Every engineering team that builds its own login system eventually asks the same question: pay a SaaS identity vendor by the monthly active user, or run the auth server yourself. In 2026, three open-source projects dominate that second path, and they are not interchangeable. Keycloak is the 35,700-star Java veteran that CERN and the Austrian government run at scale. Ory is the Go-based, API-first stack that OpenAI picked to authenticate ChatGPT’s roughly 900 million weekly users. Zitadel is the newer, SOC 2-certified challenger built for B2B SaaS multi-tenancy from day one. This comparison breaks down the versions, pricing, database requirements, CVEs, and real production deployments of all three, so you can pick the one that actually fits your stack instead of the one with the loudest GitHub README.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Keycloak vs Ory vs Zitadel: the quick verdict
If you need one sentence: Keycloak wins on maturity and admin-console convenience for enterprise realms, Ory wins on scale and headless flexibility for teams that want to build their own UI, and Zitadel wins on native multi-tenancy and compliance for B2B SaaS products launching today. None of the three is objectively “best” — each optimizes for a different failure mode, and picking wrong means a migration project eighteen months from now.
Keycloak, now at version 26.7.4 after Keycloak.org shipped that release in September 2026 (following 26.7.0 in July, then 26.7.2 and 26.7.3 across August), and carrying roughly 35,700 GitHub stars, is a Java/Quarkus server with a full admin console, realm-based multi-tenancy, and first-party support from Red Hat. Ory splits its identity stack into separate Go services — Kratos for identity, Hydra for OAuth2/OIDC — that together hold more than 30,000 combined GitHub stars across the ecosystem and power OpenAI’s login flow at a claimed 900 million weekly active users. Zitadel, at version v4.17.1 with about 14,800 stars, is the youngest of the three but the only one with SOC 2 Type II and ISO 27001:2022 certification baked into its managed cloud from day one.
What Keycloak, Ory, and Zitadel actually are
Keycloak started as a Red Hat/JBoss project and became a CNCF incubating project. It ships as a single Quarkus-powered server binary with a built-in admin UI, a login theme engine, and realms that isolate tenants inside one deployment. If you want SSO, SAML, OpenID Connect, and LDAP federation out of the box with a web console your ops team can click through, Keycloak is built for exactly that.
Ory takes the opposite architectural bet. Instead of one monolith, Ory ships four independent, API-only services written in Go: Kratos (identity, registration, login, account recovery), Hydra (OAuth2 and OpenID Connect provider), Keto (fine-grained authorization modeled on Google Zanzibar), and Oathkeeper (an identity-aware reverse proxy). There is no built-in login screen — you build your own frontend against Ory’s REST/gRPC APIs, which is precisely why API-heavy platforms like OpenAI and Klarna chose it.
Zitadel is the newest entrant, designed from the start for B2B SaaS. Its core differentiator is native “Organizations” — first-class multi-tenant containers with their own admins, branding, and identity providers — versus Keycloak’s realms, which were not originally designed for thousands of self-service tenants. Zitadel is also event-sourced on PostgreSQL, which the vendor says removes the need for a separate session cache layer that Keycloak and some Ory deployments rely on.
Keycloak vs Ory vs Zitadel: full specs comparison table
| Category | Keycloak | Ory (Kratos/Hydra/Keto) | Zitadel |
|---|---|---|---|
| Latest version (Aug 2026) | 26.7.2 | Kratos/Hydra 26.2.0 (calendar versioning) | v4.17.1 (Aug 14, 2026) |
| Language / runtime | Java, Quarkus distribution | Go | Go |
| GitHub stars | ~35,700 | Kratos ~13,800 + Hydra ~17,500 (~30k combined ecosystem) | ~14,800 |
| Architecture | Single server, realm-based multi-tenancy | Split microservices, headless/API-only | Single binary, event-sourced, native Organizations |
| Built-in login UI | Yes, themeable console | No — bring your own frontend | Yes, plus headless option |
| Required database | PostgreSQL 14-18, MySQL 8.0/8.4, MSSQL 2019/2022, Oracle 19c/23.x | PostgreSQL, MySQL, or CockroachDB (SQLite unsupported in production) | PostgreSQL 14-18 only |
| Self-hosted license cost | $0, Apache 2.0, unlimited users | $0, Apache 2.0, open-source components free | $0, Apache 2.0, self-hosted free |
| Managed cloud entry price | N/A (no first-party cloud) | Free dev tier; Production $770/year | Free tier ($0, 100 DAU); Pro from $100/mo |
| Compliance (cloud) | N/A | Not publicly listed in gathered sources | SOC 2 Type II, ISO 27001:2022 |
| Fine-grained authorization | Realm/role/policy-based (via Authorization Services) | Ory Keto (Zanzibar-style relationship graph) | Built-in roles + project grants |
| Native multi-tenancy for B2B SaaS | Realms (not built for thousands of self-serve tenants) | Manual, via namespaces/projects | Organizations (native, unlimited) |
| 2025-2026 CVEs found | 10+ published, top CVSS 8.2 | None surfaced in current vulnerability databases | None surfaced in current vulnerability databases |
| CNCF status | Incubating project | Not a CNCF project | Not a CNCF project |
| Best documented reference deployment | CERN: 300k users, 13k clients | OpenAI Hydra: ~900M weekly active users | T-Systems International (12k employees) |
Keycloak deep dive: the enterprise-tested default
Keycloak’s biggest asset is time in production. The project’s own case studies page lists CERN running Keycloak SSO for 300,000 users and 13,000 OAuth clients across the world’s largest particle physics laboratory. Austria’s federal IT provider BRZ migrated the Austrian Business Service Portal (USP), a central eGovernment platform, onto Keycloak to authenticate more than 2 million citizens across 130-plus public services. Hitachi uses Keycloak as the FAPI-conformant authorization server behind an API management cloud service for Japanese banks. Brazil’s Instituto Federal do Triângulo Mineiro (IFTM) modernized its login and Gov.br integration on Keycloak for more than 12,000 active users, a case study documented by the CNCF.
That maturity comes with a maintenance tail. Keycloak’s 2025-2026 CVE history includes several disclosures worth knowing before you deploy: CVE-2025-3501 (CVSS 8.2), where trust-store certificate verification could be skipped under a specific policy setting; CVE-2025-11419 (CVSS 7.5), an unauthenticated denial-of-service via repeated TLS 1.2 client-initiated renegotiation; CVE-2025-7365 (CVSS 7.1); and lower-severity issues like CVE-2025-11537 (CVSS 5.0, sensitive headers leaking into verbose logs) and CVE-2025-10044 (CVSS 4.3, a phishing vector via unsanitized error-page text). None of these are catastrophic on their own, but the volume — more than ten disclosed issues in roughly a year — reflects the reality of running the most widely deployed open-source IAM server: it is also the most widely attacked.
Keycloak officially supports PostgreSQL 14-18, MySQL 8.0/8.4 LTS, MariaDB, Microsoft SQL Server 2019/2022, and Oracle 19c/23.x — the widest database compatibility list of the three, which matters if your organization already has a hard requirement around MSSQL or Oracle.
Ory deep dive: the API-first stack behind OpenAI’s login
Ory’s headline reference deployment is hard to beat on scale: according to Ory’s own published case study, OpenAI adopted an Ory Enterprise License for Ory Hydra to support authentication at ChatGPT’s scale, reported at roughly 900 million weekly active users. Ory’s Kratos README also lists named organizations that have contributed to or adopted the ecosystem, including Fandom, Klarna, Cisco, Mistral, Axel Springer, Raspberry Pi Foundation, Sainsbury’s, Arduino, and T. Rowe Price.
The tradeoff for that scale is that Ory gives you almost nothing visually. Kratos and Hydra are pure APIs — there is no admin console screen where a support engineer resets a user’s password by clicking a button. Every login page, recovery flow, and consent screen is something your frontend team builds against Ory’s REST or gRPC endpoints. Teams that already have a design system and frontend capacity find this liberating; teams that want to stand up SSO in an afternoon find it slower to start.
Ory’s self-hosted OSS components (Kratos, Hydra, Keto, Oathkeeper) are completely free under Apache 2.0 and officially support PostgreSQL, MySQL, and CockroachDB as production backends — Ory’s own documentation is explicit that SQLite should never be used in production. For teams that don’t want to run the infrastructure themselves, Ory Network is the managed cloud offering, and Ory Corp has raised at least $22.5 million in a 2021 Series A led by Insight Partners, with a reported (unconfirmed valuation) Series B round of roughly $11 million on June 20, 2026 led by PHX Ventures.
Zitadel deep dive: built for multi-tenant SaaS from day one
Zitadel is the only one of the three that ships SOC 2 Type II (achieved January 2026) and ISO 27001:2022 (June 2024) certification on its managed cloud out of the box, which is why it shows up disproportionately often in vendor-selection shortlists for regulated B2B SaaS companies that can’t wait a year for a compliance audit of a self-hosted stack.
Its real-world case studies skew smaller and newer than Keycloak’s government-scale deployments, which fits its positioning: Money Key, a Swiss fiduciary financial-management tool, uses Zitadel for B2B customer authentication and delegated authorization. BLP Digital reports a 70% faster B2B integration timeline for document automation after adopting Zitadel. Kaspar&, a Swiss fintech startup, and Chapati Systems GmbH, which runs Zitadel fully self-hosted for internal and external identity, are both documented case studies. Enterprise-scale adopters tracked by third-party technology databases include T-Systems International, a German IT services firm with roughly 12,000 employees.
Architecturally, Zitadel requires PostgreSQL 14 or later — no other database is officially supported. That’s a meaningful constraint versus Keycloak’s five-database compatibility list, but Zitadel’s team argues its event-sourced, relational design removes the need for a separate Redis-style session cache that some Keycloak and Ory deployments add for horizontal scaling. Zitadel notably migrated its own cloud from CockroachDB to PostgreSQL, a move it documented publicly as a reliability and ecosystem-maturity decision.
Pricing comparison: self-hosted vs managed cloud
All three tools are free and open source to self-host under permissive licenses — there is no license fee gap here, only an infrastructure and ops-time gap. That said, the ecosystem around Keycloak isn’t entirely free of a pricing ladder: pricing tracker pricetrack.dev logged a $0 Freemium tier for Keycloak-based hosting in May 2026, alongside a $225/month Starter plan and a $1,440/month Premium plan from the same tracker, well above what Ory Network or Zitadel Cloud charge at comparable usage. The real pricing comparison is what happens if you don’t want to run the servers yourself.
| Plan | Keycloak | Ory Network | Zitadel Cloud |
|---|---|---|---|
| Self-hosted, open source | $0, unlimited users | $0, unlimited users (Kratos/Hydra/Keto/Oathkeeper) | $0, unlimited users |
| Free managed tier | Not offered directly by the project | Developer tier: free | $0/month, 100 daily active users included, unlimited total users, MFA, passkeys, audit logs, 3 external IdPs |
| Entry paid tier | N/A | Production: $770/year, includes $21/month credit, then $0.14 per active daily user/month | Pro: starts at $100/month, includes 25,000 DAU, 3 external IdP connections, 500,000 management API requests, 3 admins |
| Mid tier | N/A | Growth: $9,350/year, $255/month credit, $0.12 per aDAU/month | Usage overage billed per unit above included Pro amounts |
| Enterprise | Third-party support (e.g., Red Hat build of Keycloak, Phase Two managed hosting) | Custom, contact sales | Enterprise Cloud / Enterprise Self-Hosted: custom base + usage, unlimited MAU/orgs/clients included in base |
| Reference SaaS cost comparison | Okta Workforce SaaS runs $6-$17 per user/month with a roughly $1,500/month minimum — Keycloak self-hosted is $0 in licensing at any user count | N/A | N/A |
The practical read: if your team already runs Postgres and Kubernetes competently, self-hosting any of the three costs you nothing in licensing and only pays for the compute and the engineer-hours to keep it patched. If you’d rather not own that operational surface, Zitadel’s $100/month Pro tier with 25,000 included daily active users is the cheapest fixed-price entry point of the two managed clouds compared here; Ory’s $770/year Production tier undercuts it on paper but layers metered per-user and per-token charges on top once you exceed the included credit.
Real-world examples: who runs what in production
- CERN runs Keycloak SSO across 300,000 users and 13,000 OAuth clients for the world’s largest particle physics laboratory.
- OpenAI uses an Ory Enterprise License of Ory Hydra to authenticate ChatGPT at a reported scale of roughly 900 million weekly active users.
- Austria’s BRZ migrated the national Business Service Portal (USP) to Keycloak, authenticating 2+ million citizens across 130-plus government services.
- Money Key, a Swiss fiduciary fintech, built its B2B customer authentication and delegated-authorization system on Zitadel.
- Hitachi uses Keycloak as a FAPI-conformant OAuth authorization server for an API management platform serving Japanese banks.
- Klarna, Cisco, Mistral, and Axel Springer appear as named organizations in Ory’s public ecosystem adopter list.
- T-Systems International, a 12,000-employee German IT services firm, is tracked as a production Zitadel user by third-party technology databases.
Migration guide: moving between Keycloak, Ory, and Zitadel
Migrating identity providers is one of the riskiest infrastructure changes a team can make, because a mistake locks users out of everything at once. Here is the sequence that keeps the blast radius small, regardless of which direction you’re migrating.
- Inventory every integration point first. List every application, API, and third-party service that currently validates tokens or checks sessions against your existing IAM server before touching anything.
- Stand up the target system in parallel, on its own database instance, without pointing any production traffic at it yet.
- Export users without exporting password hashes you can’t reuse. Keycloak, Ory, and Zitadel use different hashing schemes by default (Keycloak defaults to PBKDF2/Argon2 depending on version; Ory and Zitadel default to Argon2/bcrypt variants) — plan for a forced password reset flow or a hash-migration adapter rather than assuming a clean 1:1 hash import.
- Migrate OAuth/OIDC client registrations one application at a time, starting with your lowest-traffic internal tool, not your primary customer-facing app.
- Re-point that first application’s redirect URIs and client secrets to the new provider and run it in a staging environment against real (anonymized) traffic patterns.
- Set up dual-read authentication during the cutover window so a user session validated against the old system doesn’t get silently dropped mid-migration.
- Migrate MFA enrollments explicitly — TOTP secrets and WebAuthn/passkey credentials generally cannot be exported between providers, so budget for a re-enrollment prompt.
- Cut over DNS/reverse-proxy routing for the pilot app and monitor login success rate and support ticket volume for at least 48 hours before proceeding.
- Repeat the per-application cutover for every remaining integration, always keeping the old provider running read-only until the last app is confirmed migrated.
- Decommission the old provider only after a full billing cycle has passed with zero authentication traffic against it, to catch any forgotten service accounts or scheduled jobs.
Teams moving from Keycloak to Zitadel specifically should budget extra time for realm-to-organization remapping, since Zitadel’s Organization model doesn’t map one-to-one onto Keycloak realms. Teams moving from Keycloak or Zitadel to Ory should budget the most frontend engineering time of any migration path here, because you’re not just swapping a backend — you’re building the login UI that Keycloak and Zitadel gave you for free.
5 use cases and which tool fits each one
- Enterprise internal SSO with an ops team that wants a GUI: Keycloak. Its admin console, realm model, and LDAP/Active Directory federation are the fastest path to “employees log into everything with one password” without writing custom frontend code.
- API-first product where the frontend team already owns the design system: Ory. Kratos and Hydra hand you the identity logic as pure APIs, so your login screen looks exactly like the rest of your product instead of an IAM vendor’s default theme.
- B2B SaaS onboarding thousands of self-serve customer organizations: Zitadel. Native Organizations, per-tenant branding, and per-tenant identity provider configuration are built in rather than bolted on.
- Regulated industry that needs a compliance-certified managed cloud today: Zitadel Cloud, on the strength of its SOC 2 Type II and ISO 27001:2022 certifications, or a Red Hat-supported build of Keycloak if you need vendor accountability on a self-hosted deployment.
- Massive-scale consumer authentication where you already run Go infrastructure: Ory, following the architecture OpenAI’s team chose for Hydra at reported hundreds-of-millions-of-user scale.
- Government or public-sector portal consolidating dozens of legacy logins: Keycloak, following the precedent set by Austria’s BRZ (2M+ citizens) and Brazil’s IFTM.
- Startup that wants to avoid both frontend build time and per-seat SaaS pricing: Zitadel’s free cloud tier (100 DAU, unlimited total users) is the lowest-friction way to ship real authentication before committing engineering time to either self-hosting or a full Ory frontend build.
Pros and cons
Keycloak
Pros: largest community and deployment base of the three (~35,700 GitHub stars, now on version 26.7.4 as of September 2026), full admin console out of the box, widest database compatibility (Postgres, MySQL, MariaDB, MSSQL, Oracle), CNCF incubating project status, documented at massive scale (CERN, Austrian government).
Cons: highest published CVE count of the three in 2025-2026 (10+ disclosures, top CVSS 8.2), Java/Quarkus footprint is heavier to operate than Go binaries, realm model wasn’t designed for thousands of self-serve B2B tenants, and while the core project still has no first-party managed cloud, third-party hosting trackers like pricetrack.dev were already pricing Keycloak-based plans as high as $1,440/month for a Premium tier as of May 2026 — worth checking before assuming self-hosting is the only option.
Ory
Pros: proven at extreme scale (OpenAI/Hydra), Go performance and small footprint, headless API design gives total UI control, Zanzibar-style fine-grained authorization via Ory Keto, fully free self-hosted components.
Cons: no built-in login UI means real frontend engineering investment before you have a working product, split across four separate services to learn and operate, managed cloud pricing has metered per-user and per-token components that get harder to forecast at scale, less centralized documentation than a single-binary product.
Zitadel
Pros: only one of the three with SOC 2 Type II and ISO 27001:2022 certification on managed cloud, native multi-tenant Organizations designed for B2B SaaS from the start, generous free cloud tier (100 DAU, unlimited total users), no published CVEs found in the current search results.
Cons: smallest community of the three (~14,800 stars), strictly requires PostgreSQL with no alternative database option, fewer large-scale public case studies than Keycloak or Ory, younger project with a shorter production track record.
Database and deployment requirements compared
Database choice is often the deciding factor once teams get past the feature checklist, because it determines what your existing infrastructure team can support without adding a new database engine to their on-call rotation. Keycloak is the most flexible: official docs list PostgreSQL 14-18, MySQL 8.0 and 8.4 LTS, MariaDB, Microsoft SQL Server 2019/2022, and Oracle 19c/23.x as supported production databases, configured via the --db flag at startup.
# Keycloak: point at an existing PostgreSQL instance
bin/kc.sh start --db=postgres \
--db-url=jdbc:postgresql://db-host:5432/keycloak \
--db-username=keycloak --db-password=***Ory’s documentation states that PostgreSQL, MySQL, and CockroachDB are all fully supported for Kratos and Hydra, with an explicit warning not to run SQLite in production. Connection strings are set via a DSN prefix that determines the backend:
# Ory Kratos: DSN prefix selects the database driver
dsn: postgres://kratos:***@db-host:5432/kratos?sslmode=require
# or: mysql://kratos:***@tcp(db-host:3306)/kratos
# or: cockroach://kratos:***@db-host:26257/kratosZitadel is the strictest: its self-hosting documentation says plainly that Zitadel requires PostgreSQL — versions 14 through 18 are supported — with no alternative relational database officially available. Zitadel notably migrated its own managed cloud from CockroachDB to PostgreSQL, a change the company documented as improving operational maturity and ecosystem tooling support.
Security track record: CVEs and compliance
Security posture is not just a feature checkbox for an identity provider — it’s the entire product. Keycloak’s 2025-2026 disclosed vulnerabilities include CVE-2025-3501 (CVSS 8.2, trust-store certificate verification skipped under certain policy configurations), CVE-2025-11419 (CVSS 7.5, unauthenticated denial-of-service via TLS 1.2 renegotiation), CVE-2025-7365 (CVSS 7.1), CVE-2025-12390 (CVSS 6.0, session confusion on shared devices), CVE-2025-11429 (CVSS 5.4, delayed “Remember Me” session enforcement), CVE-2025-11537 (CVSS 5.0, credential leakage into verbose logs), CVE-2025-10044 (CVSS 4.3, phishing via unsanitized error text), and CVE-2025-12150 (CVSS 3.1, WebAuthn attestation policy bypass). This is not unusual for a project of Keycloak’s size and deployment footprint — more eyes and more attackers both find more bugs — but it does mean patch management has to be a standing operational commitment, not a one-time setup task.
Neither Ory nor Zitadel had comparable CVEs surfaced in current vulnerability databases as of this research, though that reflects smaller deployment footprints and shorter track records as much as inherently stronger code. On the compliance side, Zitadel is the clear leader for teams that need paperwork alongside code: its managed cloud carries SOC 2 Type II (achieved January 2026) and ISO 27001:2022 (June 2024) certification, which can shortcut vendor security reviews that would otherwise take months.
Performance and operational overhead
Independent benchmark data comparing raw requests-per-second across all three projects is not publicly available as a clean apples-to-apples study, and any comparison article claiming precise RPS numbers without citing a reproducible methodology should be treated with skepticism. What is documented: a peer-reviewed evaluation of Keycloak as an identity server (LACCEI 2025 conference proceedings) found it “successfully deployed with 100 to 50,000+ users in government, education, healthcare, and enterprise sectors, maintaining response times of 200-300ms under high loads” — a reasonable real-world baseline for a Java/Quarkus deployment on modest hardware.
Operationally, the three differ more in shape than in raw speed. Keycloak is one process to monitor and patch, but Java/Quarkus means more memory overhead per instance than the Go binaries behind Ory and Zitadel. Ory’s split into four services (Kratos, Hydra, Keto, Oathkeeper) means more moving parts to deploy and observe individually, though each is lighter weight on its own. Zitadel’s event-sourced architecture is designed to avoid a separate session-cache layer, which simplifies the infrastructure diagram compared to a Keycloak deployment that often adds Redis or Infinispan for session clustering at scale.
Authentication methods and protocol support
All three projects support the core modern authentication protocols, but the depth and default configuration differ enough to matter for a real integration checklist. Keycloak supports SAML 2.0, OpenID Connect, OAuth 2.0, and LDAP/Kerberos federation natively through its admin console — a legacy-heavy enterprise that still has a SAML-only vendor contract will find Keycloak the path of least resistance, since SAML support in Ory and Zitadel is comparatively newer and less battle-tested against the long tail of SAML quirks that enterprise IT teams have accumulated over two decades.
Ory’s Kratos handles passwordless and passkey (WebAuthn) flows as first-class identity methods alongside traditional passwords, and Hydra implements OAuth 2.0 and OpenID Connect as a certified provider — Ory’s OAuth2 server has held OpenID Certification since its 2.x releases. Because Kratos and Hydra are separate services, a team can adopt passwordless login through Kratos while keeping Hydra purely as a downstream OAuth token issuer for third-party API clients, which is a cleaner separation of concerns than bundling both responsibilities into one login flow.
Zitadel supports OIDC, OAuth 2.0, SAML 2.0, passwordless/WebAuthn, and social login out of the box, and its documentation markets passkey support as a first-tier feature rather than an add-on — consistent with its newer codebase not carrying the legacy weight that older SAML implementations in Keycloak sometimes do. For any of the three, multi-factor authentication (TOTP, WebAuthn security keys, and push-based MFA) is supported, but Keycloak’s MFA configuration lives in its per-realm authentication flow editor, while Ory and Zitadel expose MFA policy through API calls and dashboard toggles respectively — a meaningful difference if your compliance team wants MFA enforcement auditable through infrastructure-as-code rather than a GUI click.
Cost at scale: a worked example
Pricing pages rarely show what a specific user count actually costs, so here is a rough worked comparison at three growth stages, using each platform’s published pricing formula. Self-hosted infrastructure cost is deliberately left as “varies” because it depends entirely on your cloud provider, instance sizing, and whether you already run the required Postgres/MySQL cluster for other workloads — treat it as a labor-and-compute line item, not a fixed number.
| Scenario | Keycloak (self-hosted only) | Ory Network (managed) | Zitadel Cloud (managed) |
|---|---|---|---|
| Early-stage: ~5,000 daily active users | $0 license + infra (varies) | Free developer tier or low end of Production ($770/year base) | Fits inside the $0/month free tier if DAU stays near 100; otherwise Pro tier ($100/month) comfortably covers 5,000 DAU under the 25,000 DAU allowance |
| Growth-stage: ~25,000 daily active users | $0 license + infra (varies, likely needs a dedicated cluster) | Production tier, usage above the $21/month credit at $0.14/aDAU adds up quickly past the included allowance | Pro tier ($100/month) covers this exactly at the 25,000 DAU included threshold |
| Scale-stage: ~100,000 daily active users | $0 license + infra (varies, needs HA Postgres and horizontal scaling expertise) | Growth tier ($9,350/year base), plus per-aDAU overage above the included credit | Pro tier overage billed per unit above 25,000 DAU, or negotiate Enterprise Cloud for a flatter unlimited-MAU base price |
The pattern that emerges: self-hosting wins on pure licensing cost at any scale, but the crossover point where a managed cloud becomes cheaper than paying an engineer to run Postgres HA, apply CVE patches, and handle on-call for the auth server is usually somewhere between 10,000 and 50,000 daily active users for a small team — well below the point where a large enterprise would even consider it. For context, the Okta comparison cited earlier ($6-$17 per user/month with a $1,500/month minimum) makes even Ory’s or Zitadel’s metered managed pricing look inexpensive once you’re past a few hundred total seats, which is exactly why all three open-source options exist in the first place.
Licensing and open-source governance
All three projects ship their core software under the Apache 2.0 license, which permits commercial use, modification, and self-hosting without licensing fees. The difference is in governance and long-term project risk. Keycloak is a CNCF incubating project, meaning it sits under a neutral, vendor-independent foundation with a defined governance process and multiple corporate contributors beyond Red Hat. Ory and Zitadel are both venture-backed companies that maintain their open-source cores while selling managed cloud and enterprise-license upsells — a common and sustainable model, but one where a company’s business decisions (pricing changes, feature gating, acquisition) can move faster than a foundation-governed project’s roadmap.
For teams evaluating long-term vendor risk, CNCF incubation is a meaningful signal that Keycloak’s core will remain open and community-steered even if Red Hat’s priorities shift. Ory’s and Zitadel’s Apache 2.0 licensing means self-hosted deployments are not at risk of a sudden license change on already-downloaded code, but new features may increasingly land behind the commercial “Enterprise License” tier that OpenAI itself uses for Ory Hydra at scale.
Community, documentation, and long-term support
A comparison like this one is only useful for as long as the underlying projects stay healthy, so it’s worth looking at how each one is actually maintained day to day. Keycloak’s release cadence has only accelerated through 2026: the 26.7.x line opened with 26.7.0 in July, Keycloak.org’s own release notes spotlighted it as the project’s featured 2026 release that August, and patch releases followed quickly with 26.7.2 and 26.7.3 both landing in August before 26.7.4 shipped in September — endoflife.date now tracks 26.7.x as the actively supported line, with the prior 26.6 branch retired at 26.6.4 back in June. That pace is a healthy sign for a project of its size. Its documentation lives across the official keycloak.org site, a dedicated CNCF project page, and a large body of third-party guides from Red Hat’s own build of Keycloak, which adds enterprise support contracts on top of the same open-source core.
Ory’s documentation is split by product (Kratos, Hydra, Keto, Oathkeeper each have their own docs tree), which mirrors the microservices architecture but means new adopters need to read four sets of getting-started guides instead of one. Ory moved to a calendar-based versioning scheme in 2026 (format YY.Q.N, so version 26.2.0 means the second quarter of 2026), which makes it easier to tell how current a given deployment is at a glance. Community support runs primarily through GitHub issues and Ory’s own Slack community, backed by Ory Corp’s commercial team for Enterprise License customers like OpenAI.
Zitadel’s documentation is the most linear of the three, organized around a single self-hosting guide, a single API reference, and a support-tier table that spells out response-time SLAs by plan (business-hours support on Free and Pro, bespoke SLAs as low as 30 minutes on Enterprise Cloud). Because Zitadel is not CNCF-governed, its long-term roadmap is set by the Zitadel company rather than a neutral foundation — a tradeoff worth flagging for procurement teams that specifically require vendor-neutral governance as part of an approved open-source policy.
Frequently asked questions
Is Keycloak, Ory, or Zitadel completely free to use?
Yes, for all three. The core software (Keycloak, Ory’s Kratos/Hydra/Keto/Oathkeeper, and Zitadel) is Apache 2.0 licensed and free to self-host with unlimited users. You only pay if you choose a managed cloud offering (Ory Network or Zitadel Cloud) or an enterprise support/license tier, or if you count the engineering time required to run any of them yourself.
Which is easier to set up for a first project: Keycloak, Ory, or Zitadel?
Keycloak and Zitadel both ship a working login UI and admin console, so a solo developer or small team can have SSO running within an afternoon using their Docker images. Ory requires you to build your own login and registration screens against its APIs first, which is more work upfront but gives you full control over the user experience later.
Can I migrate from Keycloak to Zitadel or Ory without forcing a password reset?
Usually not cleanly. The three projects use different default password-hashing algorithms and storage formats, so a direct hash-for-hash import is rarely possible. Most migrations either force a password reset on next login or run a temporary dual-verification adapter that checks the old hash format once and re-hashes it into the new system transparently.
Does Zitadel really require PostgreSQL, with no alternative?
Yes. Zitadel’s official self-hosting documentation states it requires PostgreSQL versions 14 through 18, with no other database option supported. This is stricter than Keycloak (which supports five different database engines) and Ory (which supports PostgreSQL, MySQL, or CockroachDB).
Which tool is best for a B2B SaaS product with many customer organizations?
Zitadel, in most cases. Its native “Organizations” model was designed specifically for B2B multi-tenancy — each customer organization can have its own admins, branding, and identity provider connections without extra engineering work. Keycloak’s realms can be adapted for this but weren’t originally built for thousands of self-serve tenants, and Ory requires you to model multi-tenancy yourself in your application layer.
Is Ory actually production-ready at large scale, given it has no built-in UI?
Yes — Ory’s own published case study states that OpenAI adopted an Ory Enterprise License for Ory Hydra to support authentication at ChatGPT’s scale, reported at approximately 900 million weekly active users. The lack of a built-in UI is a design choice for API-first teams, not a scale limitation.
How do Keycloak, Ory, and Zitadel compare on compliance certifications?
Zitadel Cloud is the only one of the three with publicly documented SOC 2 Type II (January 2026) and ISO 27001:2022 (June 2024) certification for its managed offering. Keycloak has no first-party managed cloud to certify, and Ory Network’s compliance certifications were not clearly documented in current public sources at the time of this research — teams with strict compliance deadlines should confirm directly with Ory’s sales team before committing.
What happens if I outgrow the free tier of Ory Network or Zitadel Cloud?
Both platforms scale to metered or fixed-price paid tiers. Zitadel’s Pro tier starts at $100/month with 25,000 included daily active users, then bills overage per unit. Ory Network’s Production tier is $770/year with a monthly credit, then charges roughly $0.14 per active daily user beyond that credit. Both also offer custom Enterprise pricing for large-scale or self-hosted-with-support arrangements.
The bottom line
There is no universal winner among Keycloak, Ory, and Zitadel in 2026 — there is only a better fit for your team’s constraints. Choose Keycloak if you want the most battle-tested, admin-console-driven option with the widest database support and don’t mind staying on top of a steady CVE patch cadence. Choose Ory if your team already owns frontend engineering capacity and needs proof that the architecture scales to hundreds of millions of users, following the path OpenAI took with Hydra. Choose Zitadel if you’re building a B2B SaaS product today, want native multi-tenant organizations without custom engineering, and need SOC 2 and ISO 27001 compliance on a managed cloud without waiting a year for a self-hosted audit. All three cost nothing to self-host — the real cost is the engineering time you’re willing to spend, and that’s the variable that should actually decide this comparison for your team.
Related Coverage
- Microsoft Entra ID vs Okta vs Auth0: $6 vs $17/User Gap [2026]
- OIDC vs SAML 2026: 1KB JWT vs 5KB XML, 21-Year Gap
- HashiCorp Vault vs AWS vs Azure Key Vault: 15x Gap [2026]
- How to Set Up Passkeys (FIDO2): 12 Steps, 100 Min [2026]
- Docker vs Podman 2026: 71K Stars, $0 vs $24/mo [Tested]
- CyberArk vs BeyondTrust vs Delinea: PAM After the $25B Deal [2026]
