Every European authentication provider reviewed
Kiel, Germany
Founded 2020
Free tier / From €99/month
Demo on request
Best for: Developers who want passkey-first login with components they can embed
Hanko is a passkey-first authentication and user management platform from Kiel, Germany, founded in 2020. Its FIDO2 server is certified by the FIDO Alliance, of which the company is a member, and a login starts with a passkey before falling back to an email passcode, social login or SAML single sign-on. The front end comes as web components called Hanko Elements, and sessions are signed JWTs that any backend can verify.
The company publishes its core as open source under AGPL-3.0, so the same code runs on your own servers or in Hanko Cloud, which has a free tier and paid plans from €99 a month. A standalone Passkey API lets a team add passkeys to a login system it keeps. The Kiel entry is registered under HRB 19885 KI, and the product replaces Auth0, Clerk and Firebase Auth on its tool page.
What Hanko does well
- Passkey is the default method, with an email code as fallback
- Open-source core under AGPL-3.0 and a self-hosted option without user limits
- Free cloud tier, then plans from €99 a month
- Embeddable Hanko Elements and guides for Next.js, Nuxt and SvelteKit
- FIDO Alliance member with a certified FIDO2 server
Where Hanko falls short
- The AGPL licence needs a legal read before use inside closed products
- Official SDKs centre on JavaScript and TypeScript
- Narrower than a full workforce IAM with directory federation
- Enterprise terms and SLAs are a separate paid conversation
Standout feature. Hanko is the one provider here that pairs a certified passkey server with an open-source core and a free hosted tier.
Wimsheim, Germany
Customer IAM: Essentials €699/month (1,000 users) / Standard €1,399/month (5,000 users) / Pro €2,999/month / Enterprise on request; Workforce IAM €4.50 per user/month; 20% off yearly; VAT treatment not stated
Demo on request
Best for: Companies that want customer and employee identity from one German vendor with printed prices
cidaas is the product of Widas ID GmbH in Wimsheim, registered at the Amtsgericht Mannheim under HRB 731110 and described on its About page as a business unit of WidasConcepts GmbH. It covers customer identity and access management and workforce IAM, with ID validation as an option. The company holds ISO 27001, ISO 9001 and OpenID certification, and states that it develops and hosts in Germany.
The price list is public: Customer IAM Essentials at €699 a month for 1,000 users, Standard at €1,399 for 5,000, Pro at €2,999, and Workforce IAM at €4.50 per user per month, 20% cheaper when paid yearly. A 30-day trial covers up to 500 customer users. The pages do not say whether amounts include VAT, name only one hosting partner as an example, and show no public sub-processor list.
What cidaas does well
- German GmbH with a commercial register entry at Amtsgericht Mannheim
- Hosting in Germany stated, with Open Telekom Cloud as the named example
- ISO 27001, ISO 9001 and OpenID certification listed
- Customer IAM price of €699 a month for 1,000 users is public
- Workforce IAM at €4.50 per user per month, with a yearly discount of 20%
- 30-day trial that covers up to 500 customer users
Where cidaas falls short
- Only one hosting partner is named and no sub-processor list is public
- Closed source and no edition to host yourself
- VAT treatment of the listed prices is unstated
- Entry price of €699 a month is high for a small application
- The "since 1997" claim belongs to the Widas group, not the cidaas entity
Standout feature. cidaas states what a thousand customer identities cost in euros, which most providers in this category leave to a sales call.
Winterthur, Switzerland
See website (pricing page is rendered client-side)
Demo on request
Best for: Product teams that want login and per-resource permissions behind one API
Authress is a login and access control API from Rhosys AG in Winterthur, Switzerland. Its homepage separates identity, meaning who the user is, from access control, meaning what that user may do, and lets permissions attach to individual resources and nest. Login covers a hosted UI, social providers, passwordless and WebAuthn, with SAML, OAuth and OIDC single sign-on connections listed as unlimited.
Developer tooling includes a REST API, SDKs in several languages, customizable React components, a Terraform provider and an offline test instance for running tests without the hosted service. Rhosys states that processing follows the European GDPR and that storage can be limited to a region, though the regions are not listed. The pricing and legal pages render only in the browser, so no prices or terms were read.
What Authress does well
- Resource-level permissions that can be nested, beyond plain roles
- Unlimited SSO connections and machine tokens listed
- Terraform provider plus an offline test instance
- Swiss operator with an option to restrict the storage region
- Passwordless and WebAuthn sign-in listed
Where Authress falls short
- Pricing sits on a page that only renders in a browser, so it could not be read
- Managed service only, no self-hosted edition
- Storage regions are not enumerated
- Smaller company than the US platforms it is compared with
Standout feature. Authress treats access control as a separate, nestable permission layer, so changing the login method leaves the permission model untouched.
Stockholm, Sweden
Founded 2015
Community Edition free / Standard, Enterprise and Token Handler editions on a flat annual subscription, price on request
Demo on request
Best for: Engineering teams with API security requirements and staff to operate an identity server
Curity is an identity server from Curity AB, a Swedish company founded in Stockholm in 2015 under registration number 559017-0196. It is built around OAuth, OpenID Connect, FAPI, SAML and SCIM, and the OpenID Foundation certifies its conformance. There is no Curity-operated service: the deployment page describes on-premise, single-cloud, multi-cloud and hybrid installs and nothing else.
A free Community Edition is available, and the Standard, Enterprise and Token Handler editions are sold as a flat annual subscription with the price on request, plus a 14-day trial. The code is not open source. Its terms of use, updated on 30 March 2026, name Curity AB as the contracting party, and the Danish private equity fund GRO has held a stake since May 2023, size undisclosed.
What Curity does well
- Swedish AB in Stockholm with a registration number and a 2015 founding
- Deployment on-premise, in one cloud, across clouds or hybrid, as you decide
- OpenID Foundation certified OAuth, OpenID Connect, FAPI, SAML and SCIM
- Free Community Edition and a 14-day trial of the paid editions
- Flat annual subscription, not a per-user meter
Where Curity falls short
- Prices for the paid editions are on request only
- Free to use, but not published under an open licence
- No hosted option, so all operations fall to you
- No ISO 27001 or similar audit named on its own pages
- GRO holds a stake since 2023 whose size is not stated
Standout feature. Curity has no cloud of its own, so where the data lives is decided entirely by where you install the server.
London, United Kingdom
Founded 2014
Free (open source)
Demo on request
Best for: Organisations with platform engineers that need self-hosted SSO, federation and brokering
Keycloak is an open-source identity and access management server, first released by Red Hat in 2014 and now a Cloud Native Computing Foundation incubating project under the Apache License 2.0. It speaks OpenID Connect, OAuth 2.0 and SAML 2.0, brokers logins to external identity providers and federates with LDAP and Active Directory, so existing users do not have to be migrated.
There is no vendor to buy from and no licence fee, and this directory lists the project with a United Kingdom entry. The Quarkus-based distribution runs as a container or on a JVM, an official operator exists for Kubernetes, and a commercially supported Red Hat build is available. The cost is operational: your team runs, patches, backs up and scales it, and plans each major upgrade.
What Keycloak does well
- Apache 2.0 licence, so no fees at any user count
- OpenID Connect, OAuth 2.0 and SAML 2.0 with brokering to other providers
- LDAP and Active Directory federation without moving users
- Central authorisation services based on the UMA 2.0 specification
- Kubernetes operator and a Red Hat build with a support contract
Where Keycloak falls short
- You operate, patch, back up and scale it yourself
- Large configuration surface that takes real time to learn
- Major versions need upgrade planning
- No first-party hosted service
Standout feature. Keycloak brings brokering, directory federation and central authorisation under one licence that no vendor can reprice.
Zurich, Switzerland
Not published on the pages read
Demo on request
Best for: Banks, insurers, healthcare and iGaming operators with strict login requirements
Nevis Security AG, at Birmensdorferstrasse 94 in Zurich, sells two products: the Nevis ID platform for customer and partner identity management, which it calls a SaaS solution, and the Authentication Cloud for passwordless and multi-factor login. Further offices are listed in Germany, London and Budapest. The vendor says its technology secures over 80 per cent of online banking transactions in Switzerland, which is its own claim.
The identity side lists a user data model with matching authorisation, multi-tenant administration per user group, identity orchestration and fraud detection next to single sign-on. The Authentication Cloud adds usernameless login and transaction confirmation. No price, free tier, self-serve sign-up, data location or certification appeared on the pages read, so an evaluation means contacting sales.
What Nevis Security does well
- Swiss vendor with further offices in Germany, the UK and Hungary
- One data model for customers, partners and agencies
- Passwordless, usernameless and transaction-confirmation methods
- Separate administration for each user group in multi-tenant setups
- Fraud detection listed beside login and SSO
Where Nevis Security falls short
- Neither prices nor a free tier are published
- Evaluation runs through an enterprise sales process
- Where data is stored is not stated on the pages read
- More platform than a small application needs
Standout feature. Nevis Security models brokers, agencies and policyholders as one identity structure, which developer-first services leave to custom code.
Munich, Germany
Custom pricing, based on usage, deployment and support (pricing call)
Demo on request
Best for: Companies that keep their identity provider and want passkeys rolled out and measured
Corbado is a Munich company, Corbado GmbH, registered at the Munich District Court under HRB 273934 and a subsidiary of PB Holding GmbH. Its imprint states ISO 27001 and SOC 2 Type II certifications. The homepage says plainly that your identity provider stays: Corbado adds Connect, a managed passkey server with rollout controls and fallbacks, and Observe, a read-only layer that maps every login method into one process model.
Observe offers per-user debugging and telemetry described as zero-PII, and the vendor lists commercial and open-source providers it works with, including Ory, Nevis Security and Amazon Cognito. Pricing is by quote, driven by usage, deployment and support scope, with a shared cloud by default and dedicated instances and regions on request. Corbado's own claim of over 20 million passkey users is not repeated here.
What Corbado does well
- ISO 27001 and SOC 2 Type II stated in the German imprint
- Runs next to commercial and open-source identity providers
- Connect includes a FIDO certified passkey server
- Telemetry described as free of personal data
- A pilot is possible without touching the identity provider
Where Corbado falls short
- Does not hold users or sessions, so it cannot replace the provider
- Prices only by quote
- No self-hosted edition
- Focused on passkeys alone
Standout feature. Corbado shows why individual logins fail, because Observe reads login events from systems it does not replace.
Zurich, Switzerland
Integrated plan CHF 0.25 per monthly active user (1,000 to 10,000 MAU); custom plans above
Demo on request
Best for: Banks and fintechs that need strong customer authentication with fraud context
Futurae is a Zurich company, Futurae Technologies AG, that sells the factors after the password: one-touch push, QR code, app code (TOTP), SMS code and FIDO2, plus adaptive authentication, transaction confirmation and helpdesk authentication. Four APIs (Auth, Admin, Log and Trust Signals), IAM plugins, a mobile SDK and a white-label app are listed, with enterprise integration through ADFS and OpenID Connect.
The pricing page shows the Integrated plan at CHF 0.25 per monthly active user for 1,000 to 10,000 users, charged once per calendar month, with custom plans above. Trust Signals reads device, location, behaviour and session context, naming signals such as an active call, a remote access tool, geovelocity and a new browser. Qonto appears among its customer stories. No sign-up form or user directory is described.
What Futurae does well
- CHF 0.25 per monthly active user shown for the Integrated plan
- Push, QR, TOTP, SMS and FIDO2 authenticators
- Transaction confirmation aimed at payments
- Trust Signals can run without the authentication product
- Published Auth, Admin, Log and Trust Signals APIs
Where Futurae falls short
- No hosted sign-up form or user directory described
- Written for the financial sector
- Plans beyond 10,000 users are custom
- Storage location is not stated on the pages read
Standout feature. Futurae bills per monthly active user whatever the number of authentications, and it separates fraud signals from login itself.
Trondheim, Norway
Founded 2007
Custom pricing
Demo on request
Best for: Regulated enterprises that need national eIDs, identity verification and signing
Signicat is a Norwegian identity company headquartered in Trondheim and operating since 2007. Its platform connects to more than 30 electronic identity schemes, among them Norwegian and Swedish BankID, Danish MitID, the Finnish Trust Network, Dutch iDIN, Belgian itsme and German eID, and combines identity verification and KYC, authentication, electronic signing and orchestration. Its tool page also lists passkeys and PSD2 strong customer authentication.
The company is described as a qualified trust service provider for eIDAS signatures, took part in the NOBID eID pilot with the Norwegian government, and prepares for the EU Digital Identity Wallet. Pricing is custom, combining platform fees and per-transaction charges, delivered as a cloud service with data centres in Europe. Norway belongs to the EEA but not the EU, which can matter for procurement rules.
What Signicat does well
- Verification, KYC, authentication and signing in one platform
- Native Norwegian BankID support for authentication and signing
- EU Digital Identity Wallet readiness described
- eIDAS compliance with qualified signature support
- Norwegian company in the EEA, running since 2007
Where Signicat falls short
- Custom pricing reached through a sales consultation
- Built for regulated organisations, not small teams
- Too broad if only document signing is needed
- Norway is in the EEA but not in the EU
Standout feature. Signicat joins authentication to signing, so one verified national eID login can end in a qualified signature.
Copenhagen, Denmark
Pricing pages exist for Verify, Signatures and Age Verification; amounts not read. Free testing offered
Demo on request
Best for: Services that must accept national eIDs in the Nordics, the Netherlands or Germany
Idura is the new name of Criipto, a Danish eID broker at Gammel Kongevej 3E in Copenhagen, registered as Idura ApS under CVR 35142207. A banner on its site announces the rebrand. One integration, Idura Verify, reaches MitID and MitID Erhverv, Norwegian and Swedish BankID, the Finnish Trust Network, Freja eID, Vipps MobilePay, Dutch iDIN, the German Personalausweis, UK OneID and Samleikin from the Faroe Islands.
The same company offers eID signatures, caller authentication, address lookups and age verification, and marks an ID Wallet as beta. The site claims over 700 businesses across Europe, which is the vendor's figure. A free test account is offered and pricing pages exist for Verify, Signatures and Age Verification, but the amounts were not readable. Data location is not stated.
What Idura does well
- A single integration reaches many national eIDs
- Danish company whose site shows its CVR number
- Signing and age verification sit in the same product family
- Free test account to try the flow
- Rebrand from Criipto is announced openly
Where Idura falls short
- Works only for people who hold a supported eID
- No user directory or session service described
- Amounts on the pricing pages did not load readably
- Regional coverage rather than global
Standout feature. Idura turns each new national eID into a switch inside one integration, instead of a separate project per country.
