Keycloak
Keycloak is open-source identity and access management software that adds authentication to applications and secure services, leaving those systems free from…
What Keycloak is
Keycloak is open-source identity and access management software that adds authentication to applications and secure services, leaving those systems free from handling user sign-in themselves. Its single sign-on lets users authenticate once to access multiple applications and sign out of them together. Supported standards include OpenID Connect, OAuth 2.0, and SAML. Keycloak can also use external OpenID Connect or SAML identity providers and social networks such as Google, GitHub, Facebook, and Twitter. Authentication options include passwords, passkeys, X.509 certificates, and two-factor methods with TOTP or HOTP and recovery codes. It can synchronize users from LDAP and Active Directory and bridge authentication through Kerberos. Administrators can set detailed authorization policies for applications and services. Deployment choices include a server distribution, a container image for Docker, Podman, Kubernetes, and OpenShift, and an operator for Kubernetes and OpenShift. The project uses the Apache License, Version 2.0, and is free. Some features are off by default; preview features require enabling and may not be generally supported. The project recommends Red Hat build of Keycloak for users who cannot regularly upgrade and need long-term version support.
Good
- Supports OpenID Connect, OAuth 2.0, and SAML
- Single sign-on across multiple applications
- Supports LDAP and Active Directory synchronization
- Free and licensed under Apache License 2.0
Watch out
- Some features are disabled by default
- Preview features may not be generally supported
- Regular upgrading may be needed for version support
Who it suits
Keycloak suits organizations that need centralized authentication, single sign-on, and directory synchronization. It is also relevant to teams able to manage deployment and feature configuration themselves.
Verdict
Keycloak provides a broad set of authentication, federation, and authorization functions without a software price. Check its feature status and upgrade requirements against your operational needs.
Plans and prices
From Keycloak's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Keycloak | Free | Open-source identity and access management software · no published paid plans or usage limits found |
The facts
Each one read from Keycloak's own pages, with the date it was checked.
What it does
- Authentication
- Keycloak supports passkeys, passwords, X.509 certificates, and two-factor authentication with recovery codes and TOTP/HOTP.checked 9 Oct 2026
- Authorization
- Administrators can define fine-grained authorization policies for applications and services.checked 9 Oct 2026
- Deployment
- The downloads page provides a server distribution, a container image for Docker, Podman, Kubernetes, and OpenShift, and an operator for Kubernetes and OpenShift.checked 9 Oct 2026
- Feature status
- Some features are disabled by default, and the project notes that preview features require enabling and may not be generally available as supported features.checked 9 Oct 2026
- Identity brokering
- Keycloak can authenticate users through external OpenID Connect or SAML identity providers and social networks including Google, GitHub, Facebook, and Twitter.checked 9 Oct 2026
- Licensing
- The Keycloak project is licensed under the Apache License, Version 2.0.checked 9 Oct 2026
- Project home
- Keycloak is an open-source identity and access management project accepted into the CNCF as an incubating project in April 2023.checked 9 Oct 2026
- Protocols
- Keycloak supports OpenID Connect, OAuth 2.0, and SAML.checked 9 Oct 2026
- Purpose
- Keycloak adds authentication to applications and secure services, so they do not need to store or authenticate users themselves.checked 9 Oct 2026
- Security reporting
- The project asks vulnerability reporters to email its security team and says it aims to acknowledge reports within seven business days.checked 9 Oct 2026
- Single sign-on
- Users can sign in once through Keycloak to access multiple applications and sign out of them together.checked 9 Oct 2026
- Support
- The project recommends Red Hat build of Keycloak for users who cannot regularly upgrade and need long-term support for specific versions.checked 9 Oct 2026
- User federation
- Keycloak can synchronize users from LDAP and Active Directory servers and bridge authentication through Kerberos.checked 9 Oct 2026
Alternatives to Keycloak
- 1
FusionAuth
Free planAndroidiOSWebAPI8.3From $162 a month - 2
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 3
Auth0 Guardian
Free planAndroidiOS7.3From $35 a month - 4
IBM Verify
AndroidiOSWebAPI7.3From $15,899.29 a year - 5
Specops uReset
AndroidiOSWebAPI7.0 - 6
JumpCloud Protect
AndroidiOS6.9