#1★ TOP PICK
Keycloak
Apache-2.0 identity, backed by Red Hat, running at enterprise scale.
93
OPEN SOURCEApache-2.0SELF-HOSTLOCAL-FIRST
Keycloak is the serious open answer to Okta: OpenID Connect, SAML, OAuth2, user federation to LDAP and Active Directory, fine-grained authorisation, MFA and an admin console that covers all of it. It is Apache-2.0, sponsored by Red Hat, a CNCF incubating project, and it already runs identity for organisations far larger than yours. Around 36k stars. Nothing about it is a compromise on capability — the cost is entirely in operating it, and identity is the service where operating it badly hurts most.
Strengths
- +Apache-2.0 with Red Hat behind it and CNCF governance
- +Genuinely enterprise-grade — SAML, OIDC, LDAP federation, fine-grained authz
- +No per-user cost, so growth does not raise the bill
- +Commercial support available if you need someone accountable
Trade-offs
- −Operating it well is a real skill — clustering, upgrades, database tuning
- −Admin console is powerful and not friendly
- −No pre-built integration catalogue on Okta's scale
- −Major version upgrades have broken things historically
Free and open source. Red Hat build with commercial support available. #2
Ory Kratos
Identity as an API — no UI, no opinions, entirely yours.
92
OPEN SOURCEApache-2.0SELF-HOSTLOCAL-FIRST
Ory takes the opposite approach to everything else here: Kratos handles identity, Hydra handles OAuth2, Keto handles permissions, and none of them ship a login screen. You build the interface; they provide the correctness. For a team that wants authentication fully inside their own product with no vendor's branding or flow, that is exactly right, and Apache-2.0 means no licence surprises. For a team that wanted SSO configured by Friday, it is the wrong tool — you are assembling identity from parts.
Strengths
- +Apache-2.0 across the whole stack — no carve-outs
- +API-first: your product owns the entire login experience
- +Cloud-native, stateless, scales horizontally without ceremony
- +Security-first design with a strong track record
Trade-offs
- −No UI at all — you build every screen
- −Composed of several services to deploy and understand
- −Most engineering effort of anything on this page
- −No admin console for non-technical staff
Free and open source. Ory Network is a paid hosted option. #3
ZITADEL
Multi-tenant identity built for products, not just employees.
88
OPEN SOURCEAGPL-3.0 (open core; paid cloud and enterprise tiers)SELF-HOSTLOCAL-FIRST
ZITADEL is aimed at a different job: identity for your customers rather than your staff. It is multi-tenant by design, so a SaaS company can give each customer organisation its own users, branding and policies without running separate deployments. Event-sourced audit trail, passwordless and OIDC/SAML support, AGPL-3.0, around 15k stars, Swiss-based — which matters to buyers who care where the directory lives. If you are choosing an Auth0 replacement rather than an Okta replacement, this is the closest fit.
Strengths
- +Multi-tenant by design — the right shape for customer identity
- +Event-sourced, so the audit trail is complete by construction
- +Swiss company and hosting, which answers a real procurement question
- +Modern passwordless and OIDC support
Trade-offs
- −Aimed at customer identity; weaker for internal employee SSO
- −AGPL-3.0 copyleft needs reading
- −Smaller ecosystem than Keycloak
- −Some features reserved for the paid tiers
Free and self-hostable. ZITADEL Cloud is paid per active user. #4
Logto
The fastest route from nothing to working sign-in.
87
OPEN SOURCEMPL-2.0 (open core; paid cloud tier)SELF-HOSTLOCAL-FIRST
Logto is the pragmatic middle: pre-built sign-in UI, SDKs for the common frameworks, social logins, MFA and multi-tenancy, deployable with Docker in well under an hour. It is aimed squarely at product teams who need authentication to work this week rather than an identity platform to administer for a decade. MPL-2.0 with a paid cloud tier. It is the smallest and youngest option here, which is the honest caveat, but for a startup replacing Auth0 it removes the most friction.
Strengths
- +Fastest of these from zero to a working sign-in flow
- +Sign-in UI included — no screens to build
- +Good SDKs for React, Next.js, Vue and the mobile frameworks
- +MPL-2.0 is permissive and easy to reason about
Trade-offs
- −Youngest and smallest project on this page
- −Not built for employee SSO across hundreds of apps
- −Fewer enterprise features than Keycloak
- −Multi-tenancy is newer and less proven than ZITADEL's
Free and self-hostable. Logto Cloud is paid with a free tier. #5
authentik
Modern identity that a small team can actually operate.
85
OPEN SOURCEMIT core, with enterprise and documentation carve-outsSELF-HOSTLOCAL-FIRST
authentik was built on the premise that Keycloak is more than most companies need and harder than most can run. It covers SSO, MFA, SAML, OIDC, LDAP outposts and a genuinely good flow builder for custom login journeys, with a clean interface and a Docker Compose deployment. Around 23k stars. The licence is worth stating precisely: the core is MIT, the `website/` directory is CC BY-SA, and enterprise features sit under a separate commercial licence — so it is MIT-with-carve-outs rather than plainly MIT.
Strengths
- +By far the easiest of these to stand up and keep running
- +Flow builder makes custom login journeys genuinely configurable
- +Modern interface a small team can navigate without training
- +Docker Compose deployment; sensible defaults
Trade-offs
- −Enterprise features are carved out of the MIT core
- −Younger and smaller than Keycloak
- −Single-vendor governance rather than a foundation
- −Fewer third-party integrations
Free and self-hostable for the open core. Enterprise tier is commercial.