Is FusionAuth open source?

No. FusionAuth is a commercial product with a free Community edition that you can self-host without a time limit. Keycloak is open source under Apache 2.0 and has been a CNCF project at the Incubating maturity level since 10 April 2023, with Red Hat as primary sponsor.

Is FusionAuth priced per monthly active user?

Partly. Its pricing page publishes starting prices (Starter from 162 dollars a month, Essentials and Enterprise from 2,970 dollars a month, billed annually) and sizes plans with a monthly-active-user selector that defaults to 1,000, but it publishes no per-MAU tiers. Treat the cost as volume-sensitive and get a quote at your expected MAU rather than assuming a flat licence. Community is free.

Can I migrate from Keycloak to FusionAuth without resetting passwords?

Usually yes. FusionAuth's Keycloak migration guide exports users and credentials from Keycloak's USER_ENTITY and CREDENTIAL tables and loads them through the Import API. FusionAuth 1.34 and later ships a Keycloak-compatible hashing plugin (salted-pbkdf2-hmac-sha256-512) for the default PBKDF2 setup; non-default algorithms need a custom plugin. Identity providers, applications and roles are migrated separately.

Does Keycloak support B2B multi-tenancy?

Yes, two ways. Realms give hard isolation per tenant, and the Organizations feature, fully supported since Keycloak 26.0 in October 2024, models B2B customer organizations inside a single realm. FusionAuth uses first-class tenants for the same job.

FusionAuth vs Keycloak

CapabilityFusionAuthKeycloak

Overall

3.8

4.2

Authentication: 4.5; 4.5
SSO & Federation: 3.0; 4.5
Authorization: 3.0; 4.0
Lifecycle & Provisioning: 3.0; 3.5
MFA & Passwordless: 3.5; 4.0
Governance & Audit: 3.0; 3.5
Developer Experience: 4.5; 3.5
Deployment Flexibility: 4.5; 5.0
Pricing Transparency: 3.5; 5.0
Support & Ecosystem: 3.0; 3.5

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

At a glance

Pick Keycloak when zero license cost, Apache 2.0 code you can fork and audit, and deep SAML and OIDC configurability matter more than operational effort, and you have platform engineers to run it. Pick FusionAuth when you want self-hosted ownership with a more curated CIAM product, cleaner APIs and docs, first-class tenants for B2B SaaS, and the option to pay FusionAuth to host it. Neither has per-MAU SaaS economics as harsh as the managed giants, but FusionAuth's paid plans are not the flat licence they are often described as.

Where each wins

Decision factor	FusionAuth	Keycloak
License cost	Free Community, paid plans from 162 dollars a month	Wins: free, Apache 2.0
Managed hosting from the vendor	Wins: hosted tiers up to high availability	None upstream; self-host only
Developer experience and docs	Wins: API-first, curated	Capable, steeper learning curve
Federation and protocol depth	Solid OIDC, OAuth and SAML	Wins: mature federation, user federation, custom SPIs
Open-source control and community	Proprietary	Wins: CNCF project, fork and extend
Paid vendor support	FusionAuth, 24/7 on Enterprise	Red Hat build of Keycloak or third parties

Pricing reality (checked 2026-11-05)

Keycloak costs nothing to license; you pay for infrastructure, a database, and the engineers who scale, patch and upgrade it. Paid SLAs come through the Red Hat build of Keycloak or third-party support firms.

FusionAuth's pricing page lists Community (free, self-hosted, forum and GitHub support), Starter from 162 dollars a month with basic hosting, Essentials from 2,970 dollars a month with business hosting and email support, and Enterprise from 2,970 dollars a month with high-availability hosting, 24/7 support, and gates such as advanced threat detection and SCIM. Prices are billed annually and the page sizes plans with a monthly-active-user selector (default 1,000) without publishing per-MAU tiers, so get a quote at your real volume. Model both with the TCO calculator, counting Keycloak's operations headcount honestly.

Ownership changes

No acquisitions affect either side. FusionAuth is privately held. Keycloak was accepted to the CNCF on 10 April 2023 at the Incubating level, with Red Hat as primary sponsor, so its governance is a foundation rather than a single vendor.

Deployment and architecture

FusionAuth ships as a single deployable application with tenants as a first-class object, run on your infrastructure or on FusionAuth's hosted tiers. Keycloak is a Quarkus-based server distributed as ZIP, TAR.GZ and a container image; the downloads page lists 26.8.1 as current. Tenancy uses realms for hard isolation, and Keycloak 26.0 (October 2024) made Organizations fully supported for B2B modeling and turned persistent user sessions on by default, which moves session state into the database you must size. Self-hosting either means owning patch speed: Keycloak's CVE-2026-18963, a reset-credentials account takeover fixed in 26.7.2, is the kind of advisory you have to act on yourself.

Migration notes

FusionAuth publishes a Keycloak migration guide: export users and credentials with SQL, load them through the Import API, and keep existing passwords using the Keycloak-compatible PBKDF2 hashing plugin built into FusionAuth 1.34 and later. Identity providers, clients and roles move separately, and custom Keycloak SPIs or themes must be rebuilt. Going from FusionAuth to Keycloak has no vendor-published path, so plan a custom export and test hash compatibility first.

Who should pick which

Keycloak: teams with platform engineering capacity, Red Hat or Kubernetes-standardized stacks, and federation-heavy workforce or partner SSO.
FusionAuth: product teams building customer login for B2B SaaS who want published plan prices, hosted fallback and faster time to working login.
Neither: if you want zero operations, compare managed options in Okta vs Auth0. For other self-hostable angles see Keycloak vs Zitadel, SuperTokens vs FusionAuth, and best CIAM for B2B SaaS.

Frequently asked questions

Is FusionAuth open source?: No. FusionAuth is a commercial product with a free Community edition that you can self-host without a time limit. Keycloak is open source under Apache 2.0 and has been a CNCF project at the Incubating maturity level since 10 April 2023, with Red Hat as primary sponsor.
Is FusionAuth priced per monthly active user?: Partly. Its pricing page publishes starting prices (Starter from 162 dollars a month, Essentials and Enterprise from 2,970 dollars a month, billed annually) and sizes plans with a monthly-active-user selector that defaults to 1,000, but it publishes no per-MAU tiers. Treat the cost as volume-sensitive and get a quote at your expected MAU rather than assuming a flat licence. Community is free.
Can I migrate from Keycloak to FusionAuth without resetting passwords?: Usually yes. FusionAuth's Keycloak migration guide exports users and credentials from Keycloak's USER_ENTITY and CREDENTIAL tables and loads them through the Import API. FusionAuth 1.34 and later ships a Keycloak-compatible hashing plugin (salted-pbkdf2-hmac-sha256-512) for the default PBKDF2 setup; non-default algorithms need a custom plugin. Identity providers, applications and roles are migrated separately.
Does Keycloak support B2B multi-tenancy?: Yes, two ways. Realms give hard isolation per tenant, and the Organizations feature, fully supported since Keycloak 26.0 in October 2024, models B2B customer organizations inside a single realm. FusionAuth uses first-class tenants for the same job.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.