I built a self-hosted auth system so you don't have to pay per user

我叫安特雷 — Sun, 01 Nov 2026 19:38:32 +0000

I got tired of paying per user for authentication services. So I built Knell - a self-hosted auth system that does one thing well.

## The Problem

Every auth vendor wants to charge you per user. Start small, grow big, and suddenly your auth bill is thousands per month. Plus you're handing over all your user data to a third party.

I wanted something I could deploy once, own forever, and actually understand how it works.

## What is Knell?

Knell is a self-hosted authentication system built with TypeScript, Fastify, and PostgreSQL. It handles accounts, sessions, and sign-in so your apps don't have to.

No bloat. No vendor lock-in. No mystery black boxes.

## Features

**Security first:**
- Argon2id password hashing (the strongest algorithm available)
- Rate limiting (5 login attempts per 15min)
- Account lockout after failed attempts
- IP blocking for bad actors
- Timing attack prevention
- OWASP Top 10 compliant

**Session management:**
- JWT access tokens (15min expiration)
- Refresh tokens (7 days, revocable)
- Device fingerprinting
- Max 5 concurrent sessions per user
- Track last activity

**Performance:**
- Handles 15k+ concurrent users
- Sub-20ms response times
- Connection pooling
- Query batching
- In-memory caching

## Quick Start

bash
git clone https://github.com/roadsman/knell-auth.git
cd knell-auth
docker-compose up -d


That's it. Server runs on port 3000.

## API Example

**Sign up:**

bash
curl -X POST http://localhost:3000/signup \
-H "Content-Type: application/json" \
-d '{"email":"user@example.com","password":"SecurePass123!"}'


Returns access token + refresh token.

**Authenticate requests:**

bash
curl http://localhost:3000/me \
-H "Authorization: Bearer "




## Why I Built This

1. **Cost** - No more per-user pricing
2. **Privacy** - My users' data stays with me
3. **Control** - I understand every line of code
4. **Learning** - Built exactly what I needed, nothing more

## Tech Stack

- **TypeScript** - Type safety for auth logic
- **Fastify** - Fast, low overhead HTTP server
- **PostgreSQL** - Reliable, battle-tested database
- **Argon2** - Memory-hard password hashing
- **Docker** - Easy deployment

## What's Next

This is v0.1.0. Coming soon:
- Email verification
- Password reset
- TOTP/2FA
- OAuth providers (Google, GitHub)
- WebAuthn/passkeys

## Try It

GitHub: https://github.com/roadsman/knell-auth

MIT licensed. Deploy it anywhere. Own your data.

Feedback welcome!

DEV Community: 我叫安特雷

I built a self-hosted auth system so you don't have to pay per user