The best Authentication & Identity
Every option ranked — open-source, self-hostable, and commercial — by our transparent Sovereignty Score, with honest trade-offs so you choose what fits you, not us.
Login, single sign-on, and identity-management platforms that handle user authentication, authorization, and access control for apps and APIs.
L5Applications — layer 5 of the AI stack- 1
Keycloak
Top pickOpen sourceThe mature, CNCF-backed open-source identity and access management server.
Free / self-host (Docker image or standalone distribution); commercial support available via Red Hat build of Keycloak (RHBK) for enterprises that want a support contract. · in our Auth0 comparison →
What is Keycloak? →90sovereignty - 2
authentik
Open sourceA modern, self-hostable identity provider with a flexible visual flow builder.
Free / self-host for the core MIT-licensed product; a hosted 'authentik Security' cloud offering and an Enterprise tier (support SLA, extra features under the separate enterprise/ license) are available paid. · in our Auth0 comparison →
What is authentik? →85sovereignty - 3
Ory Kratos
Open sourceA headless, API-only identity server for teams that want to build their own login UI.
Free / self-host under Apache-2.0; Ory Network offers a managed hosted version with a free tier and paid usage-based plans for teams that prefer not to operate it themselves. · in our Auth0 comparison →
What is Ory Kratos? →84sovereignty - 4
ZITADEL
Open sourceA cloud-native, API-first identity platform with a generous self-hosted core.
Free / self-host under AGPL-3.0; ZITADEL Cloud offers a managed free tier plus paid usage-based plans for teams that don't want to run the server themselves. · in our Auth0 comparison →
What is ZITADEL? →82sovereignty - 5
SuperTokens
Open sourceA developer-friendly, self-hostable auth core built for fast integration into existing apps.
Free / self-host for the Apache-2.0 core; a managed SuperTokens cloud and a paid Enterprise tier (SSO/SAML, advanced MFA policies under the ee/ license) are available for teams that want those features or don't want to self-host. · in our Auth0 comparison →
What is SuperTokens? →80sovereignty
Is it free?
The free tier, its real limits and where you start paying — read from each vendor's own pricing page and dated.
Run these yourself
What each one actually needs — real RAM, honest running cost, and the setup time nobody quotes.
- Self-hosting Keycloak 4 GB
- Self-hosting authentik 4 GB
- Self-hosting Ory Kratos 1–2 GB for Kratos, PostgreSQL and a login UI together. Kratos itself is a single Go binary and keeps no state of its own.
- Self-hosting ZITADEL 4 GB
Replacing a specific tool?
Head-to-head comparisons for each popular authentication & identity product.
Straight head-to-heads
Two authentication & identity tools, side by side — verified facts and a plain verdict.