Security & Privacy / Customer Identity and Access Management Software
Amazon Cognito is AWS's customer identity and access management service for user registration, authentication, federation, user pools, branded sign-in, and application access control.
Buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
Product scope
AWS-managed customer identity using user pools, federated AWS credentials using identity pools, and optional M2M, capacity, security and replication features.
Product checked: Oct 6, 2026
Pricing plans
Pricing checked: Oct 6, 2026
Pay for usage without minimum fees or upfront commitments. Ordinary AWS fees are billed monthly. Lite direct/social users have volume bands, Essentials costs USD 0.015 per MAU above its allowance, and Plus direct/social users cost USD 0.02 per MAU. Enterprise SAML/OIDC federation is USD 0.015 per MAU above 50. SMS, email and supporting AWS services incur separate charges. M2M requests, higher API quotas, Lite ASF and multi-Region replication add charges. Within a month, each user is assigned to the highest tier used during their activity.
Official pricing pageVerified plan boundaries that can change the required edition.
Managed login visual customization or built-in passwordless sign-in.
Supporting pricing evidenceIntegrated threat protection, risk-based authentication and authentication-event export.
Supporting pricing evidenceAdjust the license quantity to compare public recurring rates across the available plans.
License-rate calculation only. It excludes implementation, migration, training, support, taxes, add-ons, usage charges, and negotiated discounts unless they are explicitly included in the displayed public rate.
Calculate additional usage only where the plan allowance, unit, and period are established. Published rates are shown separately when an estimate is not available.
$0.05 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.04 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.02 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.02 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.01 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$2.25 USD / 1,000 token requests
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$1.50 USD / 1,000 token requests
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$1.13 USD / 1,000 token requests
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$20.00 USD / incremental RPS
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$45.00 USD / incremental RPS
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.00 USD / MAU
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.15 USD / 10,000 sync operations
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
$0.15 USD / GB
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
This calculation compares usage with the published allowance on the same unit and period basis. It excludes taxes, negotiated terms, and unverified packaging conditions.
Product scope
Material capabilities are separated by their verified relationship to the target product.
AWS approval and a one-day minimum apply.
Separately billed successful token responses.
Identity pools have no authentication/identifier charge and do not store profiles.
Lambda execution retains normal service charges.
Lite ASF add-on offers advanced security; Essentials does not include the complete threat package.
Replication requires a multi-Region customer-managed KMS key; applicable rates depend on scope.
Scoring method
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and AI assessment. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
User pools support managed sign-up, sign-in, and federation; Essentials and Plus add managed login and passwordless options, while Lite remains password-based. Buyers should select the tier that matches their required sign-in and recovery flows.
Authenticator and SMS MFA are described across tiers, with email MFA in higher tiers; Plus adds risk-based adaptive authentication, compromised-credential detection, and event logs, so buyers should confirm whether those Plus controls justify its per-MAU pricing for their sign-in mix.
User pools store customer profiles, while identity pools broker temporary AWS credentials and do not store profiles; this clear component boundary helps teams choose the right directory for each application workflow.
AWS's supplied Cognito security documentation states that user-pool and identity-pool data is encrypted at rest and describes security as a shared responsibility; AWS's agreement allows customers to specify storage Regions, so teams should confirm their own content controls and consent or privacy-choice requirements.
AWS describes its managed directory as scaling to millions of users, and Cognito provides SDK/API and Lambda extension points with optional regional replication; higher API quotas require approval and add-on usage can cost extra, so buyers should validate capacity and regional needs against their deployment.
Public review signals
PeerSpot: 3.8/5 (17 reviews); SoftwareReviews: 7.3/10 (7 reviews); SourceForge: 5/5 (1 reviews and ratings); TrustRadius: 7.4/10 (47 reviews and ratings)
Public review signals updated: Oct 8, 2026
These ratings are retained for transparency but are not presented as representative buyer sentiment.
Insufficient sample · 7 reviews
Insufficient sample · 1 review or rating
Marketplace app signals
These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.
AI assessment
The assessments below use the same buying criteria. Review their scores, confidence, fit, cautions, and conclusions alongside the sources.
AI assessment updated: Nov 1, 2026
Amazon Cognito fits developers building customer sign-up, authentication, federation, and application access for AWS-connected products. User pools manage customer profiles; identity pools broker temporary AWS credentials and do not store profiles. Choose the tier around required passwordless, threat-protection, and sign-in options, then model the monthly MAU and supporting-service charges before rollout.
Research transparency
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingUnresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.
View research methodologySources checked
FAQ
Essentials and Plus include passkeys and email/SMS one-time-password sign-in. Lite supplies basic password-based authentication.
Lite and Essentials have an ongoing 10,000 direct/social MAU monthly allowance per account or organization outside GovCloud. Eligible grandfathered Lite pools retain 50,000. SAML/OIDC users have a separate 50-MAU allowance in every tier. Plus has no direct/social free allowance; M2M token requests have no free tier.
Identity operations during a calendar month can count a user as active, including administrative changes, login, refresh and attribute queries. Further sessions in that month do not add another MAU; tier changes assign the user to the highest tier used while active.
SMS and email delivery are separately charged through supporting AWS services. Lambda and other service usage also retain their normal charges.
User pools store customer identity profiles. Identity pools broker temporary AWS credentials and do not store customer profiles.
Popular comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.
Per-user pricing / Enterprise / Single sign-on and MFA / Customer identity and consent
Per-user pricing / Enterprise / Small business / Single sign-on and MFA
Per-user pricing / Single sign-on and MFA / Customer identity and consent