Migrating auth from Firebase or Auth0 without breaking a single user login

The #1 reason teams stay on a bad auth provider: "we'd have to reset every user's password." You don't — the password-hash formats are portable.

Path 1: bulk import with hash adapters

Export your users with their password hashes. bcrypt, argon2id, scrypt, pbkdf2 — and Firebase's specific scrypt+signer-key variant — all verify natively on NexAuth. Users sign in exactly as before. No reset emails, no "we moved" campaign.

Path 2: lazy migration

Don't import anyone. Users who were never migrated still log in — the first password check runs against the legacy hash format, passes, and transparently rehashes to argon2id. Your user pool migrates itself as people log in.

Path 3: federation — don't migrate at all

Keep Firebase/Supabase/Auth0 as the user store. NexAuth verifies their tokens (JWKS) and adds the India-specific layer on top: WhatsApp OTP, DPDP consent records, BYO gateways. You keep your identity investment and gain the local channels none of them offer.

The decision rule

• Small pool (<50k), want full control → bulk import
• Large pool, want zero-downtime cutover → lazy migration
• Can't migrate yet, need WhatsApp/DPDP now → federation, migrate later