Choosing between self-hosted and managed Keycloak affects more than where your identity service runs. It determines who maintains the infrastructure, who handles security updates, and how much responsibility your team takes on when users need to authenticate.
When you add authentication to an application, it's easy to focus on the login screen. You choose between passwords and passkeys, connect an identity provider, and make sure users can access their accounts. But there's another question worth asking before your application goes live: where are your users' credentials stored, and who is responsible for protecting them?
Keycloak gives developers control over authentication and identity management. You can run it on infrastructure you manage, or use a managed Keycloak service that takes care of much of the underlying operation.
Both approaches can work well. The right choice depends on your security requirements, your team's infrastructure experience, your budget, and how much operational responsibility you're prepared to take on.
Let's look at what happens to user passwords in each setup, what changes when you choose a managed service, and how to decide which option makes sense for your application.
TL;DR
With self-hosted Keycloak, user credentials are stored in the Keycloak database that you configure and operate. Your team is responsible for securing that database, maintaining backups, applying updates, and protecting the infrastructure.
With Skycloak's managed Keycloak, you use the official upstream Keycloak platform without operating the underlying identity infrastructure yourself. Skycloak manages the infrastructure and provides automatic updates, while your team retains control over Keycloak configuration and remains responsible for integrating authentication securely into your application.
Here's the practical difference:
- Self-hosted Keycloak: You control the deployment, database, network, updates, backups, and access policies. You also carry the operational burden of keeping everything secure and available.
- Managed Keycloak with Skycloak: Skycloak manages the underlying infrastructure while giving your team full Keycloak admin access. All plans support unlimited users, so pricing isn't tied to monthly active users.
- Regions and portability: Skycloak offers deployment regions in the US, EU, Canada, and Australia, plus realm export options to help you plan a migration if you later choose to self-host.
- Getting started: You can try Skycloak free for 21 days without providing a credit card.
- Password security: Keycloak stores passwords as salted password hashes, not as readable plaintext passwords. Database access, configuration, backups, and administrative permissions still need protection.
- Cost: Self-hosting can offer more infrastructure control, but server costs are only part of the total expense. Managed services add a service fee but can reduce the engineering time spent operating the identity platform.
The short answer: In a standard deployment, Keycloak handles authentication in both models. The main difference is who operates the identity infrastructure and how responsibilities are divided between your team and the provider. If you use an external user store, credential storage and verification may be handled partly or entirely by that system.
What Actually Happens to a Password in Keycloak?
Imagine someone creates an account in your application. They enter an email address, choose a password, and click Create account. Where does that password go?
In a typical Keycloak setup using its built-in user storage, Keycloak receives the password during account creation and stores a password hash in its configured database. A password hash is the output of a one-way password-hashing function. When the user signs in later, Keycloak verifies the submitted password against the stored hash. If an external user store handles authentication, credential storage and verification may follow a different process.
The database doesn't need to contain the original password in readable form. Keycloak uses a password-hashing algorithm and configuration designed to make guessing passwords computationally expensive. The exact algorithm and parameters depend on the Keycloak version and configuration.
Keycloak's default password-hashing algorithm depends on the version and deployment configuration. Keycloak 24 changed the default from pbkdf2-sha256 to pbkdf2-sha512. Starting with Keycloak 25, Argon2 became the default for non-FIPS deployments, while FIPS deployments use a compatible algorithm such as pbkdf2-sha512. Existing credentials may retain their previous hash until the user next signs in and Keycloak re-hashes the password under the current configuration.
To inspect or configure password policy settings, open the Keycloak Admin Console and navigate to Authentication → Policies → Password policy.
Review the policy configured for your realm before assuming it matches the defaults for a particular release.
Where Keycloak Stores Password Credentials
In a standard Keycloak deployment using its built-in user storage, password credentials are stored in the database configured for Keycloak. The CREDENTIAL table holds credential records associated with users, including password-related data and metadata.
Two fields help illustrate how that works:
-
SECRET_DATA: stores sensitive credential data, including password-hashing information. -
CREDENTIAL_DATA: stores additional credential metadata, such as information about the credential type and its configuration.
These fields contain structured data, not a readable copy of the user's original password. The exact contents depend on the credential type and Keycloak version.
For example, a password credential record may contain data resembling the following. These are illustrative examples, not actual values from a live Keycloak database.
// SECRET_DATA — illustrative example
{
"value": "[password hash omitted]",
"salt": "[salt omitted]",
"additionalParameters": {}
}
// CREDENTIAL_DATA — illustrative example
{
"algorithm": "argon2",
"hashIterations": "[configured value]",
"additionalParameters": {}
}
The exact field names and structure can vary by Keycloak version and credential implementation.
Password Hashing Isn't the Whole Security Story
This distinction matters because password hashing and database security solve different problems. Hashing helps protect passwords if someone obtains a copy of the credential records, but it doesn't make a compromised identity server or database harmless. Attackers who gain administrative access may be able to alter accounts, change authentication settings, or access other sensitive information.
For example, your deployment still needs to protect:
- Database access and administrative credentials.
- Backups containing credential records and other sensitive data.
- Keycloak configuration and privileged administrative accounts.
- The infrastructure and network surrounding the identity service.
Where Is the Rest of the Identity Data Stored?
Your Keycloak deployment also holds information beyond password credentials, including user profiles, groups, roles, and configuration data. Depending on your setup, it may connect to external identity providers or use additional user-storage systems. The exact location of user data therefore depends on how the realm and user storage are configured.
For a standard deployment using Keycloak's built-in user storage, the password hashes are held in the configured database. If your environment uses an external user store, the credentials may be managed there instead.
This is the starting point for comparing self-hosted and managed Keycloak: the credential-handling model can remain the same, while the people responsible for the surrounding infrastructure change.
What Self-Hosted Keycloak Means
With self-hosted Keycloak, you deploy and operate the identity service on infrastructure under your team's control. That might be a virtual machine, a container platform, Kubernetes, or another supported environment.
You choose the deployment architecture, configure the database, manage network access, and decide how the service fits into your existing infrastructure. This gives you considerable flexibility, which can be valuable when an application has specific compliance requirements or needs to integrate with internal systems.
What Your Team Is Responsible For
The trade-off is that your team must take responsibility for operating the service reliably.
That includes:
- Applying Keycloak security updates and testing upgrades.
- Maintaining the database and testing backups and restores.
- Monitoring availability and planning for service failures.
- Protecting administrative accounts, TLS certificates, and network rules.
- Reviewing configuration changes and tracking security advisories.
There's also the less visible work: testing recovery procedures and making sure they still work when you need them.
When Does Self-Hosting Make Sense?
Self-hosting can be a good fit when you need deep infrastructure control and have the people and processes to maintain it. It can also make sense when your organization already operates identity infrastructure and has established procedures for security, monitoring, and incident response.
But running Keycloak yourself doesn't automatically make your authentication more secure. The result depends on how well the service, database, network, and operational processes are configured and maintained.
What Changes With Managed Keycloak?
Managed Keycloak shifts much of the infrastructure work to a service provider. You still use Keycloak for identity management and authentication, but the provider operates the managed environment according to its service offering.
For a development team, that can mean less time spent maintaining servers, planning upgrades, monitoring infrastructure, and managing database operations. It can also make it easier to get an identity service running without first building an entire deployment and maintenance process.
What the Provider May Manage
The provider may manage:
- Infrastructure provisioning and maintenance.
- Database operations and backups.
- Keycloak updates and upgrades.
- Availability monitoring and infrastructure recovery.
What Still Belongs to Your Team?
However, managed Keycloak doesn't mean someone else automatically handles every aspect of authentication security.
Your team still needs to configure authentication flows, manage realm settings, assign appropriate roles, protect administrative access, and integrate the identity provider correctly with your application. You also need to decide how users are onboarded, how accounts are recovered, and what permissions they receive after signing in.
Data ownership and access deserve attention, too. Before choosing a provider, understand where your identity data is stored, who can access it, how backups are protected, and what happens when you decide to leave the service.
Managed Keycloak is useful when you want to use Keycloak's identity capabilities without taking on the full burden of operating the infrastructure.
Self-Hosted Keycloak vs Skycloak: A Practical Comparison
Both deployment models can use Keycloak's authentication features. The differences become clearer when you compare the responsibilities involved in running them.
| Area | Self-hosted Keycloak | Skycloak |
|---|---|---|
| Infrastructure | Your team provisions and operates it | Skycloak manages the underlying infrastructure |
| Database operations | Your team configures, secures, and maintains the database | Skycloak manages the underlying infrastructure |
| Security updates | Your team plans, tests, and applies updates | Automatic updates |
| Backups and recovery | Your team configures and tests backup and restore procedures | Skycloak manages infrastructure, updates, backups, and scaling |
| Availability | Your team designs and maintains availability | Uptime commitments vary by plan; Business includes a 99.9% SLA, and Enterprise offers up to 99.99% |
| Configuration control | Greater control over the deployment environment | Full Keycloak admin access; Skycloak manages the underlying infrastructure |
| Operational workload | Higher infrastructure responsibility | Reduced infrastructure maintenance for your team |
| Cost structure | Infrastructure, engineering time, maintenance, and operational overhead | Infrastructure-based pricing, unlimited users, and no fees tied to monthly active users |
Self-hosted Keycloak gives your team direct control over the infrastructure and responsibility for operating it. Skycloak manages the underlying infrastructure, while your team retains full Keycloak admin access and responsibility for securely integrating authentication into your application. All Skycloak plans support unlimited users, with pricing based on infrastructure rather than monthly active users.
Cost also deserves a realistic comparison. A self-hosted deployment might look cheaper when you compare only server expenses with a managed service's monthly fee. Once you include engineering time, monitoring, backups, upgrades, incident response, and availability requirements, the total cost can look different.
For a small team, reducing ongoing operational work may justify a managed service. For an organization with a mature platform engineering team and strict infrastructure requirements, self-hosting may be the better fit.
How Skycloak Makes Managed Keycloak Practical
Self-hosting Keycloak gives your team control, but that control comes with ongoing work: maintaining the deployment, applying updates, monitoring availability, and keeping the supporting infrastructure secure.
Skycloak provides managed hosting for upstream Keycloak. It manages the underlying infrastructure while giving your team full Keycloak admin access, so you can configure identity and authentication without operating the infrastructure yourself.
Keep Keycloak's Capabilities Without Running the Infrastructure
Skycloak runs upstream Keycloak and gives your team full Keycloak admin access. Its managed service includes the following benefits:
- Less infrastructure maintenance: Skycloak manages the underlying infrastructure, reducing the operational work your team handles.
- Keycloak authentication features: Configure SSO, MFA, SAML, and OpenID Connect (OIDC).
- Unlimited users: All plans support unlimited users, with no fees tied to monthly active users.
- Regional deployment options: Paid plans offer supported deployment regions in the US, EU, Canada, and Australia.
- Realm export: Export your realms to help plan a migration to a self-hosted Keycloak deployment.
- Free trial: Try Skycloak for 21 days without a credit card.
For current pricing and plan details, visit the Skycloak pricing page.
What Does This Mean for Your Team?
Consider a small SaaS team building its product. The developers need authentication, user management, and secure access to application resources, but they may not have a dedicated platform team to maintain an identity deployment.
With self-hosted Keycloak, the team plans and maintains infrastructure provisioning, updates, backups, monitoring, and recovery alongside product development. With Skycloak, the provider manages the underlying infrastructure, while the team focuses on integrating Keycloak, configuring authentication flows, managing access, and securing application sessions.
This doesn't remove the need for sound identity and application security. Your team still needs to configure roles and permissions, protect administrative access, validate redirect URIs, and make sure authenticated users can access only the resources they're authorized to use.
The benefit is a clearer division of responsibilities: Skycloak operates the managed infrastructure, while your team focuses on using Keycloak securely within the application.
Is Skycloak Worth Considering?
Skycloak is worth considering if you want Keycloak's flexibility without operating the underlying infrastructure. All plans support unlimited users, and infrastructure-based pricing means your bill isn't tied to monthly active users. You can choose from supported deployment regions in the US, EU, Canada, and Australia, export realms when planning a migration, and try the service free for 21 days without a credit card.
Compare the available features and prices on the Skycloak pricing page.
Which Keycloak Deployment Should You Choose?
There's no universal winner. The right choice depends on your team's capabilities and the requirements of your application.
Choose self-hosted Keycloak if:
- You need extensive control over the infrastructure, network, database, or deployment architecture.
- Your organization already has people responsible for operating production services.
- You have specific requirements that a managed provider cannot meet.
- You're prepared to maintain upgrades, backups, monitoring, incident response, and disaster recovery.
Choose managed Keycloak with Skycloak if:
- You want upstream Keycloak without operating the underlying identity infrastructure.
- You want full Keycloak admin access while reducing infrastructure maintenance.
- You need features such as SSO, MFA, OIDC, and SAML.
- You want unlimited users without fees tied to monthly active users.
- You need deployment options in the US, EU, Canada, or Australia.
- Realm export and a 21-day free trial without a credit card fit your evaluation and migration plans.
For an early-stage SaaS product, Skycloak can provide a way to use Keycloak without building and maintaining the supporting infrastructure from scratch. Teams with established platform engineering capabilities or requirements that call for direct infrastructure control may prefer self-hosting. Evaluate both options against your security needs, engineering capacity, expected costs, and long-term plans.
Before committing, ask a few concrete questions: Can you configure the authentication flows you need? Can you export or migrate your identity data? What backup and recovery guarantees exist? Who applies security updates, and how are changes communicated? What happens if the provider experiences an outage?
Those answers will tell you more than the label managed or self-hosted alone.
Frequently Asked Questions
Where does Keycloak store user passwords?
→ In a standard Keycloak deployment using its built-in user storage, password credentials are stored as password hashes in the configured database. Keycloak does not need to store the original passwords in readable plaintext. If the deployment uses an external user store, credential storage may be handled by that system.
What is Skycloak, and how does it differ from self-hosted Keycloak?
→ Skycloak is a managed Keycloak service that runs the upstream Keycloak platform and manages the underlying infrastructure. With self-hosted Keycloak, your team operates the deployment and supporting services. With Skycloak, infrastructure responsibilities covered by the service move to the provider, while your team continues to manage application integration and identity configuration.
Can I use passkeys with self-hosted and managed Keycloak?
→ Yes. Keycloak supports WebAuthn-based authentication, including passwordless passkey flows, when configured appropriately. The exact setup depends on your Keycloak version, authentication flow, and environment. With a managed service, confirm that the provider supports the configuration and administrative access your application needs.
Who manages security when using Skycloak?
→ Security responsibilities are shared. Skycloak manages the underlying infrastructure, while your team uses its full Keycloak admin access to configure authentication, protect administrative accounts, assign appropriate permissions, and integrate Keycloak securely into the application. Your team should still verify any specific uptime, backup, and recovery commitments it requires.
Is self-hosted Keycloak cheaper than managed Keycloak?
→ It can be, but server costs alone don't show the full picture. Self-hosting also requires engineering time for updates, monitoring, backups, troubleshooting, and incident response. Managed Keycloak introduces service fees but may reduce those operational costs. Compare the total cost of ownership for your expected workload and team capacity.
Final Thoughts
Self-hosting gives you direct responsibility for the deployment, database, updates, and availability. Skycloak lets you keep using upstream Keycloak with full Keycloak admin access while the provider manages the underlying infrastructure.
All plans support unlimited users, and the service offers deployment regions in the US, EU, Canada, and Australia. You can try Skycloak for free for 21 days without a credit card.
Choose the setup that protects your users' identities and gives your team a clear, sustainable way to manage authentication as your product grows.
| Thanks for reading! 🙏🏻 I hope you found this useful ✅ Please react and follow for more 😍 Made with 💙 by Hadil Ben Abdallah |
  
|
|---|
