compare
Keycloak vs SuperTokens
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Keycloak | SuperTokens |
|---|---|---|
| Language | Java | Java |
| Licence | Apache-2.0 | Other |
| Stars | 37k | 15k |
| Latest | 26.8.0 | v12.2.0 |
| Last push | 2026-10-06 | 2026-10-06 |
| Release cadence | about 14 days between releases | about 6 days between releases |
| Active contributors | 97+ commit authors on the default branch in the last 90 days | 8 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace Auth0. Alternatives to Auth0 →
Full replacementKeycloakHosted login pages, social login and OpenID Connect for your applications.
Full replacementSuperTokensLogin flows, sessions and social login with prebuilt UI embedded in your app; MFA and multi-tenancy need a licence key.
Keycloak
SuperTokens
- v12.3.0-canary2026-09-09feat: in-memory storage parity for the activity-log/rollup contract by @supertokens-agent-runner[bot] inpre-release
- v12.2.02026-09-04fix: verify database schema at startup and fail loudly on missing tables/columns
- v12.1.12026-08-13fix: mirror dashboard-search arm rewrite and domain-prefix semantics in in-memory storage by @supertokens-agent-runner[…
- v12.1.02026-08-12test: stress-test the 1M-user suite in MIGRATED migration mode too by @supertokens-agent-runner[bot] in
- v12.0.102026-08-06fix: saml hardening
Keycloak
unsigned The latest release, 26.8.0, carries no signature GitHub could verify.
Loading the security report
SuperTokens
unsigned The latest release, v12.2.0, carries no signature GitHub could verify.
Loading the security report