Comparison
How Unlatch 0.3 differs from other single sign-on servers you can host yourself. What this page says about the others comes from their own documentation and code as of 23 October 2026; the versions and sources are at the end. If something is wrong or out of date, please open an issue.
| Unlatch | Pocket ID | Authelia | Kanidm | Rauthy | authentik | |
|---|---|---|---|---|---|---|
| Running it | ||||||
| Written in | Rust | Go | Go | Rust | Rust | Python, Rust, Go |
| Parts | One binary, SQLite | One binary, SQLite or PostgreSQL | One binary, SQLite, PostgreSQL or MySQL | One server with its own database | One binary, its own database or PostgreSQL | Server, worker, PostgreSQL |
| Memory | 6.5–7.3 MiB | 64–69 MiB | 106–125 MiB | 64 KB per entry | 40–57 MB | Hosts from 2 GB |
| Administration | Browser | Browser | Configuration files | Mostly command line | Browser | Browser |
| Users kept in | Its database | Its database, or synced from LDAP | A file or LDAP | Its database | Its database | Its database, LDAP and others |
| Needs email | No | No | Yes | No | For some tasks | No |
| Several servers | No | No | Yes | Two at most | Yes | Yes |
| Signing in | ||||||
| Passkeys | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Password and TOTP | ✓ | – | ✓ | ✓ | Password, no TOTP | ✓ |
| Google, GitHub, OpenID | ✓ | – | – | – | ✓ | ✓ |
| For applications | ||||||
| OpenID Connect | ✓ | ✓ | Beta | ✓ | ✓ | ✓ |
| Forward auth | ✓ | – | ✓ | – | ✓ | ✓ |
| LDAP | – | – | – | Read-only | – | ✓ |
| SAML | – | – | – | – | – | ✓ |
| PAR | ✓ | ✓ | ✓ | – | – | – |
| DPoP | ✓ | – | – | – | ✓ | ID tokens only |
| Sign-out | Both | Both | – | – | Both | Both |
| Device sign-in | – | ✓ | ✓ | – | ✓ | ✓ |
| Trust | ||||||
| OpenID certified | – | ✓ | ✓ | – | – | ✓ |
| Published audit | – | – | – | – | ✓ | ✓ |
| License | MIT | BSD-2-Clause | Apache-2.0 | MPL-2.0 | Apache-2.0 | MIT, parts enterprise |
Sign-out is RP-initiated and back-channel logout; Both means an application can end the session at the server and hear when it ends there. Device sign-in is the device authorization grant, for TVs and command line tools.
The memory of Unlatch 0.2.0, Pocket ID 2.19.1 and Authelia 4.39.28 was measured on one machine, from their Linux release binaries with default settings, Authelia with OpenID Connect and one client: resident memory 30 seconds after start, then its peak while 20 clients fetched the sign-in page 6,000 times. Each figure is the median of three runs. Pocket ID and Authelia answer with a page that a script finishes in the browser, Unlatch with the finished form. Authelia drops to about 87 MiB after five minutes at rest. The other three figures are what their documentation states.
Where Unlatch stands out
- Small. One 9 MB binary and one SQLite file, 6.5 MiB of memory at rest. In the same test Pocket ID held 64 MiB and Authelia 106 MiB; Rauthy states 40 to 57 MB, and authentik asks for a host with 2 GB.
- Everything in the browser, nothing by email. Applications, users, groups, sessions and sign-in providers are managed in the web interface. Invitations and lost passwords are links an administrator hands over, so there is no mail server to set up.
- All the usual ways to sign in at once. Passkeys, a password with a code from an authenticator app, and Google, GitHub or any OpenID provider. Pocket ID has only passkeys; Authelia and Kanidm don't offer sign-in through other providers.
- Current OAuth security. Pushed authorization requests and DPoP-bound tokens. Of the others, Pocket ID and Authelia have the first and Rauthy the second.
- Forward authentication built in, for services that don't speak OpenID Connect.
When to choose something else
Unlatch is young. It hasn't been audited or certified, runs on one server, and has no LDAP, SAML or device sign-in. Choose:
- Pocket ID if everyone signs in with passkeys and you want an OpenID certified server.
- Authelia if your users are already in LDAP and you mostly protect sites through a reverse proxy.
- Kanidm if you also need LDAP, RADIUS, or Unix and SSH accounts from the same server.
- Rauthy if you need several servers and an audited code base.
- authentik if you need SAML, LDAP, RADIUS or sign-in flows of your own design, and have the memory to spare.
- Keycloak or Zitadel for a large organisation with many tenants. Both have SAML and much more, and both need a separate database. Keycloak, in Java, recommends 2 GB of memory for a small production setup; Zitadel, in Go under the AGPL, takes about 512 MB besides PostgreSQL.
Sources
- Pocket ID 2.19.1: documentation, sign-in methods, proxy services, discovery document, several instances.
- Authelia 4.39.28: OpenID Connect support, OpenID Connect roadmap, sign-in with other providers, admin dashboard, notifications, several servers, passkeys.
- Kanidm 1.11.2: supported features, OAuth2, deployment, replication, README, forward auth, RP-initiated logout.
- Rauthy 0.37.2: README, configuration, forward auth, discovery document, high availability, audit.
- authentik 2026.8.5: requirements, OAuth2 provider, key binding, high availability, audits, enterprise features.
- Keycloak 26.8.1: containers, features. Zitadel 4.20.0: production setup.
- OpenID Foundation: certified providers, certified logout. Unlatch passes the conformance tests but isn't certified.