Keycloak
96 · HealthyIdentity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Open source alternatives to Auth0
9 open source projects replace Auth0, ranked by how safe each is to depend on.
authentik
91 · HealthyIdentity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Logto
86 · HealthyAuth and identity service for SaaS and AI apps, built on OIDC with organizations and RBAC.
ZITADEL
84 · HealthyMulti-tenant identity platform with event-sourced audit trail and B2B organizations.
Hanko
84 · HealthyAuthentication server with passkeys, passwords, social login and drop-in web components.
Better Auth
83 · HealthyTypeScript authentication framework with email and social login, passkeys, two-factor, organizations and SSO plugins.
Ory Kratos
78 · StableHeadless identity and user-management server with an API-first design.
Pocket ID
78 · StableLightweight OpenID Connect provider that signs users in to your apps with passkeys only.
SuperTokens
74 · StableAuthentication backend with prebuilt UI, sessions and multi-tenancy.
Keycloak
96 · Healthy
authentik
91 · Healthy
Logto
86 · Healthy
ZITADEL
84 · Healthy
Hanko
84 · Healthy
Better Auth
83 · HealthyAt a glance
Health and license are separate verdicts: a project can be well maintained and still not be open source.
| Project | Health | License | Stars |
|---|---|---|---|
| Keycloak | 96 · Healthy | Free to useApache-2.0 | 37k |
| authentik | 91 · Healthy | Free core, paid extrasMIT | 26k |
| Logto | 86 · Healthy | Free core, paid extrasMPL-2.0 | 15k |
| ZITADEL | 84 · Healthy | Free, share hosted changesAGPL-3.0Relicensed 2025 | 15k |
| Hanko | 84 · Healthy | Free, share hosted changesAGPL-3.0 | 9.0k |
| Better Auth | 83 · Healthy | Free to useMIT | 30k |
| Ory Kratos | 78 · Stable | Free to useApache-2.0 | 14k |
| Pocket ID | 78 · Stable | Free to useBSD-2-Clause | 9.5k |
| SuperTokens | 74 · Stable | Free core, paid extrasApache-2.0 | 15k |
Features compared with Auth0
Auth0's main features, and whether each open source alternative has them.
| Feature | Auth0B2C Essentials plan | Keycloak12 of 13 free | authentik12 of 13 free | Logto11 of 13 free | ZITADEL12 of 13 free | Hanko5 of 13 free | Better Auth9 of 13 free | Ory Kratos5 of 13 free | Pocket ID5 of 13 free | SuperTokens5 of 13 free |
|---|---|---|---|---|---|---|---|---|---|---|
| Hosted login pages | IncludedUniversal Login | YesThemeable login pages | YesCustomisable flows | Yes | Yes | YesDrop-in web components | NoA library; you build the screens | PartlyBring your own UI; reference UI included | Yes | YesPre-built UI |
| Social login | Included | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
| Multi-factor authentication | Included | YesOTP and WebAuthn | YesTOTP, WebAuthn and Duo | Yes | Yes | YesTOTP and security keys | YesTwo-factor plugin | YesTOTP and WebAuthn | PartlyPasskeys replace passwords and second factors | Paid editionPaid add-on |
| Passkeys and passwordless | Included | Yes | Yes | Yes | Yes | YesPasskey-first | YesPasskey and magic link plugins | Yes | YesPasskeys only | Yes |
| Enterprise SSO for your customers | Higher planSAML and OIDC connections, Professional | YesSAML and OIDC identity brokering | YesSAML and OIDC sources | YesIdP-initiated SSO is Cloud only | YesSAML and OIDC per organization | Not checked | YesSSO plugin with SAML and OIDC | PartlyOIDC free; SAML on Ory Network | No | Not checked |
| Organizations (B2B tenants) | Included10 organizations | Yes | Not checked | Yes | YesBuilt for multi-tenant B2B | No | YesOrganization plugin | Not checked | No | Paid editionMulti-tenancy add-on |
| Roles and permissions | Included | Yes | Yes | Yes | Yes | Not checked | YesAccess control plugin | PartlyThrough Ory Keto | PartlyUser groups | Yes |
| Machine-to-machine tokens | Higher planAdd-on | YesClient credentials | YesClient credentials | Yes | YesService users | Not checked | PartlyAPI key plugin | PartlyThrough Ory Hydra | Not checked | Not checked |
| Custom code in login flows | IncludedActions | YesJava extensions (SPIs) | YesPython expression policies | YesCustom JWT claims and webhooks | YesActions | PartlyWebhooks | YesHooks | YesWebhooks in flows | No | YesBackend overrides |
| Breached password detection | Higher planProfessional plan | NoPassword policies only | YesHave I Been Pwned policy | Not checked | Not checked | Not checked | YesHave I Been Pwned plugin | YesHave I Been Pwned check | Not checked | Paid editionAttack protection add-on |
| User management console | Included | Yes | Yes | PartlyNo console MFA or team invites | Yes | Not checked | PartlyAdmin plugin APIs; no dashboard | NoAPI only when self-hosted | Yes | PartlyFree for 3 dashboard users |
| OAuth 2.0 and OIDC provider | Included | YesOIDC and SAML | YesOIDC, SAML, LDAP and RADIUS | YesOIDC; SAML apps limited to 3 | YesOIDC and SAML | No | YesOIDC provider plugin | PartlyThrough Ory Hydra | YesOIDC only | Paid editionOAuth2 provider add-on |
| Audit logs | Limited5 days of logs | YesLogin and admin events | Yes | Yes | YesEvent-sourced audit trail | Yes | Not checked | Not checked | Yes | Not checked |
✓ has it · ◐ partly · $ only on a higher plan or paid edition · ✕ doesn't have it. "Free" counts the Auth0 features an alternative has without paying.
Sources
- Auth0, checked 2026-10-09: auth0.com
- Keycloak, checked 2026-10-09: keycloak.org, keycloak.org
- authentik, checked 2026-10-09: docs.goauthentik.io, goauthentik.io
- Logto, checked 2026-10-09: docs.logto.io, docs.logto.io
- ZITADEL, checked 2026-10-09: zitadel.com, github.com
- Hanko, checked 2026-10-09: docs.hanko.io, github.com
- Better Auth, checked 2026-10-09: better-auth.com, better-auth.com
- Ory Kratos, checked 2026-10-09: ory.sh, ory.sh
- Pocket ID, checked 2026-10-09: pocket-id.org, github.com
- SuperTokens, checked 2026-10-09: supertokens.com, supertokens.com
More in Auth & identity
Auth0 is a paid auth & identity product. See all open source auth & identity tools, ranked the same way.
Scores last refreshed from GitHub on 9 October 2026. How we score.