PWM

PWM is a free, open-source web application for password self-service in LDAP environments. It suits organizations that need control over directory policies, recovery methods, and integrations without per-user licensing. The trade-off is a large administrative surface and community-based support rather than a packaged commercial service.

Overview

PWM gives users a web interface for changing passwords and recovering forgotten accounts against an LDAP directory. Administrators work in a browser-based manager with more than 500 settings and can import or export the complete configuration as a single file. That makes repeatable deployment and policy transfer practical, but the breadth favors teams with dedicated LDAP administrators rather than small groups seeking a minimal setup.

Directory support covers Generic LDAP, 389 Directory Server, NetIQ eDirectory, Microsoft Active Directory, and OpenLDAP. The product also includes password self-service, AD auditing, and reporting. The current release shown is v2.0.8, including a fix for reCAPTCHA-related form errors.

Key features

Password changes and policy enforcement

The password-change module evaluates rules as users type and shows strength feedback, so users receive guidance before submitting a new password. Policy controls include syntax and regular-expression rules, dictionary enforcement, remote REST checking, and shared password history. Organizations with centrally governed or unusually strict password standards get more control than a basic change form provides; administrators must, however, define and maintain those rules carefully.

Account recovery

Forgotten-password verification can use email or SMS tokens, TOTP, remote REST services, OAuth, or LDAP attribute values. This range supports different identity and communication policies, including deployments that already rely on an external verification service. The right method depends on the directory and authentication architecture, so implementation planning is important.

Authentication, APIs, and integration

PWM supports Basic Authentication, HTTP-header username injection, CAS, and OAuth client single sign-on. REST APIs cover password setting, forgotten-password workflows, password-policy reading and verification, and user-attribute updates. These interfaces make PWM suitable as a component in a wider identity portal or automated help-desk process, not only as a standalone web page.

Pricing

The PWM plan costs nothing and is open source. There is no paid tier, seat allowance, quota, or free-trial period attached to the plan. The economic advantage is clear for organizations able to run and maintain the software themselves; budget planning still needs to account for Java-based deployment and administration.

Platforms

PWM is delivered as a Java WAR, an executable Java JAR with embedded Tomcat, or a Docker image. It supports API use, Linux, self-hosting, and web access. The version table lists Java 17 for PWM 2.1 and Java 11–17 for PWM 2.0, while Tomcat is not an explicit requirement. Teams standardizing on containers or Java application servers have several deployment routes, but they should match the package to the supported Java version before rollout.

Who it's for

PWM is a strong choice for organizations running one of its supported LDAP directories and needing configurable password policy, recovery, and identity integrations without license fees. It is particularly appropriate where administrators can manage hundreds of settings and expose REST-based workflows. It is less suitable for buyers who want vendor-led support, a narrow configuration path, or a turnkey cloud service.

Pros and cons

Pros

• Open-source and free: the 0.00 USD plan removes per-user licensing for self-hosted deployments.
• Broad directory coverage: support spans Generic LDAP, 389 Directory Server, NetIQ eDirectory, Active Directory, and OpenLDAP.
• Flexible recovery: email, SMS, TOTP, REST, OAuth, and LDAP-attribute verification accommodate varied policies.
• Deep integration surface: SSO options and REST APIs support portal and automation scenarios.

Cons

• Configuration complexity: more than 500 settings can demand substantial design and ongoing administration.
• Java planning required: deployments must align with the Java versions associated with the PWM release.
• Community support route: assistance is directed to the PWM-General Google Group, and question-only GitHub issues are deleted.

Alternatives

ManageEngine ADSelfService Plus is the better fit when you want a freemium product with Android, iOS, Linux, macOS, web, and Windows coverage; its Free Edition costs 0.00 USD with no expiration for 50 users, unlimited domains, and 10 endpoint MFA users.

Softerra Adaxes suits teams seeking a paid Windows, macOS, web, or self-hosted platform with a 30-day fully functional evaluation and technical support.

Blazam is another free, open-source option for API, Linux, self-hosted, web, and Windows deployments.

LTB Self Service Password is a free GPL-3.0 self-hosted alternative that requires PHP and LDAP connectivity.

ManageEngine ADAudit Plus is aimed at web and Windows deployments, with a free edition capped at 25 workstations and a separate 30-day trial.

Specops uReset is a paid, volume-priced annual subscription with a free trial and broad client-platform support.

ManageEngine ADManager Plus is a freemium administration platform for web, Windows, iOS, Android, and on-premise use.

INGOS Active Directory Manager is a paid Windows product sold through quote-based pricing.

For a wider directory of tools, see Active Directory Management Software.

Verdict

Choose PWM when you need a no-license-cost LDAP password service with unusually broad policy, recovery, API, and integration controls. Look elsewhere if your priority is vendor-managed support or a simpler, commercially packaged deployment with less configuration to own.