Pocket ID
A free, open-source, self-hosted login system for your other self-hosted apps, built entirely around passkeys — so nobody has to remember (or leak) a password ever again.
🔗 Visit Pocket ID
Description
Running your own suite of self-hosted apps (a photo gallery, a wiki, a media server) usually means either a separate login for each one, or setting up a full identity provider like Keycloak — powerful, but heavyweight for a homelab. Pocket ID is built for exactly that middle ground: a simple, single sign-on system for your self-hosted stack, but with passwords removed from the picture entirely.
Pocket ID is a free, open-source (BSD-2-Clause) identity provider that's officially OpenID Connect Certified and supports OAuth 2.0, meaning it plugs into apps the standard way. Its defining feature is that it's passkey-only — no passwords at all, authentication happens via passkeys (including physical security keys), which are phishing-resistant by design. It's simple to deploy via Docker, self-hosted so your identity data stays under your control, and has a live public demo. It has passed 9,000 GitHub stars.
💬 Our review
The short version: if you're setting up single sign-on for a homelab or small self-hosted stack and want to skip passwords entirely rather than bolt on 2FA as an afterthought, Pocket ID is a purpose-built, much simpler alternative to running a full Keycloak instance.
The differentiator versus Keycloak or ORY Hydra is scope and simplicity: those are comprehensive, enterprise-grade identity platforms with a real learning curve and operational overhead, built to handle every identity scenario imaginable. Pocket ID deliberately does one thing — OIDC/OAuth2 login via passkeys — and does it simply, which is a much better fit for a homelab or small team that doesn't need Keycloak's full feature surface. Being passkey-only rather than password-plus-optional-2FA is also a meaningfully stronger security default: there's no password to phish or leak in the first place.
The honest limits: passkey-only authentication is a real constraint, not just a feature — every client app and every user needs a passkey-compatible device/browser, which can be friction for less technical users or older hardware. It's also self-hosted only, so there's no managed SaaS option if you'd rather not run your own identity server. For a homelab or small technical team standardizing on passkeys across self-hosted apps, it's an excellent, focused choice; for an enterprise needing complex identity federation, SCIM provisioning, or legacy password support, Keycloak remains the more complete (if heavier) option.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Outil open-source (BSD-2-Clause), entièrement gratuit et auto-hébergé.
Pros
Authentification uniquement par passkey — résistante au phishing par nature
Beaucoup plus simple à déployer qu'un Keycloak complet
Certifié OpenID Connect, compatible OAuth 2.0 standard
Gratuit, open-source (BSD-2-Clause), déploiement Docker, démo publique disponible
Cons
Passkey obligatoire — nécessite un appareil/navigateur compatible pour chaque utilisateur
Auto-hébergé uniquement, pas d'offre SaaS gérée
Moins complet qu'un Keycloak pour des besoins d'identité d'entreprise complexes