{"slug": "ory-kratos", "name": "Ory Kratos", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 5, "warners": 0, "score": 2.984, "rising": -0.98, "first": "2025-11-13", "latest": "2026-07-28", "why": "Otherwise it was a great project to work with that has tons of knobs to customize.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 1, "warn": 0}, "spark": [2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Otherwise it was a great project to work with that has tons of knobs to customize.", "icon": true, "domain": null, "github_repo": null, "official_url": "https://www.ory.sh/kratos/", "pricing": "", "aliases": ["Ory Kratos"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 778846704, "item_id": 48677919, "url": "https://news.ycombinator.com/item?id=48677919", "by": "adeptima", "date": "2026-06-25", "stance": "recommend", "quote": "Ory's Kratos handles identity, login, registration, recovery, MFA...", "excerpt": "Mixed fealings cause the full context should include plans on both Authorization and Authentication flows at least withing Cloudflare ecosystem. No github examples Anyway good start in the right direction from Cloudflare, yet still long way to go especially compare to the full Ory's offering its built on. Ory's Kratos handles identity, login, registration, recovery, MFA... https://github.com/ory IMHO full scope shoul", "context": "", "use_case": "identity and authentication", "switched_from": "", "story": "Cloudflare launched self-managed OAuth for all"}, {"id": 734656417, "item_id": 45916026, "url": "https://news.ycombinator.com/item?id=45916026", "by": "larrywinch", "date": "2025-11-13", "stance": "recommend", "quote": "This looks like great stuff.", "excerpt": "This looks like great stuff. In the TypeScript ecosystem, I'd probably take a look at Better Auth though, as the developer experience is really great!", "context": "", "use_case": "", "switched_from": "", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}, {"id": 734650016, "item_id": 45915626, "url": "https://news.ycombinator.com/item?id=45915626", "by": "caleblloyd", "date": "2025-11-13", "stance": "recommend", "quote": "Otherwise it was a great project to work with that has tons of knobs to customize.", "excerpt": "I used Ory Kratos in a Go application a couple years ago by installing it as a dependency. It worked pretty well but in hindsight I would have hosted it as a separate application because it was a pain to bring along all of its dependencies. One of my biggest complaints was that one of the Account Recovery flows was just an emailed 6-digit code. So a 1 in 1 million chance that somebody without access to any of your st", "context": "", "use_case": "auth in a Go application", "switched_from": "", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["authentication", "identity and authentication", "auth in a go application"], "compared": [{"slug": "better-auth", "name": "Better Auth", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45915114", "title": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49085276", "title": "Show HN: PidgeIoT \u2013 open-source IoT/Embedded device management for all (free*)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48668033", "title": "Cloudflare launched self-managed OAuth for all", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48038827", "title": "From Supabase to Clerk to Better Auth", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"compare": 1}, "2026-06": {"recommend": 1}, "2026-07": {"neutral": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 785364578, "item_id": 49085286, "url": "https://news.ycombinator.com/item?id=49085286", "by": "Voxorin", "date": "2026-07-28", "stance": "neutral", "quote": "You can self-host Ory Kratos and PG.", "excerpt": "And now for some answers to questions I expect - Q: Is it self-hostable? - A: Well yes, but actually no. You can self-host Ory Kratos and PG. The core is deployable to your own Cloudflare account, but can't be run on bare metal (well technically it could, but you shouldn't). I would like to make a fully self-hostable version in the future, but that's low on the priority list right now. - Q: Why not use JWTs for devic", "context": "", "use_case": "authentication", "switched_from": "", "story": "Show HN: PidgeIoT \u2013 open-source IoT/Embedded device management for all (free*)"}, {"id": 778846704, "item_id": 48677919, "url": "https://news.ycombinator.com/item?id=48677919", "by": "adeptima", "date": "2026-06-25", "stance": "recommend", "quote": "Ory's Kratos handles identity, login, registration, recovery, MFA...", "excerpt": "Mixed fealings cause the full context should include plans on both Authorization and Authentication flows at least withing Cloudflare ecosystem. No github examples Anyway good start in the right direction from Cloudflare, yet still long way to go especially compare to the full Ory's offering its built on. Ory's Kratos handles identity, login, registration, recovery, MFA... https://github.com/ory IMHO full scope shoul", "context": "", "use_case": "identity and authentication", "switched_from": "", "story": "Cloudflare launched self-managed OAuth for all"}, {"id": 768830993, "item_id": 48051937, "url": "https://news.ycombinator.com/item?id=48051937", "by": "joekrill", "date": "2026-05-07", "stance": "compare", "quote": "It's super straight-forward to implement compared with similar products (Ory Kratos, Keycloak, etc).", "excerpt": "> Better Auth checked a lot of boxes right out of the gate: high code quality, Maybe I have high standards, but I absolutely would not describe Better Auth as having \"high code quality\". It has certainly been improving, but when I first looked at this project it felt really rushed and thrown together, with little automated tests. There's was virtually no logging last I looked, so there's little options to monitor wha", "context": "", "use_case": "authentication", "switched_from": "", "story": "From Supabase to Clerk to Better Auth"}, {"id": 734656417, "item_id": 45916026, "url": "https://news.ycombinator.com/item?id=45916026", "by": "larrywinch", "date": "2025-11-13", "stance": "recommend", "quote": "This looks like great stuff.", "excerpt": "This looks like great stuff. In the TypeScript ecosystem, I'd probably take a look at Better Auth though, as the developer experience is really great!", "context": "", "use_case": "", "switched_from": "", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}, {"id": 734650016, "item_id": 45915626, "url": "https://news.ycombinator.com/item?id=45915626", "by": "caleblloyd", "date": "2025-11-13", "stance": "recommend", "quote": "Otherwise it was a great project to work with that has tons of knobs to customize.", "excerpt": "I used Ory Kratos in a Go application a couple years ago by installing it as a dependency. It worked pretty well but in hindsight I would have hosted it as a separate application because it was a pain to bring along all of its dependencies. One of my biggest complaints was that one of the Account Recovery flows was just an emailed 6-digit code. So a 1 in 1 million chance that somebody without access to any of your st", "context": "", "use_case": "auth in a Go application", "switched_from": "", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}]}