Choosing an identity and access management tool requires comparing project health, shipping activity, licensing, and practical scope rather than relying on name recognition alone. This September 2026 section uses the supplied current ToolVitals facts for each listed tool, including its rank, ToolVitals score, health score, shipping score, openness label, license label, and GitHub-star context.
The ranking covers open/source-visible tools in the supplied set. Tools are ordered by ToolVitals score descending, with health and shipping used for equal composite scores. GitHub stars are context only and are not used as the ranking basis.
Rankings
| Rank | Tool | Openness | License | Health | Shipping | GitHub Stars | Score | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | Authentik | OSI-approved OSS | MIT | 98 | 98 | 25392 | 98 | 🟢 Excellent |
| 2 | Thunder | OSI-approved OSS | Apache-2.0 | 98 | 98 | 574 | 98 | 🟢 Excellent |
| 3 | Keycloak | OSI-approved OSS | Apache-2.0 | 98 | 97 | 36673 | 98 | 🟢 Excellent |
| 4 | Better Auth | OSI-approved OSS | MIT | 98 | 97 | 29853 | 97 | 🟢 Excellent |
| 5 | Jans | OSI-approved OSS | Apache-2.0 | 97 | 96 | 645 | 97 | 🟢 Excellent |
| 6 | Casdoor | OSI-approved OSS | Apache-2.0 | 97 | 96 | 14360 | 96 | 🟢 Excellent |
| 7 | Logto | OSI-approved OSS | MPL-2.0 | 97 | 96 | 14512 | 96 | 🟢 Excellent |
| 8 | Pocket ID | OSI-approved OSS | BSD-2-Clause | 96 | 95 | 9131 | 96 | 🟢 Excellent |
| 9 | Zitadel | OSI-approved OSS | AGPL-3.0 | 96 | 95 | 14952 | 95 | 🟢 Excellent |
| 10 | Authgear | OSI-approved OSS | Apache-2.0 | 95 | 96 | 2029 | 95 | 🟢 Excellent |
| 11 | Frontier | OSI-approved OSS | Apache-2.0 | 95 | 95 | 343 | 95 | 🟢 Excellent |
| 12 | Pomerium | OSI-approved OSS | Apache-2.0 | 95 | 95 | 4997 | 95 | 🟢 Excellent |
| 13 | AthenZ | OSI-approved OSS | Apache-2.0 | 95 | 94 | 1006 | 95 | 🟢 Excellent |
| 14 | Cerbos | OSI-approved OSS | Apache-2.0 | 95 | 94 | 4576 | 95 | 🟢 Excellent |
| 15 | VoidAuth | OSI-approved OSS | AGPL-3.0 | 95 | 94 | 2489 | 95 | 🟢 Excellent |
| 16 | FerrisKey | OSI-approved OSS | Apache-2.0 | 95 | 94 | 698 | 94 | 🟢 Excellent |
| 17 | Authelia | OSI-approved OSS | Apache-2.0 | 95 | 93 | 28823 | 94 | 🟢 Excellent |
| 18 | Kanidm | OSI-approved OSS | MPL-2.0 | 95 | 93 | 5351 | 94 | 🟢 Excellent |
| 19 | Passbolt | OSI-approved OSS | AGPL-3.0 | 92 | 96 | 6111 | 94 | 🟢 Excellent |
| 20 | Hanko | OSI-approved OSS | AGPL-3.0 | 93 | 92 | 9019 | 93 | 🟢 Excellent |
| 21 | Seamless Auth | OSI-approved OSS | AGPL-3.0 | 92 | 94 | 2 | 93 | 🟢 Excellent |
| 22 | shiro | OSI-approved OSS | Apache-2.0 | 92 | 90 | 4456 | 91 | 🟢 Excellent |
| 23 | Steward | OSI-approved OSS | MIT | 90 | 92 | 95 | 91 | 🟢 Excellent |
| 24 | Weft ID | OSI-approved OSS | MIT | 90 | 90 | 12 | 90 | 🟢 Excellent |
| 25 | Authorizer | OSI-approved OSS | Apache-2.0 | 86 | 92 | 1997 | 88 | 🟢 Excellent |
| 26 | authenticator-tauri | OSI-approved OSS | MIT | 83 | 77 | 1 | 80 | 🟢 Excellent |
| 27 | MaxKey | OSI-approved OSS | Apache-2.0 | 80 | 81 | 1947 | 80 | 🟢 Excellent |
| 28 | Kotauth | OSI-approved OSS | MIT | 82 | 74 | 54 | 79 | 🟢 Good |
| 29 | Authula | OSI-approved OSS | Apache-2.0 | 79 | 77 | 270 | 78 | 🟢 Good |
| 30 | PowerAuth | OSI-approved OSS | Apache-2.0 | 79 | 65 | 62 | 73 | 🟢 Good |
| 31 | OPAL | OSI-approved OSS | Apache-2.0 | 71 | 56 | 5504 | 65 | 🟢 Good |
| 32 | PearPass | OSI-approved OSS | Apache-2.0 | 66 | 52 | 533 | 60 | 🟢 Good |
| 33 | Open Authenticator | OSI-approved OSS | GPL-3.0 | 64 | 54 | 92 | 60 | 🟢 Good |
| 34 | Ory Kratos | OSI-approved OSS | Apache-2.0 | 60 | 40 | 13869 | 52 | 🟡 Fair |
| 35 | NextAuth | OSI-approved OSS | ISC | 57 | 40 | 28366 | 51 | 🟡 Fair |
| 36 | EAuth | OSI-approved OSS | Apache-2.0 | 57 | 40 | 2 | 50 | 🟡 Fair |
| 37 | ghost-auth | OSI-approved OSS | GPL-3.0 | 42 | 30 | 1 | 37 | 🔴 Needs Attention |
| 38 | Buwana | OSI-approved OSS | GPL-3.0 | 38 | 23 | 3 | 32 | 🔴 Needs Attention |
| 39 | HVT | OSI-approved OSS | AGPL-3.0 | 20 | 0 | 3 | 12 | 🔴 Needs Attention |
| 40 | WAIS Core | OSI-approved OSS | MIT | 12 | 0 | 1 | 7 | 🔴 Needs Attention |
| 41 | Tesseral | OSI-approved OSS | MIT | 8 | 0 | 1140 | 5 | 🔴 Needs Attention |
| 42 | exoauth | OSI-approved OSS | MIT | 7 | 0 | 1 | 4 | 🔴 Needs Attention |
| 43 | Warrant | OSI-approved OSS | Apache-2.0 | 5 | 0 | 1335 | 3 | 🔴 Needs Attention |
| 44 | SSOReady | OSI-approved OSS | MIT | 2 | 0 | 1535 | 1 | 🔴 Needs Attention |
| 45 | authman-app | OSI-approved OSS | GPL-3.0 | 2 | 0 | 61 | 1 | 🔴 Needs Attention |
| 46 | Padloc | OSI-approved OSS | AGPL-3.0 | 1 | 0 | 2920 | 1 | 🔴 Needs Attention |
| 47 | Oso | OSI-approved OSS | Apache-2.0 | 1 | 0 | 3489 | 0 | 🔴 Needs Attention |
| 48 | JAP | OSI-approved OSS | LGPL-3.0 | 0 | 0 | 168 | 0 | 🔴 Needs Attention |
Top 3 Highlights
Authentik ranks first with a ToolVitals score of 98, a health score of 98, and a shipping score of 98. ToolVitals lists it as OSI-approved OSS under the MIT license, and the supplied first-party description calls it “The authentication glue you need.” Its supplied GitHub context is 25,392 stars; that count does not determine the ranking.
Thunder ranks second with a ToolVitals score of 98, a health score of 98, and a shipping score of 98. It is labeled OSI-approved OSS under Apache-2.0. The supplied first-party description identifies Thunder as an identity and access management product by WSO2. Its supplied GitHub context is 574 stars, which is not a ranking input.
Keycloak ranks third with a ToolVitals score of 98, a health score of 98, and a shipping score of 97. ToolVitals lists it as OSI-approved OSS under Apache-2.0. The supplied first-party description presents it as “Open Source Identity and Access Management For Modern Applications and Services.” Its supplied GitHub context is 36,673 stars; GitHub stars are contextual rather than determinative.
Want to see the full health, license, shipping, and confidence details for every tool in Identity & Access Management? Browse all Identity & Access Management Tools →