Firefox Account Server (FxA) is Mozilla's open-source identity backend behind Firefox Sync. See how it works, self-hosting steps, licensing and alternatives.
Firefox Account Server (FxA) is the open-source identity and authentication backend Mozilla built to power sign-in across Firefox Sync, Mozilla VPN, Pocket, Firefox Add-ons, and other Mozilla relying-party applications. It was rolled out starting around Firefox 29 in 2014 as the replacement for Firefox Sync's older pairing-code system, and the public-facing brand was renamed from 'Firefox accounts' to 'Mozilla accounts' in late 2023, though the accounts.firefox.com URL and underlying FxA codebase were intentionally kept unchanged.
The project lives in the mozilla/fxa monorepo on GitHub and is licensed under the Mozilla Public License 2.0. It is built primarily in TypeScript and JavaScript on Node.js, and is structured as a small set of cooperating microservices: a content-server for the sign-in UI, an auth-server for account and password logic, an oauth-server for OAuth 2.0 flows, and a profile-server for shared profile data.
FxA's core technical distinction is its client-side key-stretching protocol (documented as 'onepw'), which combines PBKDF2 and HKDF on the client with a heavier server-side scrypt stretch, so the server never receives or stores a user's raw password and an attacker who steals the account database still faces an expensive scrypt work factor per guess.
The same key-derivation chain produces scoped encryption keys that let Firefox Sync data (bookmarks, history, saved passwords, open tabs) be encrypted end to end with keys the server cannot reconstruct on its own, and it exposes OAuth 2.0 so relying-party apps like Mozilla VPN and Pocket can request limited, scoped access instead of handling credentials directly.
There is no purchase price, subscription, or paid tier for Firefox Account Server itself; it is free, open-source software under the MPL-2.0 license that anyone can clone, audit, and self-host. Mozilla runs its own production instance at no direct cost to end users, and organizations that choose to self-host instead pay only for their own infrastructure (servers, database, and, for full Sync compatibility, a self-hosted sync-1.5 storage server) plus the engineering time to deploy and maintain it.
Because it is infrastructure rather than a commercial product, there are no seat-based plans or feature-gated tiers to compare; the single relevant 'plan' is running the open-source stack yourself or relying on Mozilla's hosted Mozilla accounts service that ships with Firefox.
FxA is Mozilla's open-source, Node.js-based identity and authentication backend that lets users sign in once and use that account across Firefox Sync, Mozilla VPN, Pocket, and other Mozilla products. The public brand was renamed from 'Firefox accounts' to 'Mozilla accounts' in November 2023, but the underlying FxA codebase and accounts.firefox.com URL were kept unchanged.
Yes. FxA is free, open-source software released under the Mozilla Public License 2.0. There is no purchase price or subscription; Mozilla's own hosted instance is free for end users, and self-hosters only pay for their own infrastructure.
Yes. Mozilla publishes a 'Run your own Firefox Accounts Server' guide describing how to clone the mozilla/fxa repository and deploy your own auth-server and content-server instances. Because Mozilla's production Sync storage rejects assertions from non-Mozilla FxA instances, a full self-hosted setup also requires running your own compatible sync-1.5 storage server.
FxA uses a protocol documented as 'onepw.' The Firefox client runs the password through 1,000 rounds of PBKDF2 and then HKDF before sending anything to the server, so the raw password never leaves the device. The server then applies an additional, much heavier scrypt-based stretch before storing a verify hash, meaning even a compromised database still requires expensive computation per password guess.
Firefox Accounts was introduced experimentally in early 2014 and became the default backend for Firefox Sync starting with Firefox 29, replacing Sync's older pairing-code-based setup, in a transition often referred to internally as 'Sync 1.5.'
For general-purpose identity and authentication needs, comparable platforms include Auth0, AWS Cognito, Keycloak, Ory (Kratos and Hydra), Authelia, and SuperTokens. Unlike FxA, most of these are designed as broadly applicable identity platforms for any application, rather than being purpose-built around one browser vendor's Sync and relying-party ecosystem.