Rankings
Open-Source Auth & CIAM
Identity you can run yourself: self-hostable authentication servers and framework-level auth libraries covering sign-in, sessions, passkeys, MFA, enterprise SSO and multi-tenancy. The dividing line for this grid is a public repository, which is also the only thing that makes satisfaction measurable — the closed CIAM vendors sell the same outcome but publish nothing that can be scored.
Open-Source Auth & CIAM Grid
Market Presence vs. Satisfaction
Keycloak
The incumbent self-hosted identity server, now governed by the CNCF
Better Auth
Framework-native TypeScript auth, acquired by Vercel
Auth.js (NextAuth.js)
The long-standing Next.js default, now maintained by Better Auth
Ory Kratos
API-first identity, headless by design
authentik
Self-hosted XIAM with a homelab-to-enterprise range
Zitadel
Multi-tenant identity infrastructure with an event-sourced core
SuperTokens
Y Combinator-backed open-source auth, self-hosted or managed
Logto
OIDC-native auth aimed at multi-tenant SaaS
Hanko
Passkey-first authentication, built and hosted in Europe
Open-Source Auth & CIAM Rankings
Based on public metrics across search volume and GitHub activity
| Rank | Tool | Score | Position | Brand | Community | Pricing |
|---|---|---|---|---|---|---|
| 1 • | Keycloak | 60.5 | Leader | 85.0 | 96.0 | Free tier |
| 2 • | Better Auth | 59.4 | Leader | 70.0 | 93.0 | Free tier |
| 3 • | Auth.js (NextAuth.js) | 55.9 | Leader | 72.0 | 92.0 | Free tier |
| 4 • | Ory Kratos | 51.2 | Leader | 66.0 | 82.0 | Free tier |
| 5 • | authentik | 50.0 | Leader | 60.0 | 90.0 | Free tier |
| 6 • | Zitadel | 44.8 | High Performer | 50.0 | 83.0 | Free tier |
| 7 • | SuperTokens | 44.7 | High Performer | 48.0 | 84.0 | Free tier |
| 8 • | Logto | 42.7 | High Performer | 44.0 | 83.0 | Free tier |
| 9 • | Hanko | 37.6 | High Performer | 34.0 | 77.0 | Free tier |