# Alternatives to Keycloak Keycloak is an open-source identity and access management server (a CNCF project) offering single sign-on, social and enterprise SSO, user federation, MFA, and fine-grained authorization, self-hosted and standards-based (OIDC, OAuth 2.0, SAML). Keycloak ranks #10 of 12 in Authentication & identity providers, with an Alt Score of 81. It is licensed under Apache License 2.0, free from Free and available on Linux, Windows and Web. 11 of 12 checklist rows are verified against a public source. Source: https://altcatalog.com/alternatives/keycloak/ Category: Authentication & identity providers ## Where Keycloak stands out - **Open source** — 3 of 12 apps with a verified answer have this - **Self-hostable** — 4 of 11 apps with a verified answer have this ## Overview - **Who it's for**: Engineering teams who need to self-host identity and access management rather than pay a per-MAU SaaS vendor, especially organizations with compliance, data-residency, or CNCF/open-source procurement requirements. - **What you get**: A free, open-source identity server providing single sign-on, social login and identity brokering, OTP/passkey MFA, fine-grained role- and attribute-based authorization, and an admin console for managing realms, users, and clients. - **How it works**: You download and run the Keycloak server (ZIP, container image, or Kubernetes Operator) on your own infrastructure, then register your applications as OpenID Connect or SAML clients so Keycloak issues and validates tokens for them. ## Profile - **License**: Apache License 2.0 (verified 2026-07-13) - **Pricing model**: Free (verified 2026-07-13) - **Starts at**: Free (verified 2026-07-13) - **Platforms**: Linux, Windows, Web - **Status**: active (verified 2026-07-13) ## Ranked alternatives | # | App | Alt Score | Licence | Platforms | |---|-----|-----------|---------|-----------| | 1 | [FusionAuth](https://altcatalog.com/alternatives/fusionauth.md) | 93 | Proprietary | Windows, macOS, Linux, Web | | 2 | [Ory](https://altcatalog.com/alternatives/ory.md) | 93 | Apache-2.0 | Linux, macOS, Windows | | 3 | [Zitadel](https://altcatalog.com/alternatives/zitadel.md) | 93 | AGPL-3.0 | Linux, macOS, Web | | 4 | [Auth0](https://altcatalog.com/alternatives/auth0.md) | 89 | Proprietary | Web | | 5 | [Clerk](https://altcatalog.com/alternatives/clerk.md) | 89 | Proprietary | Web, iOS, Android | | 6 | [Frontegg](https://altcatalog.com/alternatives/frontegg.md) | 89 | Proprietary | Web, iOS, Android | | 7 | [Stytch](https://altcatalog.com/alternatives/stytch.md) | 89 | Proprietary | Web, iOS, Android | | 8 | [Descope](https://altcatalog.com/alternatives/descope.md) | 85 | Proprietary | Web, iOS, Android | | 9 | [WorkOS](https://altcatalog.com/alternatives/workos.md) | 85 | Proprietary | Web | | 10 | [Amazon Cognito](https://altcatalog.com/alternatives/cognito.md) | 78 | ? | Web | | 11 | [Kinde](https://altcatalog.com/alternatives/kinde.md) | 74 | Proprietary | Web | Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/ ## Feature comparison Legend: Yes / No / Partial / ? (not verified). | Authentication & identity providers checklist | Keycloak | FusionAuth | Ory | Zitadel | Auth0 | Clerk | |---|---|---|---|---|---|---| | Pricing model | Free | Freemium | OSS + paid hosting | Freemium | Freemium | Freemium | | Starts at | Free | $162/mo | $770/yr | US$100/mo | $35/mo | $25/mo | | License | Apache License 2.0 | Proprietary | Apache-2.0 | AGPL-3.0 | Proprietary | Proprietary | | Platforms | Linux, Windows, Web | Windows, macOS, Linux, Web | Linux, macOS, Windows | Linux, macOS, Web | Web | Web, iOS, Android | | Social login | Yes | Yes | Yes | Yes | Yes | Yes | | Passwordless / magic links | Yes | Yes | Yes | Yes | Yes | Yes | | Passkeys / WebAuthn | Yes | Yes | Yes | Yes | Yes | Yes | | MFA | Yes | Yes | Yes | Yes | Yes | Yes | | Enterprise SSO (SAML / OIDC) | Yes | Yes | Yes | Yes | Yes | Yes | | SCIM provisioning | Partial | Yes | Yes | Yes | Yes | Yes | | B2B org / multi-tenant | Partial | Yes | Yes | Yes | Yes | Yes | | Self-hostable | Yes | Yes | Yes | Yes | Partial | No | | Pre-built UI components | Partial | Yes | Yes | Yes | Yes | Yes | | RBAC / permissions | Yes | Yes | Yes | Yes | Yes | Yes | | Open source | Yes | No | Yes | Yes | No | Partial | | Generous free tier (MAUs) | ? | Yes | No | No | Yes | Yes | ## Sources Sources for Keycloak. Each alternative is sourced on its own page. - **License**: Apache License 2.0 — (verified 2026-07-13) - Quote: “Apache License Version 2.0, January 2004” - **Pricing model**: Free — (verified 2026-07-13) - Quote: “Open Source Identity and Access Management” - **Status**: active — (verified 2026-07-13) - Quote: “Keycloak 26.7.0 released” - **Starts at**: Free — (verified 2026-07-13) - Quote: “Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.” - **Platforms**: Linux, Windows, Web — (verified 2026-07-13) - Quote: “Bare Metal / Virtual Machines - Direct installation on Linux or Windows servers” - **Social login**: Yes — (verified 2026-07-13) - Quote: “Social Login - Enable login with Google, GitHub, Facebook, Twitter, and other social networks.” - **Passwordless / magic links**: Yes — (verified 2026-07-13) - Quote: “Passkeys support is not enabled by default. It needs to be enabled in the WebAuthn Passwordless Policy” - **Passkeys / WebAuthn**: Yes — (verified 2026-07-13) - Quote: “We are happy to announce official support for passkeys in upcoming Keycloak 26.4.0.” - **MFA**: Yes — (verified 2026-07-13) - Quote: “Two-factor Authentication - Support for passkey, recovery codes and TOTP/HOTP via Google Authenticator or FreeOTP.” - **Enterprise SSO (SAML / OIDC)**: Yes — (verified 2026-07-13) - Quote: “As an OAuth2, OpenID Connect and SAML compliant server, Keycloak can secure any application and service as long as the technology stack they are using supports any of these protocols.” - **SCIM provisioning**: Partial — (verified 2026-07-13) - Quote: “We are excited to announce that the SCIM Realm API is now available as an experimental feature in Keycloak 26.6.” - **B2B org / multi-tenant**: Partial — (verified 2026-07-13) - Quote: “Keycloak Organizations is a feature that leverages the existing Identity and Access Management (IAM) capabilities of Keycloak to address CIAM uses cases like Business-to-Business (B2B) and Business-to” - **Self-hostable**: Yes — (verified 2026-07-13) - Quote: “Get started with Keycloak on a physical or virtual server.” - **Pre-built UI components**: Partial — (verified 2026-07-13) - Quote: “Theme support - Customize all user facing pages to integrate with your applications and branding.” - **RBAC / permissions**: Yes — (verified 2026-07-13) - Quote: “Keycloak supports fine-grained authorization policies and is able to combine different access control mechanisms such as: ... Role-based access control (RBAC)” - **Open source**: Yes — (verified 2026-07-13) - Quote: “Open Source Identity and Access Management” --- Ranked by verified data, never by who paid. https://altcatalog.com/trust/