Skip to content
Ditchly
Menu

Last checked October 25, 2026

Keycloak vs Zitadel

Keycloak and Zitadel are free apps you can use instead of Auth0. Keycloak is full on a second factor. Zitadel is an identity server written in Go and is easier to run.

A full score means it matches our checklist. It is not a drop-in replacement. How this works

Instead of Auth0

Last checked October 25, 2026

Keycloak is #1 (94). Zitadel is #3 (81).

Keycloak

#1 · Closest

7 of 7 checked features. A full score means it matches our checklist. It is not a drop-in replacement.

You only get part of: block passwords found in known leaks.

Notes on the review

Zitadel

#3

6 of 7 checked features. A full score means it matches our checklist. It is not a drop-in replacement.

You only get part of: a second factor.

Notes on the review88% of the list checked

Scroll sideways to see both apps.

Keycloak and Zitadel on the Auth0 list. Full, partial, missing, or not checked.
FeatureKeycloak#1 · 947 of 7 checked featuresZitadel#3 · 816 of 7 checked features
A hosted login pageCounts for 10FullFull
OIDC or SAMLCounts for 10FullFull
Social loginCounts for 6FullFull
A second factorCounts for 8FullPartial
A user directoryCounts for 8FullFull
Separate customer organizationsCounts for 8FullThe Keycloak admin guide has an Organizations section for customer orgs in one realm.FullZITADEL docs say an organization holds that customer's projects and users, like a tenant.
Block passwords found in known leaksCounts for 7PartialThe admin guide has a password blacklist file you supply. It does not document an automatic check against known leaks.Not checkedNot found in the project's public docs during this check.

Where they differ

  • A second factor

    Worth 8 points. Keycloak does all of it. Zitadel does part of it.

  • Block passwords found in known leaks

    Worth 7 points. Keycloak does part of it. The admin guide has a password blacklist file you supply. It does not document an automatic check against known leaks. Zitadel was not checked. Not found in the project's public docs during this check.

Both do all of these: a hosted login page, OIDC or SAML, social login, a user directory, and separate customer organizations.

Also ranked: Authentik is #2 (88). SuperTokens is #4 (79). Authelia is #5 (53).

Free alternatives to Auth0

The facts on file

Keycloak

Hosted login, OIDC, SAML, and a user directory.

Rules
Open source. Apache-2.0
Run it yourself
Hard. Java. Plan for upgrades and a database.
Free plan
You can run the free version on your own server. You don't pay for each person. We don't list a price for the hosted version. Not checked.
They host it
No hosted price on file.
Where it runs
Web, Run it yourself

Last checked October 25, 2026

Website·Source

Zitadel

An identity server written in Go.

Rules
Open source. AGPL-3.0
Run it yourself
Setup: medium. Plan on Docker or a small virtual machine. A paid hosted plan, if there is one, is separate from the free copy you run yourself.
Free plan
You can run the free version on your own server. You don't pay for each person. We don't list a price for the hosted version. Not checked.
They host it
No hosted price on file.
Where it runs
Web, Run it yourself

Last checked October 25, 2026

Website·Source

Which one to pick

Keycloak

Pick Keycloak if you want a second factor marked full. A leaked-password block is only partial. The admin guide has a password blacklist file you supply. The license is Apache-2.0. Running it is hard. You need Java, upgrades, and a database.

Zitadel

Pick Zitadel if you want an easier time running it yourself. Setup is medium. The license is AGPL-3.0. A second factor is partial. A leaked-password block was not found in the public docs during this check.

Read next