Casdoor
NewThe free alternative toAuth0
Casdoor is a complete identity server you host yourself: it keeps your users' accounts, shows the login page and manages access to all your apps. More than 14,000 stars on GitHub, an Apache 2.0 licence, several releases a week, and an interface that speaks French. Your users sign in with a password, an email or SMS code, a passkey or face recognition, or with more than 100 providers such as Google, GitHub or Microsoft, with two factor authentication as an option. It speaks every protocol: OAuth 2.0, OpenID Connect, SAML, CAS, LDAP and SCIM, so a recent app and an old enterprise tool can share the same accounts. Everything is set in the console: organisations, applications, sign in methods, email templates, logo and colours of the login page. Access rights rely on Casbin (roles and fine grained rules), and an MCP server lets Claude manage your users in plain language. Technically it is a single Go program plus a database, with no Java and no cluster. If you would rather not host it, a hosted version exists on casdoor.com, free up to 25,000 monthly active users. The point to know before installing it: Casdoor has published 18 security flaws since early 2025, 8 of them critical in 2026, the last two in mid September, all fixed since. Its open source competitors published some this year too, but an identity server gets updated every week, no exceptions. And the default administrator password, admin and 123, gets changed at the very first login.
Versus Auth0: the match
Price
Casdoor
€0 on your server
Auth0
€30/month (Essentials)
Users
Casdoor
Unlimited
Auth0
500 active a month on Essentials, then more
Two factor authentication
Casdoor
Included
Auth0
Pro version from Essentials
| VS | Casdoor | Auth0 ↗ |
|---|---|---|
| Price | €0 on your server | €30/month (Essentials) |
| Users | Unlimited | 500 active a month on Essentials, then more |
| Two factor authentication | Included | Pro version from Essentials |
| Enterprise SSO (SAML, LDAP) | Included | Limited by plan |
| Where your accounts live | On your server, in the country you choose | At Okta, a US company |
| Security | Up to you to update every week | Handled by Okta |
| What you need | A server and a database | An account |
How to install it (even from zero)
A Docker container and a database on your server. The prompt installs the production version (not the all in one demo), changes the default password and sets up the security updates.
- 1
Paste this prompt into Claude (Code or Desktop)
It installs Casdoor from the official repo, secures the admin account, connects your app and sets up the weekly update:
Installe Casdoor sur mon serveur : c'est le serveur d'identité open source qui remplace Auth0 (dépôt GitHub casdoor/casdoor, site casdoor.ai). N'utilise pas l'image casdoor-all-in-one, réservée aux essais : installe l'image officielle casbin/casdoor avec une base PostgreSQL ou MySQL dans Docker Compose, en suivant la documentation du dépôt, sur la dernière version publiée, et place-le derrière mon nom de domaine en HTTPS. Dès la première connexion, remplace le mot de passe administrateur par défaut (admin / 123) par un mot de passe long et active la double authentification sur ce compte. Mets l'interface en français. Crée ensuite une organisation et une application pour mon site, active la connexion par e-mail et avec Google, et montre-moi comment brancher mon appli avec OpenID Connect. Casdoor corrige souvent des failles de sécurité : prépare une commande de mise à jour que je lancerai chaque semaine, avec une sauvegarde de la base avant chaque mise à jour, et montre-moi comment être prévenu des nouvelles versions sur GitHub. Explique chaque étape simplement, je débute. Review the GitHub repository and check whether it is safe to install given my machine and my infrastructure. Ask me as many questions as possible, using widgets, to clarify my request and be as precise as you can.
- 2
Try the demo first
demo.casdoor.com lets you click around before installing anything, with admin and 123. The data resets every 5 minutes.
- 3
Update it every week
An identity server is the front door to all your accounts. Casdoor ships fixes several times a week: run your update command at least once a week, after a backup.
Paste this prompt into Claude (Code or Desktop)What you actually do with it
Your app's sign in, with no per user bill
At Auth0, Pro two factor authentication and roles start at 35 dollars a month for 500 active users, and the price rises with them. Here, the number of accounts does not change the bill.
One account for all your tools
Your clients or your team use the same account on your site, your app and your internal tools, through OpenID Connect, SAML or LDAP.
Your accounts stay with you
Your users' data lives on your server, in the country you choose, not at a US company: a real argument when a client brings up GDPR.
Project health, at a glance
Before installing an open-source tool, one question matters: is the project alive? These scores are computed from public GitHub data. They are not made up.
97/100
ExcellentVery active, well-maintained project: go ahead with confidence.
- Activity
- 100
- Maintenance
- 100
- Community
- 86
- Maturity
- 100
- Momentum
- 100
Is the code moving? (commits in the last 30 days)
How fresh is the latest update? Fresher is better.
Stars and contributors: people around means help and fixes.
Project age. Old enough to be solid, still alive.
Current pace versus its usual pace: speeding up or dozing off?
The repo in numbers
- GitHub stars
- 14.5k
- Forks
- 1.8k
- Contributors
- 310
- Commits
- 4k
- Project age
- 5.9 yrs
- Last commit
- today
- Size
- 48.7 MB
- License
- Apache-2.0
Built with
- Go 60.8%
- TypeScript 38.2%
Scores computed automatically from the GitHub API (last-30-days activity, update freshness, community size, project age). Refreshed daily.
Loucash’s take
6/10
Casdoor does what Auth0 does, for free: a login page in your colours, sign in with Google, two factor authentication, enterprise SSO, permission management. And it does it on your server, with no bill that grows with your users. What I like: everything is set in the console, in French, and the MCP server lets Claude manage accounts for me. Why 6 and not more: it is an identity server, and its security record means I have to warn you. Eight critical flaws published in 2026, the last two in mid September, all fixed since, but it means you must update it every week, no exceptions. The interface is dense, and you need to understand OpenID Connect to connect your app. If you are a beginner and stay under 25,000 monthly active users, Auth0's free plan is the safer choice for you.
It’s for you if: You run several apps or have clients who want their accounts with you, you know how to update a server every week, and Auth0 is starting to cost you. If you are a beginner, or you fit in Auth0's free plan, change nothing.
Also worth a look in the library
OpenSEO
Data & analytics€134/moThe open source SEO tool that does the job of Semrush and Ahrefs: keyword research, backlinks, rank tracking, site audit, visibility in AI answers. The software is free and self-hosted; the SEO data is pay as you go, a few cents per request, no subscription.
View details →
Appwrite
Data & analytics€22/moNewThe open source backend closest to Supabase: user accounts, a PostgreSQL database, files, functions, email, SMS and hosting for your site in one console. Free and unlimited on your own server, or on their free cloud to get started.
View details →
PocketBase
Data & analytics€22/moA complete backend in a single file: SQLite database, user accounts, files, realtime and an admin dashboard. You run it on your server and get the equivalent of Supabase or Firebase, with no subscription.
View details →
One email a week that saves you money
Every Tuesday: the open source alternatives that just entered the library, what they replace and what they save you. One email, nothing more.
Free. One email on Tuesdays. Unsubscribe in one click.
Join the Tuesday readers
