# privacyidea/privacyidea

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP, FIDO Server)

Repository: https://github.com/privacyidea/privacyidea
Canonical: https://ross.abutalabs.com/products/privacyidea
Homepage: http://www.privacyidea.org
Language: Python
License: AGPL-3.0
License Family: copyleft
Topics: python, two-factor, authentication, identityserver, idm, 2fa, mfa, otp, certificates, ca, otp-server, two-factor-authentication, opensource, fido, fido2, passkey, passkeys, push, security-key, webauthn
Last push: 2026-08-26T15:21:56+00:00

## Health v2 (maintenance only)
Score: 93/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 80, longevity 100
- inputs: {"age_days": 4474, "days_push": 7, "days_rel": 57, "gap_med": 39, "n_releases_24m": 14}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1759, forks 358 (observed 2026-08-28T04:05:32.481860+00:00)

## What it is
privacyIDEA is an open-source, self-hosted multi-factor authentication (MFA) server that centrally manages authentication tokens—OTP (HOTP/TOTP), FIDO2/WebAuthn passkeys, push, SMS, email, U2F, YubiKey, and certificates—and adds second factors to services like VPNs, SSH, and web portals. Written in Python, it provides a WebUI, a JWT-secured REST API, policy-based configuration, an audit trail, and connects to existing user stores such as AD, LDAP, SQL, and EntraID.

## Use cases
- add two-factor authentication to vpn and ssh logins
- self-hosted 2fa server for an entire company
- centrally manage otp tokens for many servers
- fido2 webauthn passkey authentication server
- add mfa to existing ldap or active directory users
- push-based login approval for web portals
- secure wordpress or otrs login with a second factor

## When to choose
- You need one central MFA server to add a second factor to many heterogeneous services (VPN, SSH, web apps, RADIUS-based logins)
- You must keep user data and authentication on-premise under your own control instead of a cloud identity provider
- You need broad token support (FIDO2/WebAuthn, push, HOTP/TOTP, SMS, email, smartcards) while reusing existing user stores like AD, LDAP, or SQL
- You want policy-driven, multi-tenant token management with a REST API and detailed audit trail

## When to avoid
- You only need a small TOTP/HOTP library embedded in a single application rather than a full authentication server
- You want a fully managed, cloud-hosted MFA/SaaS product with zero infrastructure to operate
- You need a complete SSO identity provider with SAML/OIDC as its core role—pair privacyIDEA with an IdP like Keycloak instead of using it alone
- You require a solution running natively on Windows/macOS desktops; privacyIDEA is designed to run on Linux servers

## Facets
- artifact type: service
- maturity: stable
- function: auth, authorization, security, logging
- domain: security, self-hosted, backend
- platform: python, self-hosted
- tags: 2fa, mfa, otp, fido2, webauthn, passkeys, push-authentication, hotp, totp, yubikey, u2f, radius, token-management, rest-api, ldap, audit-trail, identity-and-access-management, linux, web-server

## Member repositories
- privacyidea/privacyidea (main) score 93

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:32.481860+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:27:32.353672+00:00, confidence not recorded.
  - readme: https://github.com/privacyidea/privacyidea (fetched 2026-08-28T04:05:32.481860+00:00, sha 49a9101b272f)
  - homepage: http://www.privacyidea.org (fetched 2026-08-29T11:05:51.831200+00:00, sha 63f88e864f25)
  - site_page: https://www.privacyidea.org/about/about-the-name-privacyidea (fetched 2026-08-29T11:05:51.840256+00:00, sha 70d6ed96a0fb)
  - site_page: https://www.privacyidea.org/about/features (fetched 2026-08-29T11:05:51.841989+00:00, sha 6d02ffb49f38)
  - site_page: https://www.privacyidea.org/documentation (fetched 2026-08-29T11:05:51.843924+00:00, sha 3c13d5d4c886)
  - site_page: https://www.privacyidea.org/documentation/api (fetched 2026-08-29T11:05:51.845633+00:00, sha 0252bfbe1bad)
  - site_page: https://www.privacyidea.org/documentation/howtos (fetched 2026-08-29T11:05:51.847281+00:00, sha 0d202545daf4)
  - site_page: https://www.privacyidea.org/documentation/howtos/howto-run-privacyidea-with-apache2-and-mysql (fetched 2026-08-29T11:05:51.849086+00:00, sha 2054661e532a)
  - site_page: https://www.privacyidea.org/documentation/howtos/howto-add-two-factor-authentication-to-otrs-with-privacyidea (fetched 2026-08-29T11:05:51.850831+00:00, sha 095589d3ee0f)
  - site_page: https://www.privacyidea.org/documentation/howtos/manage-two-factor-authentication-in-your-serverfarm-easily (fetched 2026-08-29T11:05:51.852417+00:00, sha 878a2e568f30)
- Data as of 2026-08-30T08:39:29.467469+00:00.