# Keycloak

44 Hacker News commenters recommended Keycloak and 20 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Free, open-source identity server for self-hosted logins and SSO, valued as mature and extensible. Common caveat: complex to configure and run.

## Why people recommend it

- Mature, time-proven, safe choice (2 comments): "being older and time-proven for an IdP is a major positive." ([source](https://news.ycombinator.com/item?id=48820443)) "KeyCloak was donated to CNCF so a safe choice" ([source](https://news.ycombinator.com/item?id=48819714))
- Self-hosted full product, not SaaS (3 comments): "I got pretty much everything I'm self-hosting like that via keycloak" ([source](https://news.ycombinator.com/item?id=46399836)) "I can plug external identity providers to it. It's not SaaS." ([source](https://news.ycombinator.com/item?id=46456883)) "stick with KeyCloak that offers a full self hosted product" ([source](https://news.ycombinator.com/item?id=48670987))
- Extensible and feature rich (2 comments): "Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be" ([source](https://news.ycombinator.com/item?id=45915860)) "Keycloak is more feature rich." ([source](https://news.ycombinator.com/item?id=49481151))
- Solid and good enough for most (3 comments): "even if you don't want to roll your own Keycloak is good enough for just about everyone" ([source](https://news.ycombinator.com/item?id=49481098)) "not that hard to configure and rock solid" ([source](https://news.ycombinator.com/item?id=46000999)) "Keycloak really is amazingly good." ([source](https://news.ycombinator.com/item?id=49487199))

## What people warn about

- Complex configuration and heavy Java monolith (3 comments): "running and managing and possibly misconfiguring a keycloak java monolith would be exactly what I'd want to avoid" ([source](https://news.ycombinator.com/item?id=46400121)) "The sheer complexity of Keycloak's configuration and deployment vs. something like ORY's Hydra was night and day." ([source](https://news.ycombinator.com/item?id=45919071)) "Keycloak is a big complex java app that does everything in one service" ([source](https://news.ycombinator.com/item?id=49482819))
- Unstable: uptime bugs, crash loops (2 comments): "I've had really bad experiences with weird uptime bugs and crash loops" ([source](https://news.ycombinator.com/item?id=48820348)) "Having dealt with Keycloak in production it's not that great. Maybe if it didn't use Infinispan and JGroups internally." ([source](https://news.ycombinator.com/item?id=48672954))
- Clunky UI and data model (2 comments): "Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be" ([source](https://news.ycombinator.com/item?id=45915860)) "Keycloak was too clunky and cumbersome for us to use, also hard to scale" ([source](https://news.ycombinator.com/item?id=45916117))

## Alternatives hackers recommend

- [Authentik](https://hackerapproved.com/p/authentik.md): 14 recommend
- [FreeIPA](https://hackerapproved.com/p/freeipa.md): 14 recommend
- [Okta](https://hackerapproved.com/p/okta.md): 11 recommend
- [Microsoft Entra](https://hackerapproved.com/p/microsoft-entra.md): 8 recommend
- [Ory](https://hackerapproved.com/p/ory.md): 8 recommend

## Cite as

Hacker Approved, "Keycloak", https://hackerapproved.com/p/keycloak/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).