Keycloak vs Auth0: control and cost vs a managed service

Keycloak and Auth0 solve the same problem from opposite directions. Keycloak is an Apache-2.0 identity server you run yourself: no licence fee, full control, and you own the upgrades, database and availability. Auth0 is a managed service: no servers to run, a free tier up to 25,000 monthly active users, and a bill that grows with users and enterprise connections.

Short answer: Keycloak wins on cost and control if you have the operations team to run it. Auth0 wins on time to market and low operational burden if you are a product team without infrastructure staff. Casdoor is the middle ground: open source and self-hostable like Keycloak, with a flat-price managed option and organizations built in.

What each one is

Keycloak is an open-source identity and access management server. It provides realms (tenants), clients (applications), identity brokering, user federation with LDAP and Active Directory, fine-grained authorization, an admin console, theming and a REST API. It supports SAML 2.0, OpenID Connect and OAuth 2.0.

Auth0 is a managed customer identity platform. It provides hosted login pages, SDKs for every major framework, social and enterprise connections, organizations for B2B multi-tenancy, MFA, attack protection and Actions for custom logic at login time.

Feature comparison

The customization row is the one teams underestimate. Keycloak can be bent to almost any login flow, but that usually means writing Java SPI code that you must maintain across upgrades. Auth0's Actions are easier to write but run inside Auth0's constraints.

Pricing

Keycloak itself has no licence fee. The real cost is infrastructure and people: a production deployment needs a database, a load balancer, backups, monitoring, patching and someone who understands identity. Red Hat sells a supported build for organizations that want a vendor behind it.

Auth0's list prices in 2026:

• Free: 25,000 MAU and 1 enterprise connection.
• Essentials: $35 per month (B2C) or $150 per month (B2B).
• Professional: $240 per month (B2C) or $800 per month (B2B).
• Enterprise connections are only included in the B2B plans; the bill scales with MAU tiers and connection count.

For a small product, Auth0's free tier is hard to beat. At 100,000 MAU with several enterprise customers, the comparison changes: managed Keycloak hosting or a self-hosted deployment can be cheaper, at the cost of operations.

When Keycloak is the better choice

• You need full control over data location and login pages.
• You already run Kubernetes, databases and monitoring, so one more stateful service is not a new capability.
• You have Java experience or a partner who does.
• You want to avoid per-user pricing as you grow.

When Auth0 is the better choice

• You are a small product team and identity is not your core competency.
• You want hosted login, SDKs and social connections working today.
• You need enterprise SSO for customers without building a connection-management UI.
• You would rather pay than operate an identity service.

Migrating from Keycloak

Keycloak and Auth0 both store password hashes, but the formats and parameters differ. Auth0's bulk import accepts hash formats it supports and forces a reset for the rest. Keycloak's default password hashing has changed over time, so a migration must check the algorithm and iteration count before promising users they can keep their passwords.

Casdoor's Keycloak syncer reads Keycloak's user_entity, credential, keycloak_group and user_group_membership tables, and passwords survive only when the hashing parameters match. See migrating from Keycloak for the details.

The third option

Casdoor is open source under Apache-2.0 and self-hostable like Keycloak, with SAML, OIDC, CAS, LDAP and RADIUS in one service. Unlike Keycloak, it also has organizations for B2B tenants, a built-in console and a flat-price managed instance on Casdoor Cloud from $6.67/month billed yearly, with unlimited users and connections. If you want Keycloak's cost model without running Keycloak, it is worth a look.

FAQ

Is Keycloak free? Yes. Keycloak is Apache-2.0 and free to self-host. You pay for infrastructure, operations and optional commercial support.

Is Auth0 free? Auth0 is free up to 25,000 MAU with 1 enterprise connection. Paid plans start at $35 per month for B2C and $150 per month for B2B.

Can Keycloak replace Auth0? For most protocols and flows, yes. The gap is operational: you must run Keycloak, and some Auth0 features such as its hosted login experience and Actions ecosystem have no direct equivalent.

Does Keycloak support multi-tenancy? Yes, through realms. Each realm has its own users, clients and settings, but realms are heavier to operate than Auth0 Organizations.

Which is more secure, Keycloak or Auth0? Both are mature and widely deployed. The bigger risk in a self-hosted Keycloak deployment is misconfiguration and delayed upgrades, not the software itself.