PWM
What it is
PWM is an open source password self-service application for LDAP directories. Users can change passwords and recover accounts, while administrators configure its behavior in a web-based manager with over 500 settings. Configuration can be imported or exported as a single file. During a password change, the module applies password rules as users type and displays strength feedback. Forgotten-password verification can use email or SMS tokens, TOTP, remote REST, OAuth or LDAP attribute values. The project lists support for Generic LDAP, 389 Directory Server, NetIQ eDirectory, Microsoft Active Directory and OpenLDAP. Sign-in options include Basic Authentication, HTTP-header username injection, CAS and OAuth client single sign-on. REST APIs cover password setting, recovery flows, policy reading and verification, and user-attribute updates. PWM can be deployed as a Java WAR, an executable Java JAR with embedded Tomcat, or a Docker image. Its configurable controls include syntax and regex rules, dictionary enforcement, remote REST checks and shared password history. The listed PWM plan costs nothing.
For and against
For
- Web manager provides over 500 configurable settings.
- Recovery checks support email, SMS, TOTP and other methods.
- Supports several LDAP directory types.
- Available as WAR, JAR or Docker image.
Against
- PWM 2.1 lists Java 17 as its runtime requirement.
- PWM 2.0 lists Java 11–17 as its runtime range.
- Project support requests go through the PWM-General Google Group.
The verdict
PWM provides configurable password self-service for a range of LDAP directories, with several recovery methods and deployment formats. Check the listed Java requirements for the version you plan to use.
Who it suits
PWM suits organizations using LDAP directories that want a self-service option for password changes and account recovery. It is also relevant to administrators who need configurable password policies and REST APIs.
Plans and prices
PWM
Open source password self-service application for LDAP directories
Read 7 Oct 2026 · github.com
On the record
- Account recovery
- Forgotten-password verification can use email or SMS tokens, TOTP, remote REST, OAuth, or LDAP attribute values.github.com · read 7 Oct 2026
- Configuration
- Its web-based configuration manager has over 500 configurable settings, and configuration can be imported and exported in a single file.github.com · read 7 Oct 2026
- Current release shown
- The GitHub releases page marks v2.0.8 as the latest release and lists a fix for reCAPTCHA-related form errors.github.com · read 7 Oct 2026
- Deployment
- PWM is distributed as a Java WAR, an executable Java JAR with embedded Tomcat, or a Docker image.github.com · read 7 Oct 2026
- Directory support
- The README lists Generic LDAP, 389 Directory Server, NetIQ eDirectory, Microsoft Active Directory, and OpenLDAP support.github.com · read 7 Oct 2026
- Integrations
- PWM supports Basic Authentication, HTTP-header username injection, CAS, and OAuth client single sign-on options.github.com · read 7 Oct 2026
- Password management
- The password-change module enforces password rules as users type and displays password-strength feedback.github.com · read 7 Oct 2026
- Purpose
- PWM is an open source password self-service application for LDAP directories.github.com · read 7 Oct 2026
- REST APIs
- REST APIs are available for password setting, forgotten-password flows, password-policy reading and verification, and user-attribute updates.github.com · read 7 Oct 2026
- Runtime requirements
- The README's version table lists Java 17 for PWM 2.1 and Java 11–17 for PWM 2.0; it says Tomcat is not an explicit requirement.github.com · read 7 Oct 2026
- Security controls
- Configurable password policies include syntax and regex rules, dictionary enforcement, remote REST checking, and shared password history.github.com · read 7 Oct 2026
- Support
- The project asks users to seek assistance through the PWM-General Google Group and says question-only GitHub issues will be deleted.github.com · read 7 Oct 2026
