privacyIDEA
privacyIDEA is an open-source, modular authentication server for adding two-factor authentication to applications, VPNs, remote access, SSH, websites, and we…
What privacyIDEA is
privacyIDEA is an open-source, modular authentication server for adding two-factor authentication to applications, VPNs, remote access, SSH, websites, and web portals. It runs on Linux under the AGPLv3 license. A WebUI handles configuration, central token management, and user self-service, while policies and event handlers control behavior. Supported factors include passkeys and WebAuthn, push, HOTP and TOTP, email and SMS OTP, U2F, YubiKey, SSH keys, and X.509 certificates. User records can come from LDAP, Active Directory, SQL databases, flat files, and SCIM services. Integrations include Keycloak, Microsoft ADFS, FreeRADIUS, Windows desktop login, Linux PAM, OpenVPN, ownCloud, Nextcloud, WordPress, and TYPO3. A REST API with JWT authentication supports scripting. Audit entries are digitally signed, and database token secrets use AES encryption. Source is available on GitHub, with PyPI installation. Enterprise support plans are offered by NetKnights.
Good
- Open-source AGPLv3 software
- Many authentication factor options
- LDAP, Active Directory, and SCIM sources
- REST API with JWT authentication
- Digitally signed audit entries
Watch out
- Runs on Linux
- Enterprise support is separate
- Configuration requires self-hosted deployment
Who it suits
It suits organizations securing existing services, remote access, operating-system logins, and SAML authentication. Linux deployments needing many token types or directory sources may find its modular design appropriate.
Verdict
privacyIDEA provides broad two-factor authentication choices, integrations, and audit controls in an open-source Linux server. Organizations can deploy the software themselves or choose NetKnights Enterprise support plans.
Plans and prices
From privacyIDEA's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Small Business | €165 a month | 1 productive installation · 1-200 users (or more) · 8x5 support · 8h response time · 165 € /Month |
| Enterprise | €556 a month | 1 productive installation · 1-2000 users (or more) · 8x5 support · 4h response time · one consulting day a year · SCIM Resolver · 556 € /Month |
| Provider | €2,275 a month | unlimited installations in own datacenter · all users included · 12x5 support · 4h response time · 3 consulting days per year · HSM · 2275 € /Month |
The facts
Each one read from privacyIDEA's own pages, with the date it was checked.
What it does
- API
- The system provides a REST API with JWT authentication for scripting and integration into web portals.checked 7 Oct 2026
- Audit security
- Audit entries are digitally signed and checked against deletion, and token secrets in the database are AES encrypted.checked 7 Oct 2026
- Authentication methods
- Supported token types include passkeys and WebAuthn, push, HOTP/TOTP, email and SMS OTP, U2F, YubiKey, SSH keys, and X.509 certificates.checked 7 Oct 2026
- Databases
- The documentation lists SQLite, MySQL, PostgreSQL, Oracle, DB2, and MariaDB as supported SQL databases.checked 7 Oct 2026
- Deployment
- The project provides source code on GitHub and installation through PyPI; its downloads page recommends pip for Debian and other Linux distributions.checked 7 Oct 2026
- Integrations
- Listed integrations include Keycloak, Microsoft ADFS, simpleSAMLphp, FreeRADIUS, Windows desktop login, Linux PAM, Apache2, OpenVPN, ownCloud, Nextcloud, WordPress, and TYPO3.checked 7 Oct 2026
- Intended users
- The product is presented for organizations securing existing services such as remote access, operating system logins, and SAML authentication.checked 7 Oct 2026
- Management
- It provides a WebUI for configuration, central token management, and user self-service, with behavior configurable through policies and event handlers.checked 7 Oct 2026
- Open source
- The software runs on Linux and is licensed under AGPLv3.checked 7 Oct 2026
- Purpose
- privacyIDEA is a modular authentication server for adding two-factor authentication to applications, VPNs, remote access, SSH, websites, and web portals.checked 7 Oct 2026
- Support
- NetKnights Enterprise Edition includes professional support and service level agreements, and its support contract runs for one year.checked 7 Oct 2026
- User sources
- It can read users from LDAP, Active Directory, SQL databases, flat files, and SCIM services.checked 7 Oct 2026
The company
- Headquarters
- Kassel, Germanychecked 28 Sep 2026
- Maker
- NetKnights GmbH describes itself as an independent IT security company and says it was founded in Kassel in May 2014.checked 7 Oct 2026
Alternatives to privacyIDEA
- 1
Duo Mobile
Free planAndroidiOS7.7From $3 a month - 2
HYPR Authenticate
AndroidiOSWebAPI7.5From $3 a month - 3
LoginTC
Free planAndroidiOSWebAPI7.5From $36 a year - 4
IBM Verify
AndroidiOSWebAPI7.3From $15,899.29 a year - 5
OpenOTP Authentication Server
Free planAndroidiOSLinuxmacOS7.3Free plan - 6
Protectimus MFA
Free planAndroidiOSWebAPI7.3From $2 a month