For July 2026, Identity & Access Management Tools is a crowded open/source-visible category covering authentication servers, SSO, OIDC/OAuth infrastructure, access control, passkeys, password managers, and 2FA apps. ToolVitals compares 47 ranked tools using the supplied ToolVitals score, health score, shipping score, openness_label, license_label, GitHub stars, pricing scope, and status fields.
The ranking is limited to open/source-visible tools and ordered by ToolVitals score first, with GitHub stars used only as a secondary popularity signal when scores tie. In this dataset, the leading tools are labeled OSI-approved OSS, but license choices vary across MIT, Apache-2.0, AGPL-3.0, MPL-2.0, BSD-2-Clause, ISC, GPL-3.0, and LGPL-3.0, so license fit still matters.
Rankings
| Rank | Tool | Openness | License | Health | Shipping | GitHub Stars | Score | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | Authentik | OSI-approved OSS | MIT | 100 | 100 | 22260 | 100 | 🟢 Excellent |
| 2 | Keycloak | OSI-approved OSS | Apache-2.0 | 95 | 100 | 35561 | 98 | 🟢 Excellent |
| 3 | Thunder | OSI-approved OSS | Apache-2.0 | 95 | 100 | 320 | 97 | 🟢 Excellent |
| 4 | Casdoor | OSI-approved OSS | Apache-2.0 | 95 | 94 | 13900 | 96 | 🟢 Excellent |
| 5 | Jans | OSI-approved OSS | Apache-2.0 | 91 | 100 | 637 | 95 | 🟢 Excellent |
| 6 | Zitadel | OSI-approved OSS | AGPL-3.0 | 98 | 84 | 14313 | 94 | 🟢 Excellent |
| 7 | Logto | OSI-approved OSS | MPL-2.0 | 94 | 89 | 13957 | 94 | 🟢 Excellent |
| 8 | Pocket ID | OSI-approved OSS | BSD-2-Clause | 91 | 90 | 8279 | 91 | 🟢 Excellent |
| 9 | Frontier | OSI-approved OSS | Apache-2.0 | 89 | 92 | 337 | 91 | 🟢 Excellent |
| 10 | Kanidm | OSI-approved OSS | MPL-2.0 | 88 | 84 | 5105 | 90 | 🟢 Excellent |
| 11 | shiro | OSI-approved OSS | Apache-2.0 | 90 | 82 | 4437 | 90 | 🟢 Excellent |
| 12 | AthenZ | OSI-approved OSS | Apache-2.0 | 86 | 84 | 995 | 89 | 🟢 Excellent |
| 13 | Steward | OSI-approved OSS | MIT | 80 | 92 | 87 | 89 | 🟢 Excellent |
| 14 | Passbolt | OSI-approved OSS | AGPL-3.0 | 81 | 87 | 6009 | 88 | 🟢 Excellent |
| 15 | Kotauth | OSI-approved OSS | MIT | 84 | 82 | 50 | 88 | 🟢 Excellent |
| 16 | Authelia | OSI-approved OSS | Apache-2.0 | 85 | 83 | 28206 | 87 | 🟢 Excellent |
| 17 | Pomerium | OSI-approved OSS | Apache-2.0 | 85 | 81 | 4905 | 87 | 🟢 Excellent |
| 18 | Cerbos | OSI-approved OSS | Apache-2.0 | 87 | 77 | 4483 | 87 | 🟢 Excellent |
| 19 | Authgear | OSI-approved OSS | Apache-2.0 | 81 | 84 | 1885 | 87 | 🟢 Excellent |
| 20 | VoidAuth | OSI-approved OSS | AGPL-3.0 | 84 | 84 | 2318 | 86 | 🟢 Excellent |
| 21 | FerrisKey | OSI-approved OSS | Apache-2.0 | 81 | 82 | 656 | 85 | 🟢 Excellent |
| 22 | Authorizer | OSI-approved OSS | Apache-2.0 | 80 | 77 | 1971 | 84 | 🟢 Excellent |
| 23 | Weft ID | OSI-approved OSS | MIT | 72 | 84 | 12 | 82 | 🟢 Excellent |
| 24 | Hanko | OSI-approved OSS | AGPL-3.0 | 81 | 64 | 8965 | 80 | 🟢 Excellent |
| 25 | Seamless Auth | OSI-approved OSS | AGPL-3.0 | 72 | 73 | 2 | 79 | 🟢 Good |
| 26 | NextAuth | OSI-approved OSS | ISC | 74 | 61 | 28291 | 77 | 🟢 Good |
| 27 | OPAL | OSI-approved OSS | Apache-2.0 | 85 | 52 | 5481 | 77 | 🟢 Good |
| 28 | PowerAuth | OSI-approved OSS | Apache-2.0 | 73 | 57 | 62 | 75 | 🟢 Good |
| 29 | Ory Kratos | OSI-approved OSS | Apache-2.0 | 73 | 54 | 13741 | 74 | 🟢 Good |
| 30 | PearPass | OSI-approved OSS | Apache-2.0 | 67 | 65 | 510 | 73 | 🟢 Good |
| 31 | Open Authenticator | OSI-approved OSS | GPL-3.0 | 67 | 67 | 88 | 73 | 🟢 Good |
| 32 | MaxKey | OSI-approved OSS | Apache-2.0 | 67 | 37 | 1917 | 65 | 🟢 Good |
| 33 | authenticator-tauri | OSI-approved OSS | MIT | 66 | 34 | 1 | 63 | 🟢 Good |
| 34 | Authula | OSI-approved OSS | Apache-2.0 | 59 | 38 | 249 | 62 | 🟢 Good |
| 35 | ghost-auth | OSI-approved OSS | GPL-3.0 | 65 | 28 | 2 | 60 | 🟢 Good |
| 36 | Buwana | OSI-approved OSS | GPL-3.0 | 56 | 31 | 3 | 55 | 🟡 Fair |
| 37 | HVT | OSI-approved OSS | AGPL-3.0 | 51 | 17 | 3 | 50 | 🟡 Fair |
| 38 | Oso | OSI-approved OSS | Apache-2.0 | 39 | 0 | 3496 | 39 | 🔴 Needs Attention |
| 39 | WAIS Core | OSI-approved OSS | MIT | 38 | 7 | 1 | 39 | 🔴 Needs Attention |
| 40 | EAuth | OSI-approved OSS | Apache-2.0 | 33 | 7 | 2 | 38 | 🔴 Needs Attention |
| 41 | Tesseral | OSI-approved OSS | MIT | 36 | 0 | 1137 | 35 | 🔴 Needs Attention |
| 42 | nexeres | OSI-approved OSS | Apache-2.0 | 31 | 7 | 1 | 34 | 🔴 Needs Attention |
| 43 | SSOReady | OSI-approved OSS | MIT | 31 | 0 | 1531 | 32 | 🔴 Needs Attention |
| 44 | Warrant | OSI-approved OSS | Apache-2.0 | 27 | 0 | 1334 | 31 | 🔴 Needs Attention |
| 45 | Padloc | OSI-approved OSS | AGPL-3.0 | 27 | 0 | 2922 | 30 | 🔴 Needs Attention |
| 46 | authman-app | OSI-approved OSS | GPL-3.0 | 26 | 0 | 61 | 28 | 🔴 Needs Attention |
| 47 | JAP | OSI-approved OSS | LGPL-3.0 | 6 | 0 | 168 | 21 | 🔴 Needs Attention |
Top 3 Highlights
Authentik ranks first with a ToolVitals score of 100, backed by 100 health and 100 shipping scores. It is labeled OSI-approved OSS under the MIT license_label, has no pricing scope listed, and has 22,260 GitHub stars. Its description is broad but practical: authentication glue for connecting identity flows across services.
Keycloak ranks second with a ToolVitals score of 98, combining a 95 health score with a 100 shipping score. It has the highest GitHub star count in the top ten at 35,561 stars, but it trails Authentik on ToolVitals score, which is the primary ranking signal here. Keycloak is labeled OSI-approved OSS with the Apache-2.0 license_label.
Thunder ranks third with a ToolVitals score of 97, a 95 health score, and a 100 shipping score. Its GitHub footprint is much smaller than several lower-ranked tools at 320 stars, which makes the ranking notable: ToolVitals score leads, while GitHub stars are only a secondary tie-breaker. Thunder is labeled OSI-approved OSS with the Apache-2.0 license_label.
Want to see the full details, pricing, and trend data for every tool in Identity & Access Management? Browse all Identity & Access Management Tools →