Keycloak
by Keycloak · Open source identity and access management with single sign-on
BenchRank score
Screenshots of Keycloak
Homepage
Overview
Keycloak is an open source identity and access management server. Applications delegate login to it, so they do not handle login forms, authenticate users or store them, and one session covers every connected application until single sign-out. It supports OpenID Connect, OAuth 2.0 and SAML, connects to LDAP or Active Directory, and is managed from an admin console.
- Best for
- Teams self-hosting single sign-on and user management for their own applications and services.
- Pricing
- The captured page shows no prices; Keycloak is described as open source and offered as a download.
- Runs on
- Linux
Strengths and trade-offs
Strengths
- Single sign-on and single sign-out across connected applications
- Supports OpenID Connect, OAuth 2.0 and SAML 2.0
- Connects to existing LDAP or Active Directory directories
- Social login and identity brokering configured without code
Trade-offs
- You run, cluster and scale the server yourself; no hosted option shown
- Users held in other stores need a provider you implement yourself
- Customisation beyond the console's settings requires writing code
How Keycloak markets itself
A structured read of the promise, proof and page design on Keycloak’s captured homepage.
Homepage capture
“Identity and Access Management”
- Angle: Open source / ownership
- Hero: Abstract graphic
Pricing
Published plans and prices from Keycloak’s own pricing page.
How this score is made up
Each dimension is scored out of 100 and combined into the headline score using fixed weights.
MCP support
Whether an agent can drive the product through the Model Context Protocol, and how much setup that takes.
API quality
Public API surface: machine-readable spec, official SDKs, documented auth, errors, rate limits and versioning.
Documentation
Publicly reachable docs — coverage, freshness, code samples and machine readability.
Agent friendliness
How readable the site is to an automated client: llms.txt, structured data, server-rendered content, crawler access.
Changelog
A public, dated record of what shipped and when — the clearest signal that a product is still alive.
Marketing site structure
Whether the site answers a buyer's questions: clear positioning, the pages that matter, and accessibility.
Page speed
How fast the site loads for real visitors: Chrome UX Report 75th-percentile LCP, INP and CLS, with a Lighthouse mobile run standing in where a site has too little traffic for field data.
Operational trust
Status page and incident history, security disclosure, compliance and data-processing documentation.
Measured, but not part of the score
Useful to know, but not a mark for or against the product — so these do not affect the ranking.
Openness
Source availability, self-hosting, data export and open standards. Scored and shown, but not part of the composite — paid SaaS is not worse for being paid SaaS.
Maintenance
Release cadence and repository activity. Scored and shown, but not part of the composite — it is only measurable for open repositories.
This doesn’t look right — report a problem with Keycloak’s score
Where this comes from
The Keycloak pages BenchRank reads when it scores the product — its documentation, release notes, status and security pages, and its repository where there is one.
Alternatives in Identity & Access Management
Ranked 1
77 — BenchRank score out of 100Ory
Ory · API-first identity and access management, self-hosted or managed
Best for: Engineering teams wanting API-first identity and access management they can self-host or buy as SaaS
Ranked 2
73.9 — BenchRank score out of 100Logto
Logto · Open-source auth infrastructure with SSO, RBAC and multi-tenancy
Best for: Developers adding auth, enterprise SSO and multi-tenancy to SaaS or AI apps without building it
Ranked 3
70.9 — BenchRank score out of 100Hexclave
Hexclave · Open-source auth, payments, email and analytics building blocks
Best for: Startups wanting auth, payments, emails and analytics as one open-source, self-hostable platform.
Is this your product?
Claim Keycloak to manage its profile. Claiming lets you suggest edits to the descriptive fields — it never changes scores or rankings.