---
url: 'https://www.corbado.com/blog/best-keycloak-alternatives'
title: 'Top 10 Keycloak Alternatives'
description: 'Find the best Keycloak alternative for passkeys. Compare top CIAM providers by UX, integration, pricing, adoption and full passkey functionality at scale.'
lang: 'en'
author: 'Vincent'
date: '2025-04-04T16:19:34.729Z'
lastModified: '2026-04-01T06:00:50.730Z'
keywords: 'Keycloak alternative'
category: 'Passkeys Reviews'
---

# Top 10 Keycloak Alternatives

## Key Facts

- Keycloak lacks **fallback orchestration**, purpose-built passkey UX, adoption tooling
  and analytics, making specialized alternatives necessary for B2C deployments at scale.
- Corbado achieves up to **10x higher adoption rates** than generic solutions, tracking
  over 100 signals per user interaction to enable precise funnel optimization and A/B
  testing.
- **PingOne for Customers** starts at USD 35,000/year; Hanko's Startup Plan supports 1
  million monthly active users at USD 29/month flat.
- **Duende IdentityServer** provides no native WebAuthn support, requiring developers to
  implement passkey ceremonies, attestation and credential storage entirely from scratch.
- Amazon Cognito includes passkey support in standard **MAU pricing** with no per-device
  fees, but lacks conditional UI, adoption analytics and fallback orchestration.

## 1. Why Using a Keycloak Alternative?

[Keycloak](https://www.corbado.com/blog/keycloak-passkeys) is a powerful open-source identity and access
management (IAM) solution popular among developer teams. It offers built-in support for
WebAuthn and passkeys, making it a strong starting point for internal tools or
engineering-driven environments.

However, if your goal is to roll out
[passkeys at scale](https://www.corbado.com/blog/introducing-passkeys-large-scale-overview) to end users,
especially in B2C scenarios, [Keycloak](https://www.corbado.com/blog/keycloak-passkeys) shows its limitations. It
lacks purpose-built UX, fallback orchestration, adoption tooling, and
[passkey analytics](https://www.corbado.com/blog/passkey-analytics). For teams that want to go beyond a
functional implementation and optimize real-world adoption and user experience,
alternative solutions may be more effective.

## 2. What to Look for in Passkey Alternatives?

When evaluating alternatives to [Keycloak](https://www.corbado.com/blog/keycloak-passkeys) with passkeys in mind,
it’s important to go beyond surface-level feature checklists. Here’s what really matters
if you want passkeys to work - not just technically, but at scale.

### 2.1 Passkey Functionality

Yes, any [passkey provider](https://www.corbado.com/blog/passkey-providers) should support WebAuthn, platform
[authenticators](https://www.corbado.com/glossary/authenticator) (iOS,
[Android](https://www.corbado.com/blog/how-to-enable-passkeys-android), macOS,
[Windows Hello](https://www.corbado.com/glossary/windows-hello)) and basic login and registration flows. But
advanced functionality makes or breaks adoption at scale:

- **Multi-passkey support per user**\
  Support for [multiple passkeys per account](https://www.corbado.com/faq/multiple-passkeys-per-account) (e.g.,
  one for phone, one for laptop), including device names, metadata, and management
  options.

- **Optimized login flows**\
  Features like 1-Tap login, [Conditional UI](https://www.corbado.com/glossary/conditional-ui) or automatic
  passkey ceremony start to reduce friction and increase adoption.

- **Passkey fallback mechanisms**\
  What happens when passkey authentication fails? A secure and user-friendly fallback path
  is essential.

- **Passkey intelligence**\
  Real-time insights and decision support to find out if passkey logins and creations work
  for a user on a particular device and browser version. This helps to optimize the
  passkey experience and ultimately adoption.

- **Passkey analytics and tracking**\
  Built-in analytics to monitor adoption, success rates, error types and other key
  metrics.

- **Advanced passkey management console**\
  A powerful interface for admins to manage, monitor and debug passkey activity across the
  user base. Often this includes detailed login funnel analyses.

- **Support for advanced WebAuthn features**\
  Advanced features such as [WebAuthn Signal API](https://www.corbado.com/blog/webauthn-signal-api), Client
  Capabilities and [Client Hints](https://www.corbado.com/blog/client-hints-user-agent-chrome-safari-firefox)

### 2.2 Implementation Effort

Passkeys aren’t plug-and-play in terms of implementation - the hard part is in the
details. Look for providers that reduce engineering overhead by offering:

- **Purpose-built passkey SDKs and UI components**\
  Not just generic OAuth-like “Log in with a passkey” buttons or “magic link” flows, but
  components specifically designed for smooth passkey registration and login.

- **Credential lifecycle management APIs**\
  Support for creating, listing, renaming, deleting and rotating passkeys via
  well-documented APIs.

- **Progressive migration support**\
  Enable existing users to add a passkey after login or during key friction points, such
  as [2FA](https://www.corbado.com/blog/passkeys-vs-2fa-security) prompts, which are essential for driving
  gradual adoption.

- **Developer tooling**\
  Robust support for integration and testing, including WebAuthn testing harnesses,
  integration simulators and real-time logs for device/browser diagnostics

### 2.3 Passkey User Experience (UX)

[Passkey adoption](https://www.corbado.com/blog/passkey-adoption-business-case) lives or dies by UX. It's not
enough for the flow to “technically work”, the focus must be on maximizing login and
activation rates as well as minimizing user drop-off and avoiding dead-ends. Look for
solutions that go beyond the basics and deliver a seamless, user-centric experience:

- **Advanced login flows**\
  Start the login flow via
  [passkey autofill](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill) or
  [one-tap](https://docs.corbado.com/corbado-connect/features/one-tap-login) passkey
  buttons - no need for extra clicks, or manual username input.

- **Visual feedback and context**\
  Clear indicators during [passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) and
  login, including:\
  – Progress bars or animations\
  – Contextual messages (e.g., “Logging in with your iPhone”)\
  – UI-level fallback guidance if something fails

- **First-time user onboarding**\
  Localized messaging and subtle animations that educate and build trust, especially for
  users new to passkeys.

- **Smart fallback routing**\
  Intuitive options when [passkey login](https://www.corbado.com/blog/passkey-login-best-practices) isn’t
  available, such as “Use another device”, “Continue with SMS” or “Use passkey on your
  phone”

- **Device-awareness**\
  Avoid confusing users by hiding passkey options on unsupported environments (e.g.,
  desktop browsers without WebAuthn support).

### 2.4 Passkey Adoption

Enabling passkeys is easy. Driving real-world usage? Much harder. A good provider will
actively help you get users to adopt passkeys.

#### 2.4.1 Adoption Strategy & Tools

Look for a provider that offers more than just the technical foundation:

- **Focus on real adoption rates**\
  Does the provider help you drive meaningful adoption (e.g. 50–80% of users) or just
  “offer passkeys” as a feature?

- **Support for campaigns and nudges**\
  – Segment-based passkey prompts\
  – Nudging users after login or during security prompts\
  – Forced enrollment for secure environments

- **Progressive onboarding flows**\
  Encourage [passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) at key moments, like
  after the login, after the password entry or on secure device login

- **In-product promotion tools**\
  – Tooltips, modals, or banners that encourage
  [passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices)\
  – Built-in analytics to track conversion and interaction

- **Deep analytics & insights**\
  – How many users have created a passkey?\
  – Login success rates by device, browser, or OS\
  – Fallback usage frequency\
  – Drop-off points in the flow

- **User segmentation**\
  Identify users based on their device/browser compatibility, historical login behavior
  and passkey readiness

- **A/B testing support**\
  Experiment with different authentication flows and fallback strategies to find what
  works best.

- **Password phase-out strategies**\
  Built-in tools and strategies to help you remove passwords entirely once a critical mass
  of [passkey adoption](https://www.corbado.com/blog/passkey-adoption-business-case) is reached.

#### 2.4.2 User Education & Onboarding

Simple, clear onboarding builds trust and helps users adopt passkeys with confidence.

- **Ready-made UI & help content**\
  – Pre-built UI components, prompts, and messages\
  – Consumer-friendly help centers and step-by-step guides

- **Support for diverse user groups**\
  – Guidance tailored to both tech-savvy and non-tech-savvy users\
  – Consideration for global variations in language, device type, and OS versions

#### 2.4.3 Long-Term Roadmap to Passwordless

True value comes from moving toward a fully passwordless future. Look for providers that
help you plan for:

- Safe removal of passwords once passkey coverage is sufficient

- Ongoing user education to keep passkeys “top of mind”

- Tools to prevent fallback dependency and legacy credential usage

### 2.5 Operations & Maintenance

With passkeys, much of the complexity shifts from the user experience to backend
operations and support workflows. A strong provider will simplify ongoing management and
reduce the operational burden.

**Key operational capabilities to consider:**

#### 2.5.1 Ongoing Monitoring & Security Updates

- **Device Visibility & Metadata Logging**\
  Automatic logging of key metadata such as creation date, browser and platform type, and
  device nickname to support [troubleshooting](https://www.corbado.com/blog/passkey-troubleshooting-solutions)
  and analytics.

- **Regular Release Cadence**\
  Timely updates in response to WebAuthn spec changes, browser and OS updates, or passkey
  ecosystem developments.

- **Security Responsiveness**\
  Proactive handling of security advisories and zero-day
  [vulnerabilities](https://www.corbado.com/glossary/vulnerability), including rapid deployment of patches across
  infrastructure.

#### 2.5.2 Cross-Platform Testing & QA

- **Compatibility Assurance**\
  Continuous testing to ensure reliable passkey functionality across all major browsers,
  operating systems, and devices.

- **Automated vs. Manual QA**\
  Preference for providers with automated
  [end-to-end test](https://www.corbado.com/blog/passkeys-e2e-playwright-testing-webauthn-virtual-authenticator)
  coverage to catch regressions early and reduce operational overhead.

- **Adoption Engineering**\
  Access to dedicated experts to monitor adoption rates and optimize UX across platforms –
  especially valuable in managed passkey offerings.

- **Monitoring & Troubleshooting Tools**\
  Real-time visibility into authentication flows: see which device a login originated
  from, what credential was used, and why a
  [passkey login](https://www.corbado.com/blog/passkey-login-best-practices) may have failed.

- **Enterprise-Grade Observability**\
  Role-based access controls (RBAC), audit logs, and full compliance with SOC2/GDPR for
  tracking and securing authentication events.

- **Dashboards & Alerts**\
  Customizable analytics for tracking adoption metrics, fallback method usage, and
  suspicious behaviors (e.g., excessive device re-registrations).

### 2.6 Pricing & ROI

Many providers treat passkeys as a premium add-on or charging per device or credential. To
make a [future-proof](https://www.corbado.com/faq/are-passkeys-the-future) decision, evaluate both the total cost
of ownership and the expected return on investment.

#### 2.6.1 Transparent & Scalable Pricing

- **Inclusive Passkey Support**\
  [Passkey features](https://www.corbado.com/blog/social-logins-pre-filled-passkeys-customization) should be
  included by default, not upsold as an add-on.

- **No Per-Device or Per-Credential Fees**\
  Pricing should scale with your users, not with the number of devices or credentials they
  use.

- **Predictable Cost Structures**\
  Look for pricing models that grow linearly or offer volume discounts as adoption
  increases.

#### 2.6.2 Total Cost of Ownership (TCO)

- **Upfront Costs**\
  Consider vendor license fees and the time required to integrate passkeys — whether
  building in-house or working with a third party.

- **Ongoing Costs**\
  Factor in developer time for maintaining passkey implementations, performing security
  audits, and staying up to date with ecosystem changes.

- **Future Expansion**\
  Evaluate the cost of adding advanced capabilities later (e.g., device intelligence,
  analytics, or [identity verification](https://www.corbado.com/blog/digital-identity-guide)) - especially if
  you'd need to build them yourself.

#### 2.6.3 Return on Investment (ROI)

- **Operational Savings**
    - Lower
      [SMS OTP costs](https://www.corbado.com/blog/introducing-passkeys-large-scale-overview/why-are-sms-otps-costly-for-enterprises)

    - Fewer login-related support tickets

    - Reduced account recovery overhead

- **User Experience Gains**
    - Higher login success rates and fewer abandoned sessions

    - Smoother logins across devices improve user retention and engagement

- **Business Impact**
    - Increased revenue from more completed logins or transactions, particularly in
      [e-commerce](https://www.corbado.com/passkeys-for-e-commerce)

    - Faster onboarding and reduced friction in critical user journeys

#### 2.6.4 Time to Market

- **Implementation Speed**\
  Compare the timeline to integrate passkeys with a vendor vs. building from scratch

- **Opportunity Cost**\
  Delays in shipping passkey support can result in lost competitive advantage, missed
  conversion opportunities or higher support burden.

## 3. Alternatives

Keycloak works well if you're already using it as your IdP and have the engineering
capacity to build everything around passkeys yourself. But when time-to-market, conversion
optimization, and ease of adoption matter, it’s worth evaluating solutions tailored for
passkey-first authentication.

Here are some of the most relevant alternatives – including Corbado, which was built
specifically to drive high [passkey adoption](https://www.corbado.com/blog/passkey-adoption-business-case) in
public-facing apps and platforms.

### 3.1 Corbado

Corbado is built specifically for passkey-first applications. Unlike many CIAM providers
who treat passkeys as a side feature, Corbado puts
[passwordless UX](https://www.corbado.com/faq/passkey-user-experience-benefits-non-technical-audience) and high
passkey adoption at the center. The solution supports both, integrates seamlessly into
existing identity systems, gets you 10x higher passkey adoption and is optimized for
[large-scale](https://www.corbado.com/blog/introducing-passkeys-large-scale-overview) B2C or
[public-sector](https://www.corbado.com/passkeys-for-public-sector) deployments.

#### 3.1.1 Passkey Functionality

Corbado delivers industry-leading passkey adoption with robust WebAuthn functionality.

- Supports [WebAuthn Level 3](https://www.corbado.com/blog/passkeys-prf-webauthn) with Signal API,
  [Client Capabilities](https://www.corbado.com/blog/webauthn-client-capabilities), and
  [Client Hints](https://www.corbado.com/blog/client-hints-user-agent-chrome-safari-firefox)

- Multi-passkey support per user, with comprehensive metadata and management options

- Advanced fallback logic with proactive detection of problematic environments and
  alternatives

- Comprehensive
  [passkey intelligence](https://docs.corbado.com/corbado-connect/features/passkey-intelligence):
  over 100 tracked signals per interaction (OS, browser, device, errors, behavior)

- Real-time funnel analysis and adaptive login algorithms

#### 3.1.2 Implementation Effort

Corbado ensures minimal integration complexity, designed specifically for
[large-scale](https://www.corbado.com/blog/introducing-passkeys-large-scale-overview) rollouts.

- Ready-to-use SDKs and UI components for [React](https://www.corbado.com/blog/react-passkeys),
  [Next.js](https://www.corbado.com/blog/nextjs-passkeys), and plain HTML / JavaScript

- Credential lifecycle management APIs (create, list, rename, delete, rotate)

- Seamless integration into existing CIAM/IdP setups without user migration

- Robust developer tooling, including traffic adoption simulators, real-time logs, and
  integration diagnostics

#### 3.1.3 User Experience

Corbado prioritizes frictionless UX, resulting in exceptional adoption rates.

- Native [biometric authentication](https://www.corbado.com/blog/passkeys-biometric-authentication) via
  [one-tap](https://docs.corbado.com/corbado-connect/features/one-tap-login) login and
  autofill-first user experience

- Context-aware, proactive fallback logic to maintain seamless login experiences

- Comprehensive visual feedback and contextual messages to enhance user understanding

- Continuous UX optimization powered by detailed user behavior tracking and analytics

#### 3.1.4 Passkey Adoption

Corbado significantly outperforms generic solutions, focusing heavily on measurable
adoption.

- Up to 10x higher passkey adoption rates compared to other solutions

- In-depth tracking of over 100 signals per user event, enabling precise A/B testing and
  funnel optimization

- Behavioral nudging, tailored prompts, and adaptive strategies based on user behavior and
  device capabilities

- Comprehensive passkey adoption analytics, insights into success rates, fallbacks, and
  drop-off points

- Built-in tools to support gradual password phase-out and progressive onboarding

#### 3.1.5 Operations & Maintenance

Corbado simplifies ongoing maintenance and reduces support overhead.

- Advanced device metadata logging (creation date, browser, OS, device nickname)

- Regular, proactive updates for OS/browser compatibility and rapid response to security
  advisories

- Fully automated cross-platform QA to ensure compatibility and reliability

- Comprehensive monitoring, real-time diagnostics,
  [troubleshooting](https://www.corbado.com/blog/passkey-troubleshooting-solutions) dashboards, and alerting
  tools

- GDPR/SOC2-compliant audit trails, role-based access controls (RBAC), and observability

#### 3.1.6 Pricing & ROI

Corbado provides predictable, scalable
[pricing with rapid return on investment](https://www.corbado.com/pricing).

- Transparent, user-based pricing without per-device or credential fees

- Immediate cost reductions in SMS OTP, support tickets, and account recovery overhead

- Increased login success rates and reduced session abandonment rates

- ROI typically realized in less than 12 months, avoiding hidden in-house development
  costs

- Supports [gradual rollout](https://www.corbado.com/faq/gradual-rollout-support-passkey-adoption) strategies,
  minimizing operational and financial risk

#### 3.1.7 Conclusion

Corbado is an ideal solution for
[large-scale](https://www.corbado.com/blog/introducing-passkeys-large-scale-overview) B2C organizations aiming
for high passkey adoption and frictionless user experiences. Its strengths lie in
extensive data-driven optimizations, advanced UX flows, seamless integration capabilities,
and minimal operational complexity, making it especially suitable for environments where
login success directly impacts revenue,
[customer retention](https://www.corbado.com/blog/passkeys-user-retention-keychain) and brand perception.

### 3.2 Frontegg

Frontegg is a flexible CIAM platform popular with B2B
[SaaS](https://www.corbado.com/blog/saas-companies-integrate-passkeys) companies. It offers a wide range of
authentication features and has recently added initial support for passkeys. While this
makes it a viable option for teams exploring
[passwordless authentication](https://www.corbado.com/glossary/passwordless-authentication), its passkey tooling
is still maturing, especially for high-adoption and user-facing environments.

#### 3.2.1 Passkey Functionality

Frontegg supports WebAuthn-based passkeys across major platforms, including Touch ID, Face
ID, and [Windows Hello](https://www.corbado.com/glossary/windows-hello).

- Basic passkey creation and login flows are supported via hosted UI

- Multi-passkey support and credential metadata management are limited

- No support for advanced WebAuthn features like Signal API or
  [Client Capabilities](https://www.corbado.com/blog/webauthn-client-capabilities)

- No credential lifecycle APIs for renaming, listing, or deleting passkeys

#### 3.2.2 Implementation Effort

Integration is straightforward using Frontegg’s hosted login flow, but custom UI use cases
may require more effort.

- Hosted login widget simplifies initial setup

- Custom frontends require manual WebAuthn integration

- No dedicated SDKs or UI components tailored for passkeys

- Lacks fallback orchestration or real-time diagnostics during integration

#### 3.2.3 User Experience

Passkey UX is functional but not yet optimized for high-conversion, frictionless user
journeys.

- No [conditional UI](https://www.corbado.com/glossary/conditional-ui) or
  [one-tap login](https://docs.corbado.com/corbado-connect/features/one-tap-login)
  experience

- Limited contextual feedback or animations during login

- No visual indicators for [passkey fallback](https://www.corbado.com/blog/passkey-fallback-recovery) options

- User onboarding is generic and lacks passkey-specific guidance

#### 3.2.4 Passkey Adoption

Frontegg enables passkey usage but provides few tools to increase real-world adoption.

- No built-in nudging or segmentation for onboarding

- No A/B testing or analytics on passkey conversion

- No in-product prompts or timing-based enrollment flows

- No tracking of drop-offs or fallback usage

#### 3.2.5 Operations & Maintenance

Includes general [authentication observability](https://www.corbado.com/blog/authentication-observability), but
passkey-specific tooling is not yet available.

- No dashboards for passkey success rates or device/browser usage

- No logs or error reports for failed passkey attempts

- No role-based filtering or passkey-specific alerts

#### 3.2.6 Pricing & ROI

Frontegg offers tiered pricing with
[passkey features](https://www.corbado.com/blog/social-logins-pre-filled-passkeys-customization) available in
higher plans.

- No additional fees per device or credential

- Passkey value depends on broader CIAM usage

- ROI primarily driven by consolidation and ease-of-use, not passkey adoption alone

#### 3.2.7 Conclusion

Frontegg is a versatile CIAM platform that offers initial support for passkeys and works
well for teams exploring
[passwordless authentication](https://www.corbado.com/glossary/passwordless-authentication) in
[SaaS](https://www.corbado.com/blog/saas-companies-integrate-passkeys) environments. However, if your goal is to
reach high passkey adoption rates across diverse user devices and environments, more
specialized solutions with advanced tooling and UX may offer better long-term fit.

### 3.3 LoginID

LoginID is a strong choice for **enterprises with strict compliance, fraud prevention and
regulatory requirements**, offering built-in legal binding and [FIDO2](https://www.corbado.com/glossary/fido2)
support.\
**However**, it lacks transparent pricing, modern UX optimization, and developer-friendly
tooling for driving passkey adoption at scale.

#### 3.3.1 Passkey Functionality

LoginID provides solid foundational support for passkey authentication across major
platforms.

- Supports WebAuthn-based passkey creation and authentication across web and mobile
  platforms.

- Includes basic credential management options (list, rename,
  [delete passkeys](https://www.corbado.com/blog/webauthn-signal-api)).

- However, advanced [WebAuthn Level 3](https://www.corbado.com/blog/passkeys-prf-webauthn) features (e.g., Signal
  API, [Client Capabilities](https://www.corbado.com/blog/webauthn-client-capabilities),
  [Client Hints](https://www.corbado.com/blog/client-hints-user-agent-chrome-safari-firefox)) are not explicitly
  documented.

#### 3.3.2 Implementation Effort

LoginID offers multiple SDKs and APIs aimed at easing integration, though deeper
integration scenarios may require significant development effort.

- Provides SDKs for web (JavaScript) and mobile (Android, [iOS](https://www.corbado.com/blog/webauthn-errors))
  applications.

- Allows integration into existing IAM solutionsDocumentation lacks details on advanced
  migration or progressive onboarding scenarios, potentially increasing complexity in
  large-scale implementations.

#### 3.3.3 User Experience

LoginID prioritizes simplicity and ease-of-use, although some advanced UX optimizations
might be missing.

- Offers convenient autofill functionality for streamlined authentication.

- Supports "usernameless" login flows to reduce friction.

- Limited information about visual feedback, onboarding nudges, or platform-specific
  optimizations (e.g., [Conditional UI](https://www.corbado.com/glossary/conditional-ui), advanced fallback UX).

#### 3.3.4 Passkey Adoption

LoginID includes basic mechanisms to support passkey adoption, though comprehensive user
adoption tooling is unclear.

- Allows users to upgrade existing authentication methods to passkeys after initial login.

- No explicit documentation regarding behavior-based nudging, in-product prompts, user
  segmentation, or built-in A/B testing to drive large-scale adoption.

- Missing detailed analytics or insights for adoption funnel optimization.

#### 3.3.5 Operations & Maintenance

LoginID provides foundational operations and management tools, but enterprise-grade
observability and advanced monitoring are not fully detailed.

- Includes basic credential management APIs and session management.

- Comprehensive device metadata logging, detailed authentication event monitoring, audit
  logging, or SOC2/GDPR-compliant observability tools are not explicitly described in
  documentation.

- Real-time [troubleshooting](https://www.corbado.com/blog/passkey-troubleshooting-solutions) and monitoring
  dashboards appear to be absent or minimally documented.

#### 3.3.6 Pricing & ROI

LoginID pricing is enterprise-oriented and non-transparent, requiring direct vendor
contact.

- No publicly disclosed pricing; custom quotes needed based on usage and scale.

- Appears suitable mainly for enterprise or compliance-focused environments rather than
  startups or smaller deployments.

ROI likely driven by compliance, reduced OTP costs, and improved login security; however,
detailed cost-benefit analysis examples are not publicly available.

#### 3.3.7 Conclusion

LoginID is a viable choice for organizations prioritizing basic passkey integration and
compliance-driven environments.

However, teams seeking extensive UX optimizations, detailed analytics for adoption, robust
operational observability, or transparent pricing models might find gaps in the current
offering.

### 3.4 Authsignal

Authsignal is a good fit for **developers building custom authentication flows with strong
policy orchestration and fraud-based step-up logic**.\
**However**, passkey support is limited to lower-level integration, with no built-in
adoption flows or UX components for
[passkey onboarding](https://www.corbado.com/faq/steps-creating-passkey-user-onboarding).

#### 3.4.1 Passkey Functionality

Authsignal offers basic passkey authentication features. Besides they support various
authentication methods, including TOTP, SMS OTP and push notifications, providing
flexibility in user authentication.

#### 3.4.2 Implementation Effort

Authsignal aims to simplify the integration process with:​

- **Drop-In Integration**: Designed to plug into any architecture, allowing rapid
  deployment of passkeys, [adaptive MFA](https://www.corbado.com/glossary/adaptive-mfa), and passwordless
  authentication

- **SDKs and Pre-Built UI Components**: Offers SDKs for JavaScript,
  [React](https://www.corbado.com/blog/react-passkeys) Native, [iOS](https://www.corbado.com/blog/webauthn-errors), and
  [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android), along with pre-built UI components,
  facilitating seamless integration across platforms.

- **Platform Integrations**: Provides integration for integrating with various IAM
  solutions,

#### 3.4.3 User Experience

Authsignal focuses on delivering a seamless and
[user-friendly authentication](https://www.corbado.com/faq/passkey-user-experience-benefits-non-technical-audience)
experience:​

- **Passwordless Authentication**: Facilitates a smooth user experience by eliminating the
  need for traditional passwords, utilizing passkeys and
  [biometric authentication](https://www.corbado.com/blog/passkeys-biometric-authentication) methods. ​

- **Effortless UX**: Provides [authenticator](https://www.corbado.com/glossary/authenticator) enrollment and
  challenge flows, allowing customization with branding elements like logos to align with
  the application's design.

#### 3.4.4 Adoption

To promote passkey adoption, Authsignal provides:​

- **Expert Support**: Offers guidance and support to achieve high passkey adoption rates
  within organizations.

- **Educational Resources**: Publishes articles and guides on implementing passkeys,
  including strategies for championing passkey adoption and understanding their
  functionality.

#### 3.4.5 Operations & Maintenance

Authsignal provides tools and features to support ongoing management:

- **No-Code Rules Engine**: Allows for the creation and management of authentication rules
  and policies without coding, facilitating [adaptive MFA](https://www.corbado.com/glossary/adaptive-mfa) and
  risk-based authentication.

- **360 Observability and Analytics**: Offers analytics and observability features,
  providing insights into authentication events and user behaviors.

#### 3.4.6 Pricing & ROI

Authsignal offers scalable pricing plans:

- **Free Plan**: Supports up to 2,000 monthly active users, including features like
  passkeys, SMS OTP, email OTP, TOTP, a no-code rules engine, and a single view of the
  customer.

- **Essential Plan**: Starting at $99 USD/month (billed annually) for 5,000 monthly active
  users, offering all features from the Free plan plus additional capabilities.

#### 3.4.7 Conclusion

Authsignal presents a robust and flexible authentication solution, particularly
well-suited for organizations seeking to add multi-factor authentication to their product.
Its drop-in integration, comprehensive SDKs, and pre-built UI components facilitate rapid
deployment across various platforms.

However, organizations with highly specialized requirements or those seeking extensive
customization may need to assess whether Authsignal's offerings align with their specific
needs.

### 3.5 OwnID

OwnID is well suited for **e-commerce platforms** and **retail-focused websites** looking
to add passkey-based login via
[biometric authentication](https://www.corbado.com/blog/passkeys-biometric-authentication) with low development
overhead. Their approach is tailored to specific integrations and verticals.\
**However**, their solution is **highly niche**, often tightly coupled with proprietary
components, and lacks the flexibility and UX polish needed for broader or more customized
implementations.

#### 3.5.1 Passkey Functionality

OwnID offers passkey support as part of a tightly scoped authentication solution tailored
to [e-commerce](https://www.corbado.com/passkeys-for-e-commerce).

- Focuses on biometric login across [retail](https://www.corbado.com/passkeys-for-e-commerce) and commerce use
  cases with opinionated integration paths.

- Offers multiple auth methods, but passkey flows are **not open or extensible** beyond
  predefined templates.

    Does not support advanced WebAuthn features or deep customization for varied user
    flows.

#### 3.5.2 Implementation Effort

OwnID aims to simplify integration with:

- **Connectors and SDKs**: Provides pre-built connectors for platforms like Salesforce
  Commerce Cloud, [Adobe](https://www.corbado.com/blog/adobe-passkeys-best-practices-analysis) Commerce Cloud,
  and [Auth0](https://www.corbado.com/blog/auth0-passkeys-analysis), as well as SDKs for custom integrations.

- **Quickstart Guides and Documentation**: Offers comprehensive guides to facilitate rapid
  implementation, reducing development time and effort.

#### 3.5.3 User Experience

OwnID provides a basic biometric login flow optimized for embedded
[e-commerce](https://www.corbado.com/passkeys-for-e-commerce) scenarios.

- UX is **highly standardized**, limiting control for teams wanting to tailor onboarding
  or fallback flows.

- Visuals and messaging are **generic and not optimized for high-conversion UX**,
  especially outside of commerce-specific use cases.

- Lacks dynamic passkey logic (e.g., conditional UI, smart fallback routing, or real-time
  behavioral nudging).

#### 3.5.4 Passkey Adoption

To promote passkey adoption, OwnID provides:

- **Systematic Transition from Passwords**: Integrates passkeys directly into the login
  process, systematically shifting users away from passwords over time.

- **Post-Login Enrollment**: After a user logs in with a password, they are offered the
  ability to skip the password next time by setting up a passkey, encouraging gradual
  adoption.

#### 3.5.5 Operations & Maintenance

OwnID provides tools to support ongoing management:​

- **Admin Dashboard**: Offers an interface for monitoring authentication activities and
  managing user credentials.​

- **Fallback Authentication Methods**: Automatically includes alternative authentication
  methods to ensure users can access their accounts even if passkeys are unavailable.

#### 3.5.6 Pricing & ROI

Specific pricing information for OwnID's services is not publicly disclosed. Organizations
are encouraged to contact OwnID directly to obtain detailed pricing information tailored
to their specific use cases and requirements.​

#### 3.5.7 Conclusion

OwnID presents a [passwordless authentication](https://www.corbado.com/glossary/passwordless-authentication)
solution focused on **niche e-commerce platforms** with pre-built flows and limited
customization. It’s a fit for companies looking for a narrowly scoped solution that “just
works” within supported platforms.\
However, its **lack of UX flexibility**, **limited analytics**, and **tight focus on
specific shop platforms** make it less suitable for larger-scale rollouts or teams with
broader identity needs or advanced adoption goals.

### 3.6 Hanko

Hanko is ideal for **startups and teams seeking a simple, open-source passkey
implementation** with clean SDKs and hosted options.\
**However**, it currently lacks enterprise-level observability, adoption tooling, and
advanced fallback orchestration.

#### 3.6.1 Passkey Functionality

Hanko offers a comprehensive passkey authentication system:​

- **FIDO2-Certified Passkey API and SDK**: Facilitates integration of passkeys into
  existing authentication systems, supporting various methods including passkeys,
  passwords, passcodes, and social logins.

- **Multi-Factor Authentication (MFA)**: Supports TOTP
  [authenticator](https://www.corbado.com/glossary/authenticator) apps and FIDO security keys, enhancing account
  security.

#### 3.6.2 Implementation Effort

Hanko aims to simplify integration with:

- **Embeddable Web Components and APIs**: Designed for quick integration into
  applications.

- **JavaScript/TypeScript SDK**: Facilitates interaction with the Passkey API.

- **Example Implementations**: Provides guides for frameworks like
  [Next.js](https://www.corbado.com/blog/nextjs-passkeys) and the T3 Stack.

#### 3.6.3 User Experience

Hanko focuses on delivering a seamless authentication experience:​

- **Passwordless Authentication**: Utilizes passkeys and passcodes for user convenience.

- **Customizable Authentication Components**: Aligns with application design and user
  flow.

- **Passkey Management**: Allows users to view, create, rename, and
  [delete passkeys](https://www.corbado.com/blog/webauthn-signal-api) within their security settings. ​

#### 3.6.4 Passkey Adoption

To promote passkey adoption, Hanko recommends:​

- **Onboarding Integration**: Encouraging users to create passkeys during initial
  onboarding to ensure early adoption.

- **User Prompts**: Prompting returning users who haven't created a passkey to do so,
  highlighting benefits like faster logins and enhanced security.

The focus is more on giving the user a choice for login methods than driving real-world
passkey adoption.

- Passkey API can be added to existing auth systems but requires substantial additional
  engineering effort for real-world usage

- No support for nudging, A/B testing, or user segmentation

- Lacks tooling for gradual password phase-out

#### 3.6.5 Operations & Maintenance

Hanko provides tools for ongoing management:​

- **Admin API Endpoints**: Includes endpoints for managing passwords, WebAuthn
  credentials, OTPs, and sessions.

- **Session Management**: Offers server-side sessions with options for session limits and
  active session lists.

- Metadata logging and basic auditing available

- No built-in dashboards or alerting for auth issues

#### 3.6.6 Pricing & ROI

Hanko offers scalable pricing plans:​

- **Free Plan**: Supports up to 10,000 monthly active users with core authentication
  features.

- **Pro Plan**: At $29/month, includes 10,000 free monthly active users, with additional
  users at $0.01 each, offering enhanced features like personal support and SAML
  [SSO](https://www.corbado.com/blog/passkeys-single-sign-on-sso).

- **Startup Plan**: Provides up to 1 million active users for $29/month flat.

#### 3.6.7 Conclusion

Hanko presents a robust authentication solution suitable for organizations aiming to
implement passkeys. Its clearly a solution for developers and startups. However,
organizations requiring highly specialized features or extensive customization may need to
assess whether Hanko's offerings align with their specific requirements.

### 3.7 Ping Identity

Ping is designed for **enterprises needing full IAM orchestration and secure,
standards-based passkey support across mobile and web**.\
**However**, its passkey feature set is part of a broader platform, with limited
documentation on UX, fallback logic or adoption-driving mechanisms.

#### 3.7.1 Passkey Functionality

- Supports basic [FIDO2](https://www.corbado.com/glossary/fido2)/WebAuthn for passwordless authentication with
  registered platform [authenticators](https://www.corbado.com/glossary/authenticator).

- Available through Ping SDKs for [iOS](https://www.corbado.com/blog/webauthn-errors),
  [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android), and JavaScript.

- No mention of advanced WebAuthn features like Signal API or Client Capabilities.

#### 3.7.2 Implementation Effort

- Sample applications are provided to help developers implement passkey flows.

- Requires PingAM or PingOne Advanced Identity Cloud for setup.

- No-code orchestration UI available through PingOne.

- SDK setup includes device binding and key pair registration.

#### 3.7.3 User Experience

- Mobile SDKs bind the device cryptographically to a user identity.

- No detailed documentation on fallback UX or contextual feedback.

#### 3.7.4 Passkey Adoption

- Offers cloud-based passwordless capabilities under PingOne for Customers.

- Adoption strategies like nudging or analytics are not publicly documented.

- Focus is on simply offering passkey of a feature, not consumer adoption UX.

#### 3.7.5 Operations & Maintenance

- SDKs support device verification, key rotation, and secure binding.

- No public details on passkey-specific observability or login funnel analytics.

- Security updates and versioning are maintained across Ping services.

#### 3.7.6 Pricing & ROI

- PingOne for Customers pricing starts at $35,000/year (Essential tier).

- Passkey support is part of broader passwordless orchestration capabilities.

- ROI is positioned around enterprise security, reduced password friction, and
  infrastructure alignment.

- No pricing per credential or device; volume-based enterprise pricing assumed.

#### 3.7.7 Conclusion

Ping Identity offers a robust and enterprise-grade passkey solution built on
[FIDO2](https://www.corbado.com/glossary/fido2) and WebAuthn standards. It is best suited for large organizations
already using the Ping platform or those needing orchestration, compliance, and secure
passwordless authentication at scale. The platform’s SDKs support key passkey flows on web
and mobile, and it integrates into existing IAM setups.

However, Ping Identity’s offering is less geared toward rapid implementation or
consumer-focused UX optimization. It lacks publicly documented features for A/B testing,
nudging strategies, deep analytics, and advanced
[passkey observability](https://www.corbado.com/blog/authentication-observability). Pricing is also
enterprise-only and not transparent.

### 3.8 Daon

Daon fits best for **large enterprises already using Daon’s identity stack (e.g. KYC,
biometrics)** and looking to expand into passkey-based authentication.\
**However**, it’s not ideal for greenfield implementations or teams seeking agile UX
customization, developer self-service, or rapid iteration.

#### 3.8.1 Passkey Functionality

Daon offers solid passkey support leveraging WebAuthn and FIDO2, particularly suitable for
regulated and enterprise environments.

- Supports WebAuthn and FIDO2 standards across major platforms (iOS, Android, macOS,
  [Windows Hello](https://www.corbado.com/glossary/windows-hello)).

- Provides foundational multi-passkey support, including basic management (create, delete,
  manage credentials).

- Limited public information on advanced [WebAuthn Level 3](https://www.corbado.com/blog/passkeys-prf-webauthn)
  features (e.g., Signal API, Client Capabilities, detailed analytics).

#### 3.8.2 Implementation Effort

Daon simplifies implementation via its identity platforms but may require significant
initial configuration.

- Offers IdentityX and TrustX platforms, designed for integration into existing
  authentication infrastructures.

- Provides [SaaS](https://www.corbado.com/blog/saas-companies-integrate-passkeys) deployment options (Identity
  Continuity with TrustX) and hosted identity solutions (IdentityX).

- Public documentation indicates strong compatibility with existing IAM setups, but
  specific developer tools like testing harnesses or detailed API documentation are
  limited publicly.

#### 3.8.3 User Experience

Daon prioritizes smooth and frictionless authentication experiences, with a focus on
biometrics and passkey-based login.

- Delivers passwordless, biometric-driven passkey authentication to reduce friction.

- Supports multi-factor authentication (MFA) with intuitive flows, enhancing security
  without compromising UX.

- Limited details publicly available on advanced UX elements like conditional UI, visual
  login progress indicators, or device-specific optimizations.

#### 3.8.4 Passkey Adoption

Daon provides foundational tools and guidance but offers limited public information on
adoption-focused strategies.

- Educates customers on passkey benefits through comprehensive FAQs and sector-specific
  resources (e.g., [financial services](https://www.corbado.com/passkeys-for-banking)).

- No detailed public information on proactive adoption tools such as A/B testing,
  segmented nudging, or progressive onboarding flows.

- Passkey-specific analytics, funnel tracking, or detailed adoption metrics are not
  prominently detailed publicly.

#### 3.8.5 Operations & Maintenance

Daon offers solid operational support with emphasis on compliance, though detailed
observability tools and analytics appear limited.

- Features general customer support teams to assist with implementation and maintenance.

- Compliance support documentation and assistance for regulated industries (GDPR, SOC2
  compliance).

- Publicly limited information on real-time troubleshooting dashboards, detailed device
  metadata logging, or comprehensive operational analytics.

#### 3.8.6 Pricing & ROI

Daon’s pricing is tailored for enterprise deals and not publicly disclosed.

- Pricing is quote-based; no transparent plans or per-user pricing models.

- Designed for large organizations with specific compliance or orchestration needs.

- ROI is likely framed around fraud reduction and enterprise security improvements.

- No data shared on passkey [conversion rates](https://www.corbado.com/blog/logins-impact-checkout-conversion),
  support ticket reduction, or UX uplift.

- Time to market may vary depending on existing use of IdentityX/TrustX infrastructure.

#### 3.8.7 Conclusion

Daon is a strong fit for organizations already using other parts of the Daon ecosystem
(e.g., [identity proofing](https://www.corbado.com/blog/digital-identity-guide),
[KYC](https://www.corbado.com/blog/iso-18013-7-mdl-bank-kyc-onboarding), or biometric authentication) and looking
to extend their stack with passkey capabilities. Its platform is built for large
enterprises with strict security, compliance, and orchestration requirements.

However, for product teams that are starting from scratch or looking for self-serve
developer tooling, passkey-specific UX optimization, or real-time adoption tracking, Daon
may be less suitable. The platform is designed for full-suite enterprise deployments
rather than lightweight or standalone passkey rollouts.

### 3.9 Duende

Duende is a great fit for **teams building custom OAuth2/OIDC infrastructure with full
control over authentication logic**.\
**However**, passkeys must be implemented entirely from scratch, with no native WebAuthn
support or tooling for adoption, fallback, or observability.

#### 3.9.1 Passkey Functionality

- Passkeys (WebAuthn) are not natively supported in Duende; developers must implement
  WebAuthn flows themselves or integrate third-party libraries.

- Duende is protocol-focused (OAuth2, OpenID Connect) and does not offer out-of-the-box
  biometric or passkey handling.

- Passkey support depends entirely on how much the developer is willing to build or plug
  in externally.

#### 3.9.2 Implementation Effort

- High integration effort for passkeys; developers need to manage WebAuthn ceremonies,
  [attestation](https://www.corbado.com/glossary/attestation), and credential storage manually.

- No official WebAuthn modules or SDKs; requires familiarity with both Duende’s
  extensibility model and WebAuthn spec.

- Best suited for teams with strong security and identity engineering experience.

#### 3.9.3 User Experience

- No native UI components or frontend support for passkeys.

- All UX for registration, login, and fallback handling must be built from scratch or
  sourced from third-party libraries.

- No support for Conditional UI or
  [one-tap login](https://docs.corbado.com/corbado-connect/features/one-tap-login) flows.

#### 3.9.4 Passkey Adoption

- No built-in tooling for onboarding, nudging, or progressive enrollment.

- Lacks analytics, segmentation, or tracking features needed to drive adoption.

- Adoption strategy is entirely custom and developer-defined.

#### 3.9.5 Operations & Maintenance

- No native observability or monitoring tools for passkey usage or issues.

- Credential lifecycle management must be built and maintained manually.

- Maintenance complexity increases with scale, especially in multi-device or
  cross-platform scenarios.

#### 3.9.6 Pricing & ROI

- Duende is a commercial product with licensing fees based on usage tiers.

- ROI for passkeys depends on how much of the WebAuthn stack is custom-built.

- Low TCO only if you already use Duende and have internal resources to manage passkey
  integration end-to-end.

#### 3.9.7 Conclusion

Duende IdentityServer is a powerful and flexible identity platform, best suited for teams
building **custom OAuth2/OpenID Connect solutions**. However, it does not provide native
passkey support - making it a better choice for developers who want full control over
authentication flows and are comfortable implementing the entire WebAuthn stack
themselves.

For companies focused on **fast passkey rollout, consumer adoption, or optimized UX**,
Duende alone is likely not sufficient. In those cases, an external passkey orchestration
layer may be needed to fill the gap.

### 3.10 Cognito

[Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito) is a good option for **simple passkey use cases
within the AWS ecosystem, especially when using Hosted UI and managed login flows**.\
**However**, it lacks flexibility for custom frontends, real adoption tooling, fallback
logic, and UX optimization - making it hard to scale passkey usage effectively.

#### 3.10.1 Passkey Functionality

[Amazon Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito) supports basic passkey (WebAuthn/FIDO2)
functionality for passwordless authentication through its Hosted UI.

- WebAuthn Support: Manages basic WebAuthn ceremonies internally without exposing advanced
  configuration options to developers.

- No advanced WebAuthn features like Conditional UI, Signal API, or fine-grained
  credential control.

#### 3.10.2 Implementation Effort

[Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito) is simple to set up if using the Hosted UI, but
custom frontend integration significantly increases development effort.

- Hosted UI Integration: Works out-of-the-box with minimal setup when using
  [Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito)’s managed login flow.

- Manual Integration for Custom UIs: Developers must handle WebAuthn flows manually if not
  using Hosted UI.

- No drop-in UI components or frontend SDKs for WebAuthn available from
  [AWS](https://www.corbado.com/blog/passkeys-amazon-cognito).

- Limited customization of the login experience (no access to PublicKeyCredentialOptions).

#### 3.10.3 User Experience

Cognito offers a functional but limited UX when it comes to passkeys.

- Separate “Sign in with passkey” Button: Requires explicit user action to trigger passkey
  login.

- No Conditional UI: Users won’t see
  [passkey autofill](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill) prompts
  automatically after entering their email.

- Static Login Flow: Passkey registration is only offered via Hosted UI and not embedded
  in contextual moments like post-login.

- Fallbacks like password and SMS are available but not orchestrated intelligently.

#### 3.10.4 Passkey Adoption

Cognito currently offers no dedicated features for increasing or tracking passkey
adoption.

- Manual Enrollment Only: Passkey registration must be initiated by the user through
  account settings or Hosted UI.

- No Nudging or A/B Testing: Lacks in-product messaging, nudges, or targeting strategies
  for progressive adoption.

- No Funnel Analytics: Developers cannot track passkey creation rates, drop-offs, or login
  method success.

- Adoption Intelligence: No support for fallback detection, device readiness, or
  behavioral targeting.

#### 3.10.5 Operations & Maintenance

Operational tools for managing passkey-based logins are minimal in Cognito.

- No Admin Dashboard for Passkeys: [AWS](https://www.corbado.com/blog/passkeys-amazon-cognito) Console provides
  general user management, but no passkey-specific views.

- No Real-Time Monitoring: No built-in logging or troubleshooting tools for failed
  WebAuthn attempts.

- Fallbacks are static: Passwords and MFA (e.g. OTP) can be used, but not dynamically
  orchestrated based on environment.

- No support for viewing device metadata or credential-level logs.

#### 3.10.6 Pricing & ROI

Cognito uses a pay-per-MAU model, but passkey usage is included without additional cost.

- Included in MAU Pricing: No extra fees for enabling passkeys within user pools.

- Transparent Pricing: [AWS](https://www.corbado.com/blog/passkeys-amazon-cognito) pricing for Cognito is
  publicly available and scales with MAUs.

- No Add-on Costs: Passkeys don’t incur device-based or credential-based charges.

- Limited ROI Optimization: No tooling for reducing SMS costs, increasing adoption, or
  optimizing login success.

#### 3.10.7 Conclusion

[Amazon Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito) provides a functional foundation for
adding passkey support, especially when using its Hosted UI. It’s a good fit for teams
that want to experiment with passkeys in a greenfield project or internal tool.

However, Cognito lacks customization, UX optimization, analytics and adoption tooling -
which limits its suitability for large-scale or enterprise passkey rollouts. Organizations
aiming for deep passkey integration, measurable adoption and frictionless UX may find
Cognito’s offering too limited without additional tooling.

## 4. Conclusion

We’ll be honest: We’ve got strong opinions on passkeys. It’s our daily focus, and yes,
that means we’ve got strong opinions. But only because we’ve seen what it really takes to
make passkeys work at scale - not just technically, but with real users, across devices
and in business-critical environments.

Keycloak gives developers control - but that comes at the cost of building your own
passkey flows, fallback logic, analytics and UX from scratch.

Corbado, on the other hand, delivers a production-ready passkey platform out of the box,
optimizing everything from login success rates to backend observability. A smart choice
for teams that want to ship quickly and scale passkeys with confidence.

## Frequently Asked Questions

### How does Keycloak's passkey support compare to purpose-built passkey providers?

Keycloak supports WebAuthn technically but lacks purpose-built UX, fallback orchestration,
adoption nudging and passkey analytics. Specialized providers like Corbado offer over 100
tracked signals per interaction, conditional UI and credential lifecycle APIs that
Keycloak requires teams to build from scratch.

### What should I evaluate when choosing a Keycloak alternative for enterprise passkey rollout?

Beyond basic WebAuthn support, evaluate providers on credential lifecycle management APIs,
fallback orchestration, passkey-specific analytics dashboards, GDPR/SOC2 compliance and
pricing transparency. Alternatives range from Hanko's USD 29/month startup plan to Ping
Identity's USD 35,000/year enterprise tier, with significant differences in adoption
tooling.

### Which Keycloak alternative is best suited for e-commerce passkey integration?

OwnID targets e-commerce specifically with pre-built connectors for Salesforce Commerce
Cloud and Adobe Commerce Cloud, offering low development overhead. However, its
standardized UX limits customization and it lacks conditional UI, A/B testing and detailed
adoption analytics for broader rollouts.

### How long does it typically take to see ROI after switching from Keycloak to a dedicated passkey provider?

Corbado targets ROI realization in less than 12 months, driven by reductions in SMS OTP
costs, fewer login-related support tickets and reduced account recovery overhead. Amazon
Cognito includes passkey support at no extra cost within MAU pricing but provides no
tooling to measure or actively optimize adoption outcomes.

### Which Keycloak alternative requires the least implementation effort to add passkey support?

Hanko and Authsignal offer the lowest implementation overhead among Keycloak alternatives.
Hanko provides a free plan for up to 10,000 monthly active users with embeddable web
components; Authsignal's free tier supports 2,000 monthly active users and includes
drop-in SDKs for React Native, iOS and Android.