[opensourcedex]

privacyidea is a free, open source identity & access management (iam) project written in Python and released under AGPL-3.0. It has 1,774 GitHub stars, 361 forks and 193 open issues, and was last pushed 4 hours ago. On this registry it ranks #25 of 27 tracked projects in Identity & Access Management (IAM), with 5 head-to-head comparisons available.

What is privacyidea?

privacyIDEA is an open-source, self-hosted multi-factor authentication platform, written in Python and licensed under AGPL-3.0, for organisations that need to add a second factor to many different applications at once while keeping sensitive user data inside their own infrastructure.

What it is

privacyIDEA is an on-premise MFA platform for orchestrating multi-factor authentication across an entire stack. It is distributed as the privacyIDEA package on PyPI, developed in Python, and released under the AGPL-3.0 licence, which the project describes as guaranteeing software freedom. The GitHub repository carries the topics 2fa, authentication, ca, certificates, fido, fido2, identityserver, idm, mfa, opensource, otp and otp-server, placing it in the Security and Privacy / Identity and Access Management category. Project documentation is published at privacyidea.readthedocs.io, and the homepage is at privacyidea.org. The repository is actively maintained, with the most recent push recorded in September 2026.

The concrete problem it solves is the scatter of second-factor mechanisms that accumulates when every application, VPN and identity provider is secured separately. privacyIDEA centralises that work: it connects to the user stores an organisation already runs — Active Directory, LDAP, SQL and EntraID — without locking the deployment into a specific ecosystem, and then serves authentication factors to whatever needs them. Rather than configuring one-time passwords inside each individual service, an operator configures factors once and exposes them through a REST API and through integrations with operating systems, identity providers, remote-access gateways and web servers.

Key capabilities

  • FIDO2 and WebAuthn support for passkeys and hardware authenticators such as YubiKey and Plug-Up.
  • Smartcard and certificate authentication over PIV and x509, including connection to a Microsoft CA through ms-ca-service and enrolment to PIV-compatible devices with the enrolment client for Windows.
  • Push notifications, TOTP and HOTP through the privacyIDEA Authenticator, with compatibility for standard TOTP and HOTP apps such as Google Authenticator, plus TiQR.
  • Additional factor types including SMS, Email, SSH keys, security questionnaires and registration codes for rollout.
  • Operating-system integration through Linux PAM and a Windows Credential Provider.
  • Identity-provider integration with Keycloak, ADFS, Shibboleth and SimpleSAMLphp.
  • Remote-access and web integration through RADIUS for VPNs such as OpenVPN, Fortinet and Palo Alto, SSH, Apache, Nginx, nextCloud, ownCloud and a general REST API.

Who uses it and how

  • Administrators securing VPN and remote-access infrastructure that authenticates over RADIUS, covering products such as OpenVPN, Fortinet and Palo Alto.
  • Teams that federate logins through Keycloak, ADFS, Shibboleth or SimpleSAMLphp and want a second factor layered onto the identity provider rather than each application.
  • Organisations authenticating operating-system logins, on Linux through PAM and on Windows through the Credential Provider.
  • Web portal and file-sync operators that integrate either through the REST API behind Apache or Nginx, or through the packaged nextCloud and ownCloud integrations.
  • Deployments where user data must remain inside the operator's own infrastructure, which the project presents as the reason for its on-premise design.

Getting started

Install the privacyIDEA package from PyPI, and follow the install instructions at privacyidea.readthedocs.io for running the system. For a development environment, clone the repository with git clone https://github.com/privacyidea/privacyidea.git, change into the privacyidea directory, and create a virtual environment.

How it compares

The supplied facts do not name any comparable projects, so on the evidence presented here privacyIDEA stands alone in this registry. Any comparison with other multi-factor authentication products would need to be made from sources outside this listing.

When to use it — and when not to

A self-hoster must run the Python application and connect it to existing user stores such as Active Directory, LDAP, SQL or EntraID, and must supply the delivery channels for factor types in use, such as mail delivery for Email tokens and an SMS gateway for SMS tokens. Teams that want a fully managed service rather than infrastructure they operate themselves should look elsewhere. The README also defers installation and configuration detail to the external documentation site rather than carrying it inline, and the repository currently shows 193 open issues, which is worth reviewing against your own requirements before committing.

project readme (upstream, from github) — read inline

.. .. image:: https://circleci.com/gh/privacyidea/privacyidea/tree/master.svg?style=shield&circle-token=:circle-token .. :alt: CircleCI .. :target: https://circleci.com/gh/privacyidea/privacyidea

Backend |cov-backend| Frontend |cov-frontend|

.. |cov-backend| image:: https://codecov.io/gh/privacyidea/privacyidea/branch/master/graph/badge.svg?flag=backend :alt: Backend coverage :target: https://codecov.io/gh/privacyidea/privacyidea?branch=master&flags[0]=backend

.. |cov-frontend| image:: https://codecov.io/gh/privacyidea/privacyidea/branch/master/graph/badge.svg?flag=frontend :alt: Frontend coverage :target: https://codecov.io/gh/privacyidea/privacyidea?branch=master&flags[0]=frontend

.. .. image:: https://img.shields.io/pypi/dm/privacyidea.svg .. :alt: Downloads .. :target: https://pypi.python.org/pypi/privacyIDEA/

.. image:: https://img.shields.io/pypi/v/privacyidea.svg :alt: Latest Version :target: https://pypi.python.org/pypi/privacyIDEA/#history

.. image:: https://img.shields.io/pypi/pyversions/privacyidea.svg :alt: PyPI - Python Version :target: https://pypi.python.org/pypi/privacyIDEA/

.. image:: https://img.shields.io/github/license/privacyidea/privacyidea.svg :alt: License :target: https://pypi.python.org/pypi/privacyIDEA/

.. image:: https://readthedocs.org/projects/privacyidea/badge/?version=master :alt: Documentation :target: http://privacyidea.readthedocs.org/en/master/

.. .. image:: https://codeclimate.com/github/privacyidea/privacyidea/badges/gpa.svg .. :alt: Code Climate .. :target: https://codeclimate.com/github/privacyidea/privacyidea

.. .. image:: https://api.codacy.com/project/badge/grade/d58934978e1a4bcca325f2912ea386ff :alt: Codacy Badge :target: https://www.codacy.com/app/cornelius-koelbel/privacyidea

privacyIDEA: Open-Source Multi-Factor Authentication

privacyIDEA is an open-source MFA platform for orchestrating all your multi-factor authentication needs. Secure your entire stack with a flexible, self-hosted solution that puts you in control. As an on-premise platform, your sensitive user data always remains within your infrastructure.

Key Features

  • Universal MFA: Add a second factor to virtually any application—from SSH and VPNs to IdPs like Keycloak and web portals.
  • Extensive Factor Support: Go beyond simple OTP. We support everything from cutting-edge Passkeys and push authentication to various OTP types.
  • Vendor-Agnostic: Connect to your existing user stores (AD, LDAP, SQL, EntraID) without being locked into a specific ecosystem.
  • Truly Open: Licensed under AGPLv3 to guarantee your software freedom, always.

Supported Authentication Factors

  • 🔑 Passkeys & Hardware: FIDO2/WebAuthn devices (like YubiKey, Plug-Up).
  • 💳 Smartcards (PIV/x509): Connect to a Microsoft CA using the ms-ca-service _ and enroll certificates directly to PIV-compatible devices with our enrollment client for Windows _.
  • 📱 Software & Mobile: Use the privacyIDEA Authenticator _ for PUSH notifications, TOTP, and HOTP; for standard TOTP/HOTP, other apps like Google Authenticator are also compatible. TiQR is also supported.
  • 📜 Classic & Remote: SMS, Email, SSH Keys, Security Questionnaires, and simple Registration Codes for easy rollout.

Seamless Integration

Enhance the security of your existing infrastructure:

  • Operating Systems: Linux (PAM) , Windows (Credential Provider)
  • Identity Providers: Keycloak , ADFS , Shibboleth , SimpleSAMLphp
  • Remote Access: VPNs with RADIUS (OpenVPN, Fortinet, Palo Alto), SSH
  • Web Applications: Apache, Nginx, any web portal via our REST API.
  • nextCloud , ownCloud
  • and more...

Join the Community

Have feedback, questions, or ideas? Join the discussion on our community forum: https://community.privacyidea.org

Setup

For setting up the system to run it, please read install instructions at privacyidea.readthedocs.io _.

If you want to setup a development environment start like this::

git clone https://github.com/privacyidea/privacyidea.git
cd privacyidea
virtualenv venv
source venv/bin/activate
pip install -r requirements.txt

.. _testing_env:

You may additionally want to set up your environment for testing, by adding the additional dependencies::

pip install -r tests/requirements.txt

You may also want to read the blog post about development and debugging at https://www.privacyidea.org/privacyidea-development-howto/

Running it

First You need to create a config-file _.

Then create the database tables and the encryption key::

./pi-manage create_tables
./pi-manage create_enckey

If You want to keep the development database upgradable, You should stamp _ it to simplify updates::

./pi-manage db stamp head -d migrations/

Create the key for the audit log::

./pi-manage create_audit_keys

Create the first administrator::

./pi-manage admin add

Run it::

./pi-manage run

Now you can connect to http://localhost:5000 with your browser and login as administrator.

Run tests

If you have followed the steps above to set up your environment for testing _, running the test suite should be as easy as running pytest with the following options::

python -m pytest -v --cov=privacyidea --cov-report=html tests/

Contributing

There are a lot of different ways to contribute to privacyIDEA, even if you are not a developer.

If you found a security vulnerability please report it to [email protected].

You can find detailed information about contributing here: https://github.com/privacyidea/privacyidea/blob/master/CONTRIBUTING.md

Code structure

The database models are defined in models.py and tested in tests/test_db_model.py.

Based on the database models there are the libraries lib/config.py which is responsible for basic configuration in the database table config. And the library lib/resolver.py which provides functions for the database table resolver. This is tested in tests/test_lib_resolver.py.

Based on the resolver there is the library lib/realm.py which provides functions for the database table realm. Several resolvers are combined into a realm.

Based on the realm there is the library lib/user.py which provides functions for users. There is no database table user, since users are dynamically read from the user sources like SQL, LDAP, SCIM or flat files.

Subscriptions and limitations of community edition

Using privacyIDEA Server and the privacyIDEA FreeRADIUS plugin there is technically no limitation of the community edition or the code in this repository. Admins will receive a welcome message about possible support, if more than 50 users are enrolled.

Plugins

The privacyIDEA project also provides several plugins for 3rd party applications like SSO Identity Providers or Windows Login.

Plugins can be limited in the number of users. I.e. the plugin will complain, if the total number of users in privacyIDEA with an active token exceeds a certain limit. There is a certain base number of users, with which the plugin will work. To enhance this number, you will need a subscription. In some cases an additional demo subscription can be found in the release list of the corresponding github plugin repository, you can get a subscription from the company NetKnights or if you have a very good understanding of this Open Source code, you could create a subscription on your own.

readme truncated — read the full docs on github

Frequently asked questions

Is privacyidea free to use?

privacyidea is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does privacyidea do?

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP, FIDO Server)

What is privacyidea written in?

privacyidea is primarily written in Python. Its source is publicly available at https://github.com/privacyidea/privacyidea, and it has 1,774 GitHub stars.