Home › Passwords & identity › Keycloak

Keycloak

Industry-standard IAM, batteries included

provisional — pending verificationApache-2.0self-hostable

Arete score

4.0 / 5

Autonomy5

Return4

Efficiency2

Transparency5

ἀρετή “AH-reh-tay” — excellence: a thing being good at what it’s for. Mean of the four principle scores. How we score →

Visit site ↗ Self-host with ValueIndex — join waitlist

Plain outbound link — no affiliate parameters, no tracking redirects.

~ Provisional — seeded estimate by a human researcher; full rubric pass pending. Working notes ↓

Why it's listed

Keycloak is listed in passwords & identity because it competes on utility: industry-standard iam, batteries included. Its funding model is disclosed on the listing. Licensed Apache-2.0; pricing: free. It's on the heavier side for its category — we score that honestly and say so. This entry is provisional — the scores are seeded estimates pending our full manual rubric pass, and the verification date will appear here once complete.

Facts

License: Apache-2.0
Pricing: Free
Funding model: Red Hat-sponsored OSS
Self-hostable: Yes — deploy difficulty: hard
Verification: Provisional — scores are seeded estimates pending manual verification

Evidence notes

JVM; heavy but authoritative

Recorded during the rubric pass — every score must carry evidence a stranger could re-check.

Also in passwords & identity

Vaultwarden (5.0) — Bitwarden-compatible server in Rust, tiny footprint
Authelia (4.8) — Lean auth/2FA gateway for reverse proxies
Authentik (4.0) — Modern identity provider (SSO/OIDC/SAML)

Spotted a problem — trackers added, dark patterns, abandonment? Report a violation. Scores change when evidence does.