For July 2026, Identity & Access Management Tools is a crowded open/source-visible category covering authentication servers, SSO, OIDC/OAuth infrastructure, access control, passkeys, password managers, and 2FA apps.
The ranking is limited to open/source-visible tools and ordered by ToolVitals score first, with GitHub stars used only as a secondary popularity signal when scores tie. In this dataset, the leading tools are labeled OSI-approved OSS, but license choices vary across MIT, Apache-2.0, AGPL-3.0, MPL-2.0, BSD-2-Clause, ISC, GPL-3.0, and LGPL-3.0, so license fit still matters.
Rankings
| Rank | Tool | Openness | License | Health | Shipping | GitHub Stars | Score | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | Authentik | OSI-approved OSS | MIT | 100 | 100 | 22260 | 100 | 🟢 Excellent |
| 2 | Keycloak | OSI-approved OSS | Apache-2.0 | 95 | 100 | 35561 | 98 | 🟢 Excellent |
| 3 | Thunder | OSI-approved OSS | Apache-2.0 | 95 | 100 | 320 | 97 | 🟢 Excellent |
| 4 | Casdoor | OSI-approved OSS | Apache-2.0 | 95 | 94 | 13900 | 96 | 🟢 Excellent |
| 5 | Jans | OSI-approved OSS | Apache-2.0 | 91 | 100 | 637 | 95 | 🟢 Excellent |
| 6 | Zitadel | OSI-approved OSS | AGPL-3.0 | 98 | 84 | 14313 | 94 | 🟢 Excellent |
| 7 | Logto | OSI-approved OSS | MPL-2.0 | 94 | 89 | 13957 | 94 | 🟢 Excellent |
| 8 | Pocket ID | OSI-approved OSS | BSD-2-Clause | 91 | 90 | 8279 | 91 | 🟢 Excellent |
| 9 | Frontier | OSI-approved OSS | Apache-2.0 | 89 | 92 | 337 | 91 | 🟢 Excellent |
| 10 | Kanidm | OSI-approved OSS | MPL-2.0 | 88 | 84 | 5105 | 90 | 🟢 Excellent |
| 11 | shiro | OSI-approved OSS | Apache-2.0 | 90 | 82 | 4437 | 90 | 🟢 Excellent |
| 12 | AthenZ | OSI-approved OSS | Apache-2.0 | 86 | 84 | 995 | 89 | 🟢 Excellent |
| 13 | Steward | OSI-approved OSS | MIT | 80 | 92 | 87 | 89 | 🟢 Excellent |
| 14 | Passbolt | OSI-approved OSS | AGPL-3.0 | 81 | 87 | 6009 | 88 | 🟢 Excellent |
| 15 | Kotauth | OSI-approved OSS | MIT | 84 | 82 | 50 | 88 | 🟢 Excellent |
| 16 | Authelia | OSI-approved OSS | Apache-2.0 | 85 | 83 | 28206 | 87 | 🟢 Excellent |
| 17 | Pomerium | OSI-approved OSS | Apache-2.0 | 85 | 81 | 4905 | 87 | 🟢 Excellent |
| 18 | Cerbos | OSI-approved OSS | Apache-2.0 | 87 | 77 | 4483 | 87 | 🟢 Excellent |
| 19 | Authgear | OSI-approved OSS | Apache-2.0 | 81 | 84 | 1885 | 87 | 🟢 Excellent |
| 20 | VoidAuth | OSI-approved OSS | AGPL-3.0 | 84 | 84 | 2318 | 86 | 🟢 Excellent |
| 21 | FerrisKey | OSI-approved OSS | Apache-2.0 | 81 | 82 | 656 | 85 | 🟢 Excellent |
| 22 | Authorizer | OSI-approved OSS | Apache-2.0 | 80 | 77 | 1971 | 84 | 🟢 Excellent |
| 23 | Weft ID | OSI-approved OSS | MIT | 72 | 84 | 12 | 82 | 🟢 Excellent |
| 24 | Hanko | OSI-approved OSS | AGPL-3.0 | 81 | 64 | 8965 | 80 | 🟢 Excellent |
| 25 | Seamless Auth | OSI-approved OSS | AGPL-3.0 | 72 | 73 | 2 | 79 | 🟢 Good |
| 26 | NextAuth | OSI-approved OSS | ISC | 74 | 61 | 28291 | 77 | 🟢 Good |
| 27 | OPAL | OSI-approved OSS | Apache-2.0 | 85 | 52 | 5481 | 77 | 🟢 Good |
| 28 | PowerAuth | OSI-approved OSS | Apache-2.0 | 73 | 57 | 62 | 75 | 🟢 Good |
| 29 | Ory Kratos | OSI-approved OSS | Apache-2.0 | 73 | 54 | 13741 | 74 | 🟢 Good |
| 30 | PearPass | OSI-approved OSS | Apache-2.0 | 67 | 65 | 510 | 73 | 🟢 Good |
| 31 | Open Authenticator | OSI-approved OSS | GPL-3.0 | 67 | 67 | 88 | 73 | 🟢 Good |
| 32 | MaxKey | OSI-approved OSS | Apache-2.0 | 67 | 37 | 1917 | 65 | 🟢 Good |
| 33 | authenticator-tauri | OSI-approved OSS | MIT | 66 | 34 | 1 | 63 | 🟢 Good |
| 34 | Authula | OSI-approved OSS | Apache-2.0 | 59 | 38 | 249 | 62 | 🟢 Good |
| 35 | ghost-auth | OSI-approved OSS | GPL-3.0 | 65 | 28 | 2 | 60 | 🟢 Good |
| 36 | Buwana | OSI-approved OSS | GPL-3.0 | 56 | 31 | 3 | 55 | 🟡 Fair |
| 37 | HVT | OSI-approved OSS | AGPL-3.0 | 51 | 17 | 3 | 50 | 🟡 Fair |
| 38 | Oso | OSI-approved OSS | Apache-2.0 | 39 | 0 | 3496 | 39 | 🔴 Needs Attention |
| 39 | WAIS Core | OSI-approved OSS | MIT | 38 | 7 | 1 | 39 | 🔴 Needs Attention |
| 40 | EAuth | OSI-approved OSS | Apache-2.0 | 33 | 7 | 2 | 38 | 🔴 Needs Attention |
| 41 | Tesseral | OSI-approved OSS | MIT | 36 | 0 | 1137 | 35 | 🔴 Needs Attention |
| 42 | nexeres | OSI-approved OSS | Apache-2.0 | 31 | 7 | 1 | 34 | 🔴 Needs Attention |
| 43 | SSOReady | OSI-approved OSS | MIT | 31 | 0 | 1531 | 32 | 🔴 Needs Attention |
| 44 | Warrant | OSI-approved OSS | Apache-2.0 | 27 | 0 | 1334 | 31 | 🔴 Needs Attention |
| 45 | Padloc | OSI-approved OSS | AGPL-3.0 | 27 | 0 | 2922 | 30 | 🔴 Needs Attention |
| 46 | authman-app | OSI-approved OSS | GPL-3.0 | 26 | 0 | 61 | 28 | 🔴 Needs Attention |
| 47 | JAP | OSI-approved OSS | LGPL-3.0 | 6 | 0 | 168 | 21 | 🔴 Needs Attention |
Top 3 Highlights
Authentik ranks first with a ToolVitals score of 100, backed by 100 health and 100 shipping scores. Its description is broad but practical: authentication glue for connecting identity flows across services.
Keycloak ranks second with a ToolVitals score of 98, combining a 95 health score with a 100 shipping score. It has the highest GitHub star count in the top ten at 35,561 stars, but it trails Authentik on ToolVitals score, which is the primary ranking signal here. Keycloak is labeled OSI-approved OSS with the Apache-2.0 license_label.
Thunder ranks third with a ToolVitals score of 97, a 95 health score, and a 100 shipping score. Its GitHub footprint is much smaller than several lower-ranked tools at 320 stars, which makes the ranking notable: ToolVitals score leads, while GitHub stars are only a secondary tie-breaker. Thunder is labeled OSI-approved OSS with the Apache-2.0 license_label.
Want to see the full health, shipping, openness, and evidence details for every tool in Identity & Access Management? Browse all Identity & Access Management Tools →