Skip to content
SPECIFICTION
Get listed

PWM

github.com

Free plan WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.3 #11 of 23 in Self-Service Password Reset Software

What it is

PWM is a free, open-source password self-service application for LDAP directories. Its web configuration manager exposes more than 500 settings and lets administrators import or export configuration as one file. During password changes, rules are enforced while users type and password-strength feedback is shown. Forgotten-password verification can use email or SMS tokens, TOTP, remote REST, OAuth, or LDAP attributes. Listed directory support includes Generic LDAP, 389 Directory Server, NetIQ eDirectory, Microsoft Active Directory, and OpenLDAP. Authentication options include Basic Authentication, HTTP-header username injection, CAS, and OAuth client single sign-on. REST APIs cover password setting, recovery, policy reading and verification, and user-attribute updates. PWM is distributed as a Java WAR, an executable Java JAR with embedded Tomcat, or a Docker image. The version table lists Java 17 for PWM 2.1 and Java 11–17 for PWM 2.0. Configurable policies include syntax and regex rules, dictionary enforcement, remote REST checks, and shared password history. The listed plan is free.

Spec sheet

Purpose
PWM is an open source password self-service application for LDAP directories.Read 7 Oct 2026 · github.com
Deployment
PWM is distributed as a Java WAR, an executable Java JAR with embedded Tomcat, or a Docker image.Read 7 Oct 2026 · github.com
Integrations
PWM supports Basic Authentication, HTTP-header username injection, CAS, and OAuth client single sign-on options.Read 7 Oct 2026 · github.com
Support
The project asks users to seek assistance through the PWM-General Google Group and says question-only GitHub issues will be deleted.Read 7 Oct 2026 · github.com
Account recovery
Forgotten-password verification can use email or SMS tokens, TOTP, remote REST, OAuth, or LDAP attribute values.Read 7 Oct 2026 · github.com
Configuration
Its web-based configuration manager has over 500 configurable settings, and configuration can be imported and exported in a single file.Read 7 Oct 2026 · github.com
Current release shown
The GitHub releases page marks v2.0.8 as the latest release and lists a fix for reCAPTCHA-related form errors.Read 7 Oct 2026 · github.com
Directory support
The README lists Generic LDAP, 389 Directory Server, NetIQ eDirectory, Microsoft Active Directory, and OpenLDAP support.Read 7 Oct 2026 · github.com
Password management
The password-change module enforces password rules as users type and displays password-strength feedback.Read 7 Oct 2026 · github.com
REST APIs
REST APIs are available for password setting, forgotten-password flows, password-policy reading and verification, and user-attribute updates.Read 7 Oct 2026 · github.com
Runtime requirements
The README's version table lists Java 17 for PWM 2.1 and Java 11–17 for PWM 2.0; it says Tomcat is not an explicit requirement.Read 7 Oct 2026 · github.com
Security controls
Configurable password policies include syntax and regex rules, dictionary enforcement, remote REST checking, and shared password history.Read 7 Oct 2026 · github.com

Plans and prices

PWM Free Open source password self-service application for LDAP directories Read 7 Oct 2026 · github.com

Every PWM plan and price →

Strong points and limits

Strong points

  • More than 500 configurable settings
  • Multiple recovery verification methods
  • Support for major LDAP directory products
  • REST APIs for password and policy workflows
  • WAR, JAR, and Docker deployment options

Limits

  • Java runtime versions vary by PWM release
  • Support is directed to a Google Group
  • Question-only GitHub issues are deleted
  • Tomcat is not an explicit requirement

Who it suits

PWM suits organizations using LDAP directories that need password changes, recovery, policy enforcement, and administrative configuration. It is relevant to teams deploying Java or Docker-based self-service infrastructure.

Verdict

PWM provides broad LDAP self-service and recovery controls with extensive configuration and API coverage. Its open-source distribution supports several deployment formats and directory systems without a listed charge.

Where Specifiction places it

Alternatives to PWMAll alternatives →