Kratos

Judgement

What it is

Building block

What it does

A headless identity and user management server handling registration, login, passkeys, social sign-in, MFA, account recovery and profile management through APIs.

Adopt it when

You want to own your login system and build your own UI on top, rather than use a hosted provider's screens.

Watch out

Headless means you build all the UI; some features and the smoothest path are on the paid Ory Network.

Ready for

Production-ready

Runs as

Self-hosted server and cloud service

Built with

Go, PostgreSQL and SQLite

How established

Established: started 8 years ago, latest release v26.2.0.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-03 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Kratos → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Kratos

1. 1
   Keycloak keycloak

   Open Source Identity and Access Management For Modern Applications and Services

   Building block Production-ready You need self-hosted SSO across many applications with enterprise protocols and no licence fees.

   ★ 38k Apache-2.0 Java Active, pushed today
2. 2
   Better Auth better-auth

   The most comprehensive authentication framework

   Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.

   ★ 31k MIT TypeScript Active, pushed yesterday
3. 3
   Authelia authelia

   The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

   Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.

   ★ 29k Apache-2.0 Go Active, pushed today
4. 4
   Devise heartcombo

   Flexible authentication solution for Rails with Warden.

   Building block Production-ready You are building a Rails app with conventional email and password accounts.

   ★ 24k MIT Ruby Active, pushed 27 days ago
5. 5
   Casbin apache

   Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

   Building block Production-ready Your application needs configurable permission rules without writing an authorisation engine.

   ★ 20k Apache-2.0 Go Active, pushed today
6. 6
   openGym DuarteSantos8

   Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

   Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

   ★ 19k AGPL-3.0 JavaScript Active, pushed today
7. 7
   ZITADEL zitadel

   ZITADEL - Identity infrastructure, simplified for you.

   Building block Production-ready You build a B2B SaaS that needs per-customer organisations and SSO without assembling it yourself.

   ★ 16k AGPL-3.0 Go Active, pushed today
8. 8
   Logto logto-io

   🧑‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.

   Building block Production-ready You want an Auth0-like service with ready sign-in screens that you can self-host or use as cloud.

   ★ 15k MPL-2.0 TypeScript Active, pushed today

Commercial identity providers and single sign-on servers

1. 1
   Microsoft Entra ID Microsoft

   Strengthen identity security with Microsoft Entra ID, a cloud identity and access (IAM) solution that prevents identity attacks and supports SSO and Zero Trust.

   Complete system Production-ready Your organisation uses Microsoft 365 and wants identity and SSO without another vendor.

   508 readers a month Since 2008 Commercial
2. 2
   Ping Identity Ping Identity

   Ping Identity helps you protect your users and every digital interaction they have while making experiences frictionless.

   Complete system Production-ready A large enterprise or bank has complex hybrid identity needs, including on-premise federation.

   498 readers a month Since 2002 Commercial
3. 3
   JumpCloud JumpCloud

   JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.

   Complete system Production-ready A small or midsize company without Active Directory wants one place for users, devices and access.

   179 readers a month Commercial
4. 4
   Okta Workforce Identity Okta, Inc.

   Okta Workforce Identity makes access for employees, contractors, and partners simple and secure. Discover how to reduce risk with Okta's scalable solution.

   Complete system Production-ready A company with many SaaS apps wants vendor-neutral SSO and automated onboarding and offboarding.

   Commercial
5. 5
   Auth0 Okta, Inc.

   Secure users, AI agents, and more with Auth0, a production-ready authentication and authorization platform built to help you ship faster and drive sign-ups.

   Building block Production-ready A product team wants a complete login system for its customers with enterprise SSO and does not want to build auth.

   Commercial
6. 6
   AWS IAM Identity Center Amazon Web Services

   IAM Identity Center helps you securely create, or connect, your workforce identities and manage their access centrally across AWS accounts and applications.

   Complete system Production-ready You run several AWS accounts and want engineers to sign in once with roles assigned centrally.

   Commercial