The upper tier pricing is a bit aggressive even if free 5000 MAUs is a good "hook" (more than sufficient for most upstarts).

I've been meaning to evaluate keycloak.org and userbase.com, two radically different open source user management layers. Especially, userbase which has a relatively more attractive pricing for their hosted option.

Besides, user management is something I'd like to rid if I can, and instead rely on anonymous / decoupled (passwordless?) identity layers like human-id.org and gazepass.com

Cloudflare's OPAQUE is another enticing (zero-password) tangent in all of this, but they warn folks to not build identity systems using it, yet.

mau usually means logs in once during the month, if you have 20% mau that's 25k registered users. $250 / mo to manage a site with 25k users doesn't seem that bad.

I guess the pricing is more feature-based than MAU based.

The professional pricing have "Two-step verification" and "No visible Clerk branding".