# Keycloak vs Logto

**Leader by vioscaleAI score:** Keycloak

| Attribute | Keycloak | Logto |
|---|---|---|
| **vioscaleAI score** | 65.4 (46% (low)) | 54.6 (69% (medium)) |
| activity.commits_last_30d | 100 | 100 |
| adoption.dependent_repos | 678 | 11 |
| adoption.github_stars | 37,140 | 14,683 |
| adoption.package_downloads_weekly | 998,112 | - |
| content.faq | `[{"answer":"Centralized authentication and authorization platform that manages user identity and access control across applications, reducing the need for individual apps to build their own login systems. It is indexed under Auth & Identity Software.","source":"https://www.keycloak.org","question":"What is Keycloak?","confidence":0.6},{"answer":"Keycloak is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://www.keycloak.org","question":"Is Keycloak free to use?","confidence":0.6},{"answer":"Keycloak supports the web, Windows, Linux and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://www.keycloak.org","question":"What platforms does Keycloak support?","confidence":0.6},{"answer":"Yes. Keycloak can be deployed on-premise and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://www.keycloak.org","question":"Can Keycloak be self-hosted?","confidence":0.6},{"answer":"We have confirmed 10 integrations for Keycloak, including GitHub, Google, Facebook, Twitter, LDAP, Active Directory, Kerberos and Kubernetes, plus 2 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://www.keycloak.org","question":"What does Keycloak integrate with?","confidence":0.6},{"answer":"Yes. Keycloak is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/keycloak/keycloak","question":"Is Keycloak open source?","confidence":0.95}]` | `[{"answer":"A developer-focused identity infrastructure that handles user authentication, authorization, and access control across web, mobile, and server applications. Built on standard protocols including OIDC, OAuth 2.1, and SAML with native support for multi-tenancy, enterprise single sign-on, and role-based access control. It is indexed under Auth & Identity Software.","source":"https://logto.io/de/pricing","question":"What is Logto?","confidence":0.6},{"answer":"Logto is open source, so it can be self-hosted and used at no licence cost. It is released under the MPL-2.0 licence. A commercial or hosted edition starts at $0.08. Prices are published openly on the vendor's own pricing page. Pricing changes often, so verify at source before relying on it.","source":"https://logto.io/de/pricing","question":"Is Logto free to use?","confidence":0.6},{"answer":"Logto supports the web, iOS, Android and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://logto.io/de/pricing","question":"What platforms does Logto support?","confidence":0.6},{"answer":"Yes. Logto can be deployed cloud / SaaS and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://logto.io/de/pricing","question":"Can Logto be self-hosted?","confidence":0.6},{"answer":"We have confirmed 11 integrations for Logto, including Google, Apple, Discord, GitHub, Facebook, Azure AD, Okta and Cloudflare Turnstile, plus 3 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://logto.io/de/pricing","question":"What does Logto integrate with?","confidence":0.6},{"answer":"We have independently confirmed SOC 2 for Logto. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Logto not holding them. Always confirm compliance directly before you rely on it.","source":"https://logto.io","question":"What security certifications does Logto have?","confidence":0.48},{"answer":"Yes. Logto is published under the MPL-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/logto-io/logto","question":"Is Logto open source?","confidence":0.95},{"answer":"Logto is available worldwide. The vendor is headquartered in the United States.","source":"https://logto.io/de/pricing","question":"Where is Logto available?","confidence":0.75}]` |
| deployment.options | `{"cloud":true,"self_hosted":true}` | `{"cloud":true,"self_hosted":true}` |
| description.long | An open-source identity management solution that allows users to authenticate once and gain access to multiple applications, eliminating the need for individual login handling at the application level. | A developer-focused identity infrastructure that handles user authentication, authorization, and access control across web, mobile, and server applications. Built on standard protocols including OIDC, OAuth 2.1, and SAML with native support for multi-tenancy, enterprise single sign-on, and role-based access control. |
| features.capabilities | `{"mfa":true,"oidc":true,"rbac":true,"hosting":"both","saml_sso":true,"hosted_ui":"both","open_source":true,"passwordless":true,"social_login":true,"b2b_multi_tenant":true,"passkeys_webauthn":true,"scim_provisioning":true}` | `{"mfa":true,"oidc":true,"rbac":true,"hosting":"both","saml_sso":true,"hosted_ui":"both","open_source":true,"passwordless":true,"social_login":true,"b2b_multi_tenant":true,"passkeys_webauthn":true,"scim_provisioning":true}` |
| integrations.count | 8 | 12 |
| integrations.list | `[{"name":"GitHub"},{"name":"Google"},{"name":"Facebook"},{"name":"Twitter"},{"name":"LDAP"},{"name":"Active Directory"},{"name":"Kerberos"},{"name":"Kubernetes"},{"name":"Apache APISIX"},{"name":"OpenTelemetry"},{"name":"OpenID Connect","native":true},{"name":"SAML 2.0","native":true}]` | `[{"name":"Google"},{"name":"Apple"},{"name":"Discord"},{"name":"GitHub"},{"name":"Facebook"},{"name":"Azure AD"},{"name":"Okta"},{"name":"Google One Tap"},{"name":"Google reCAPTCHA Enterprise"},{"name":"Cloudflare Turnstile"},{"name":"SMS services"},{"name":"SMTP email"},{"name":"HTTPS email"},{"name":"Microsoft Azure AD","native":true,"category":"sso","direction":"inbound"},{"name":"WhatsApp","native":true,"category":"communications","direction":"outbound"},{"name":"Aliyun SMS","native":true,"category":"communications","direction":"outbound"},{"name":"Aliyun Direct Mail","native":true,"category":"communications","direction":"outbound"},{"name":"MailJunky","native":true,"category":"communications","direction":"outbound"},{"name":"SMSBao","native":true,"category":"communications","direction":"outbound"},{"name":"WeCom","native":true,"category":"communications","direction":"outbound"},{"name":"OAuth","native":true,"category":"sso","direction":"inbound"},{"name":"OIDC","native":true,"category":"sso","direction":"inbound"},{"name":"SAML","native":true,"category":"sso","direction":"inbound"}]` |
| language.primary | Java | TypeScript |
| license.spdx | Apache-2.0 | MPL-2.0 |
| market.availability | `{"primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true,"linux":true,"windows":true}` | `{"cli":true,"web":true}` |
| pricing | `{"type":"open_source","sourceUrl":"https://www.keycloak.org","retrievedAt":"2026-09-07T13:10:46.299Z"}` | `{"type":"hybrid","plans":[{"free":true,"name":"Free","summary":"$0/mo","features":["Audit logs","User management"],"components":[{"kind":"fixed","amount":0,"period":"month","currency":"USD"}],"contactSales":false},{"free":false,"name":"Pro","summary":"From $24/mo + token usage","features":["50K free tokens per month","Token-based usage billing beyond free tier"],"components":[{"kind":"fixed","amount":24,"period":"month","currency":"USD"}],"contactSales":false}],"summary":"Free tier available; paid plans from $24/mo with token-based usage billing.","currency":"USD","freeTier":true,"sourceUrl":"https://logto.io/pricing","retrievedAt":"2026-09-14T13:21:24.983Z","startingPrice":{"amount":24,"period":"month","currency":"USD"},"billingPeriods":["month"]}` |
| pricing.free_tier | yes | yes |
| pricing.model | open_source | freemium |
| pricing.price_level | free | low |
| pricing.starting_price | - | `{"amount":24,"currency":"USD"}` |
| pricing.transparent | yes | no |
| release.cadence_days | 13 | 29 |
| release.history | `[{"url":"https://github.com/keycloak/keycloak/releases/tag/nightly","date":"2022-09-27T02:22:00Z","type":"prerelease","version":"nightly"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.8.0","date":"2026-10-01T05:57:20Z","type":"stable","version":"26.8.0"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.5","date":"2026-09-30T17:44:19Z","type":"stable","version":"26.7.5"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.4","date":"2026-09-16T14:44:06Z","type":"stable","version":"26.7.4"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.3","date":"2026-08-31T09:29:37Z","type":"stable","version":"26.7.3"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.2","date":"2026-08-19T05:26:20Z","type":"stable","version":"26.7.2"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.1","date":"2026-08-05T15:54:37Z","type":"stable","version":"26.7.1"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.7.0","date":"2026-07-09T06:58:13Z","type":"stable","version":"26.7.0"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.4","date":"2026-06-26T19:19:51Z","type":"stable","version":"26.6.4"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.3","date":"2026-06-04T17:00:13Z","type":"stable","version":"26.6.3"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.2","date":"2026-05-19T12:41:03Z","type":"stable","version":"26.6.2"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.1","date":"2026-04-15T13:58:02Z","type":"stable","version":"26.6.1"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.0","date":"2026-04-08T08:54:19Z","type":"stable","version":"26.6.0"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.7","date":"2026-04-02T14:47:13Z","type":"stable","version":"26.5.7"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.6","date":"2026-03-19T06:45:39Z","type":"stable","version":"26.5.6"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.5","date":"2026-03-05T15:40:30Z","type":"stable","version":"26.5.5"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.4","date":"2026-02-20T09:19:45Z","type":"stable","version":"26.5.4"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.3","date":"2026-02-10T07:30:08Z","type":"stable","version":"26.5.3"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.2","date":"2026-01-23T14:26:58Z","type":"stable","version":"26.5.2"},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.1","date":"2026-01-14T18:09:13Z","type":"stable","version":"26.5.1"}]` | `[{"url":"https://github.com/logto-io/logto/releases/tag/v1.45.0","date":"2026-10-13T07:52:46Z","type":"stable","version":"v1.45.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.44.0","date":"2026-09-30T07:20:33Z","type":"stable","version":"v1.44.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.43.0","date":"2026-08-31T11:56:01Z","type":"stable","version":"v1.43.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.42.0","date":"2026-07-30T04:16:00Z","type":"stable","version":"v1.42.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.41.0","date":"2026-06-30T08:09:25Z","type":"stable","version":"v1.41.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.40.1","date":"2026-05-29T10:38:46Z","type":"stable","version":"v1.40.1"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.40.0","date":"2026-05-29T07:41:41Z","type":"stable","version":"v1.40.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.39.0","date":"2026-04-30T02:55:56Z","type":"stable","version":"v1.39.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.38.0","date":"2026-03-31T10:45:02Z","type":"stable","version":"v1.38.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.37.1","date":"2026-02-28T09:31:48Z","type":"stable","version":"v1.37.1"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.37.0","date":"2026-02-28T03:40:27Z","type":"stable","version":"v1.37.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.36.0","date":"2026-01-30T06:46:50Z","type":"stable","version":"v1.36.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.35.0","date":"2025-12-30T09:43:29Z","type":"stable","version":"v1.35.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.34.0","date":"2025-11-28T05:34:41Z","type":"stable","version":"v1.34.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.33.0","date":"2025-10-31T06:54:33Z","type":"stable","version":"v1.33.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.32.0","date":"2025-09-30T06:37:14Z","type":"stable","version":"v1.32.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.31.0","date":"2025-08-29T08:55:14Z","type":"stable","version":"v1.31.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.30.1","date":"2025-07-31T17:12:43Z","type":"stable","version":"v1.30.1"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.29.0","date":"2025-06-27T05:47:28Z","type":"stable","version":"v1.29.0"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.28.0","date":"2025-05-26T13:25:04Z","type":"stable","version":"v1.28.0"}]` |
| reliability.status_page | - | yes |
| security.certifications | - | `[{"name":"SOC 2","status":"active"}]` |
| security.disclosure_policy | yes | yes |
| security.scorecard | 9.3 | - |
| security.soc2 | - | yes |
| security.trust_center | https://www.keycloak.org/security | - |
| security.vulnerabilities | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=maven&package_name=org.keycloak%3Akeycloak-server-spi&per_page=100","last_12m":0,"max_severity":null}` | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=npm&package_name=%40logto%2Fphrases-ui&per_page=100","last_12m":0,"max_severity":null}` |

## Capabilities (Auth & Identity Software)

| Capability | Keycloak | Logto |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Cloud + self-hosted | Cloud + self-hosted |
| **Methods** |  |  |
| Social login | ✓ | ✓ |
| Passwordless | ✓ | ✓ |
| Passkeys / WebAuthn | ✓ | ✓ |
| Multi-factor auth | ✓ | ✓ |
| **Enterprise** |  |  |
| SAML SSO | ✓ | ✓ |
| SCIM provisioning | ✓ | ✓ |
| B2B / multi-tenancy | ✓ | ✓ |
| **Standards** |  |  |
| OpenID Connect provider | ✓ | ✓ |
| **Delivery** |  |  |
| Hosted UI | Both | Both |
| **Access** |  |  |
| RBAC | ✓ | ✓ |
| **Licensing** |  |  |
| Self-hostable OSS core | ✓ | ✓ |

*Source: vioscaleAI. Generated 2026-10-16T19:02:34.719Z. "-" = undocumented, not absent.*