← Directory

Keycloak

Keycloak is an open-source Identity and Access Management platform for adding authentication to self-hosted applications.

  • Other
  • Security
  • Tools & Utilities
Keycloak is an open-source Identity and Access Management platform for adding authentication to self-hosted applications. It lets you secure services and manage user login with minimal effort, removing the need to store users or build custom authentication logic.

Platform availability

Available on 4 of 6 install platforms

Also on Docker Hub and GitHub

Health score

90/100 Excellent

Maintained
100last commit 7 days ago
Popular
9137,037 GitHub stars
Easy to install
654 install platforms, install notes, Docker image
Light to run
95512 MB minimum RAM, runs on ARM
How is this calculated?

A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). Factors without data are left out and the rest are rescaled.

Availability: platform listings confirmed today, links checked 8 days ago

GitHub stars
37,037
Open issues
3264
Last commit
2026-09-28
Latest release
26.7.4
License
Apache-2.0
Activity
steady

Checked 7 days ago - source: GitHub (keycloak/keycloak)

Resources & Compatibility

Minimum requirements: 512 MB RAM, 1 GB disk. ARM (e.g. Raspberry Pi) is supported.

Checked 7 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Tell Windows what to start first If Keycloak uses an external database, add the database and network services to the service's dependency list (--depends-on) during install. This list tells Windows to start those background programs first, so Keycloak doesn't fail or show login errors because its database isn't running yet. source
  • Delay Keycloak's automatic start Install the Windows service with the delayed-automatic start option so Keycloak starts a few seconds after Windows boots. This gives the database and network time to come up, reducing first-boot failures. source
  • Start the service after installing After the service is installed, run net start keycloak in an administrator command prompt to start it immediately. Without this, Keycloak may remain installed but not running, so the login page won't be available until the next reboot. source

Fetched 7 days ago - each note links to its source

Alternatives (12)

  • Auth0 - You can connect any application (written in any language or on any stack) to Auth0 and define its Connection, the method used to authentica…
  • Authelia - Authelia is an open-source authentication and authorization server that provides login, multi-factor authentication, and single sign-on for…
  • Tinyauth - Tinyauth is a lightweight OpenID Connect authentication and authorization server that adds login and access controls to self-hosted apps be…
  • VoidAuth - VoidAuth is an open-source authentication platform for self-hosted applications.
  • ZITADEL - Zitadel is an open-source identity and access management platform for self-hosted services, teams, and customers.
  • authelia-admin-control-panel
  • authentik - Authentik is an open-source identity provider that adds flexible single sign-on, user management, and common sign-in protocol support to se…
  • authentik-ldap - Authentik-LDAP is a Lightweight Directory Access Protocol (LDAP) interface that exposes Authentik users and groups to legacy applications r…
  • authportal - AuthPortal is a lightweight, self-hosted authentication gateway for Plex users.
  • casdoor - Casdoor is an open-source, multi-tenant, and cloud-native identity and access management (IAM) solution.
  • openam - OpenAM is a security tool that lets you log in once to access multiple different apps.
  • pocket-id - A simple OIDC provider that allows users to authenticate with their passkeys to your services.

Checked 4 days ago - source: AlternativeTo

Common questions

Why might the Keycloak Docker image not be on Docker Hub?

The official container image is hosted on Quay rather than Docker Hub. Red Hat, which also develops Keycloak, uses Quay as its open source registry.

What startup dependencies should I configure if Keycloak runs as a Windows service with an external database?

Add the database and network services to the Windows service dependency list. You can also use delayed automatic start, and after installing run the service start command to begin Keycloak immediately.

Can Keycloak authenticate users from an existing LDAP or Active Directory server?

Yes, Keycloak has built-in support for connecting to existing LDAP or Active Directory servers. It also allows custom providers for other user stores, such as a relational database.

Where can I find upgrade instructions for Keycloak?

The official documentation includes an upgrading guide for the Keycloak server and adapters.

Answers sourced from github.com, www.keycloak.org, www.keycloak.org, www.reddit.com

Community

Collected yesterday - public community threads