Tweet by zebassembly

April 19, 2025

This one is a little complicated since the algorithm being (relatively) slow is actually by design and we limit CPU time on the free tier. Looking through better auth and its deps, it uses a mix of runtime-provided crypto and JS implemented crypto with I suspect most of it being the latter. With it being implemented in JS, depending on how long your Worker has been in memory the JIT compiler might or might not have optimized your code (why some people are seeing 5s vs ~200ms for signups). Crypto for accounts being slow is usually a feature to prevent brute force attacks if your DB ever gets compromised, but because this is JS it’s extra slow compared to the optimized code a would-be attacker would actually use. Better-auth could use native crypto (node:crypto via nodejs_compat maybe?) for Workers but even then it probably wouldn’t be faster than the 10ms of CPU limit on the free tier.

Author
zebassembly
Date
April 19, 2025
Open on X