Keycloak
Hacker ApprovedThe most recommended of 12 identity providers
Free, open-source identity server for self-hosted logins and SSO, valued as mature and extensible. Common caveat: complex to configure and run.
Free, open-source identity server for self-hosted logins and SSO, valued as mature and extensible. Common caveat: complex to configure and run.
64 people gave an opinion
- recommend it
- 44
- criticize it
- 20
- approval share
- 69%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 44 people recommend itNeeds 10 or more, met.
- 2.2 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Mature, time-proven, safe choice
“being older and time-proven for an IdP is a major positive.”
Comment from 7 Jul 2026 in “Better Auth is joining Vercel” “KeyCloak was donated to CNCF so a safe choice”
Comment from 7 Jul 2026 in “Better Auth is joining Vercel” Self-hosted full product, not SaaS
“I got pretty much everything I'm self-hosting like that via keycloak”
Comment from 27 Dec 2025 in “Exe.dev/” “I can plug external identity providers to it. It's not SaaS.”
Comment from 1 Jan 2026 in “Ask HN: How Are You Handling Auth in 2026?” “stick with KeyCloak that offers a full self hosted product”
Comment from 25 Jun 2026 in “Cloudflare launched self-managed OAuth for all” Extensible and feature rich
“Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be”
Comment from 13 Nov 2025 in “Kratos - Cloud native Auth0 open-source alternative (self-hosted)” “Keycloak is more feature rich.”
Comment from 28 Aug 2026 in “I used AWS cognito for a startup. I wouldn't do it again” Solid and good enough for most
“even if you don't want to roll your own Keycloak is good enough for just about everyone”
Comment from 28 Aug 2026 in “I used AWS cognito for a startup. I wouldn't do it again” “not that hard to configure and rock solid”
Comment from 21 Nov 2025 in “Okta's NextJS-0auth troubles” “Keycloak really is amazingly good.”
Comment from 29 Aug 2026 in “I used AWS cognito for a startup. I wouldn't do it again”
What people warn about
Each mark is one comment
Complex configuration and heavy Java monolith
“running and managing and possibly misconfiguring a keycloak java monolith would be exactly what I'd want to avoid”
Comment from 27 Dec 2025 in “Exe.dev/” “The sheer complexity of Keycloak's configuration and deployment vs. something like ORY's Hydra was night and day.”
Comment from 13 Nov 2025 in “Kratos - Cloud native Auth0 open-source alternative (self-hosted)” “Keycloak is a big complex java app that does everything in one service”
Comment from 28 Aug 2026 in “I used AWS cognito for a startup. I wouldn't do it again” Unstable: uptime bugs, crash loops
“I've had really bad experiences with weird uptime bugs and crash loops”
Comment from 7 Jul 2026 in “Better Auth is joining Vercel” “Having dealt with Keycloak in production it's not that great. Maybe if it didn't use Infinispan and JGroups internally.”
Comment from 25 Jun 2026 in “Cloudflare launched self-managed OAuth for all” Clunky UI and data model
“Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be”
Comment from 13 Nov 2025 in “Kratos - Cloud native Auth0 open-source alternative (self-hosted)” “Keycloak was too clunky and cumbersome for us to use, also hard to scale”
Comment from 13 Nov 2025 in “Kratos - Cloud native Auth0 open-source alternative (self-hosted)”
Other identity providers people recommend
The four most recommended other identity providers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| KeycloakThis page | 44 | 20 | 69% | 12 | — | Approved |
| Authentik | 14 | 0 | 100% | 11 | — | Approved |
| FreeIPA | 14 | 7 | 67% | 4 | — | Approved |
| Okta | 11 | 47 | 19% | 7 | — | — |
| Microsoft Entra | 8 | 18 | 31% | 6 | — | — |
What people said
40 of the 70 comments that mention it, newest first. Each links to the original comment.
“You can use Keycloak as a SAML/OIDC -adapter.”
“Keycloak really is amazingly good.”
“Keycloak is a big complex java app that does everything in one service”
“I like Keycloak a lot but didn't select them because I cannot use my own frontend framework.”
“Keycloak is more feature rich.”
“even if you don't want to roll your own Keycloak is good enough for just about everyone”
“it's definitely not bad, but there are times when it's been frustrating, and getting it both stable and scalable seem to be incompatible goals”
“start with an open source solution like Keycloak or authentic and fork it”
“I've set it up today with OIDC AuthN (Keycloak)”
“Setting up a Keycloak instance as opposed to handing over login credentials to Octa should be a consideration”
“the documentation gave me too little guidance”
“being older and time-proven for an IdP is a major positive.”
“I've had really bad experiences with weird uptime bugs and crash loops”
“I wish I had just picked up Keycloak and stuck with it”
“KeyCloak was donated to CNCF so a safe choice”
“Having dealt with Keycloak in production it's not that great. Maybe if it didn't use Infinispan and JGroups internally.”
“KeyCloak is great if you want a full stack Java server to run internal workforce”
“stick with KeyCloak that offers a full self hosted product”
“only takes a fraction of what Keycloak needs”
“Tell me one feature that is not supported by libraries like OpenIddict (You can build around) or Keycloak?”
“they all really needed the 6 months to whip it into shape”
“it worked fine - a little dated but functional”
“it was a lot of work to manage keycloak configs with the IaC pipeline”
“even things like Keycloak/FreeIPA are only partial solutions”
“it was annoying to setup but worked okay in practice”
“Put it all behind an OAuth login using something like Keycloak”
“perhaps have setup instructions to use something like Keycloak or the Ory system”
“There are for example products like keycloak. OpenID/OAuth2/Token/Security IdP in a box.”
“I can plug external identity providers to it. It's not SaaS.”
“I personally use it, as it's so easy to run and integrate with social auth”
“running and managing and possibly misconfiguring a keycloak java monolith would be exactly what I'd want to avoid”
“I got pretty much everything I'm self-hosting like that via keycloak”
“not that hard to configure and rock solid”
“The sheer complexity of Keycloak's configuration and deployment vs. something like ORY's Hydra was night and day.”
“I wanted to escape the Kratos hell by migrating to Keycloak”
“Keycloak is much better than the Java apps I have had to operate”
“we could just write our own code plugging directly into / replacing parts of Keycloak”
“I've used environment variables to configure keycloak. Worked for me.”
“Keycloak was too clunky and cumbersome for us to use, also hard to scale”
“Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.