Keycloak Performance Benchmarks: A Deep Dive into Scaling and Sizing (26.4) #43133

ahus1 · 2025-10-01T15:50:08Z

ahus1
Oct 1, 2025
Collaborator

Please share your feedback with us about recent blog post: https://keycloak.org/2025/10/keycloak-benchmark

gilvansfilho · 2025-10-02T21:59:05Z

gilvansfilho
Oct 2, 2025

First of all, great blog post.
Results are amazing 🚀

Now, could I ask which was the password hashing algorithm used? I am asking because I see a lot of cpu but "minimal" memory per pod.

1 reply

pruivo Oct 3, 2025
Collaborator

We didn't configure any parameters for password hashing. We use the default settings, Argon2.

csfreitas · 2025-10-03T14:17:33Z

csfreitas
Oct 3, 2025

The article is very good. I have a question regarding the results table and the test scenario. Did the CPU Limit value consider headroom or just what was needed for constant load? The test results were run for both scenarios (logins and refresh per second) or separately?

1 reply

pruivo Oct 3, 2025
Collaborator

No headroom given as we state in the blog: Because our test used a constant load, we did not allocate as much CPU as we typically recommend. We strongly recommend leaving 150% extra headroom for CPU usage to handle spikes in load, as mentioned in our documentation.
Both logins and refreshes happen concurrently.

wfouche · 2025-10-03T17:38:33Z

wfouche
Oct 3, 2025

How long can performance be sustained at the high throughput rates that are mentioned in the benchmark report? The worst response observed should ideally also be reported; just mentioning percentiles is not enough. Lastly the cost of running and hosting a software solution in the cloud is important to know and would interesting to read about. What is the $ cost per unit of throughout?

2 replies

pruivo Oct 6, 2025
Collaborator

Hi @wfouche, thank you for your comment. See answers below.

How long can performance be sustained at the high throughput rates that are mentioned in the benchmark report?

I'm unsure how to answer or measure this. Have you observed some problems in your deployment?

The worst response observed should ideally also be reported; just mentioning percentiles is not enough.

Most SLOs are defined in percentiles (at least, the ones that cross my hands). Here is the KC 26.4 report:

What is the $ cost per unit of throughout?

We did some cost analysis last year, and you can see it here: keycloak/keycloak-benchmark#1022 (comment)
For AWS, the Graviton processor is the most cost-effective. For other cloud providers, I'm afraid I can't get that information.

wfouche Oct 9, 2025

@pruivo , thank you for your response. I have a general interest in benchmarking and how benchmark results are reported. Always learning.

gilvansfilho · 2026-03-05T18:02:23Z

gilvansfilho
Mar 5, 2026

Hey team,
I have a bunch of questions:

About keycloak benchmark: how to run that in parallel? I mean, the blog post says "The benchmark ran on 20 to 50". How to achieve that? Would be great to have more information about how tests are prepared and executed.
Do we have any guidance about the base number of threads (http-pool-max-threads) based on avaiable cpu and memory?
About Openshift Routers. Would be great to have more information. How many routers were put in place? Any other thing other than scaling number of replicas was done?

Thanks in advance.

2 replies

pruivo Mar 5, 2026
Collaborator

Hey there!

All scripts are available in Keycloak Benchmark project. For your specific question, n independent Gatling runners are started, and the results are combined at the end. It is done by this ansible script.
The default worked fine most of the time, except for the last test, where 10% more threads were added. By default, the http-pool-max-threads is set to 4 times the number of CPU cores.
We scaled it up to have 1 router per OpenShift worker node. We didn't touch anything else because we were unsure about potential side effects, and we didn't have the expertise to tune it further.

Thank you for your questions.

gilvansfilho Mar 6, 2026

Thanks a lot. Very helpful

wfouche · 2026-03-06T19:58:12Z

wfouche
Mar 6, 2026

File https://github.com/keycloak/keycloak-benchmark/blob/main/pom.xml allows Java versions up to 25 to be used for benchmarking.

Did you benchmark Keycloak using Java 25 and have you tried using ZGC instead of the default G1GC? (ZGC is proven to reduce percentile response time tail latencies).
For best latency results both Gatling and Keycloak should use Java 25 and ZGC.

4 replies

pruivo Mar 8, 2026
Collaborator

Hey there!

I did not; Java 25 is not supported, and I didn't add any GC testing to avoid another test dimension. Java 25 support is planned for 26.6 (#43265).
Also, Gatling is compiled for Java 17 https://github.com/keycloak/keycloak-benchmark/blob/main/pom.xml#L22

VinodAnandan Mar 8, 2026

@pruivo Do we have any challenges or restrictions regarding upgrading the Gatling version or the target version? As I understand it, Gatling versions 3.14 / 3.15 and above support JDK 25 ?
gatling/gatling@e5ed518

pruivo Mar 9, 2026
Collaborator

@VinodAnandan Let me know if #34661 answers your question.

VinodAnandan Mar 9, 2026

@pruivo thanks for the context !

Keycloak Performance Benchmarks: A Deep Dive into Scaling and Sizing (26.4) #43133

Uh oh!

Uh oh!

ahus1 Oct 1, 2025 Collaborator

Replies: 5 comments · 10 replies

Uh oh!

Uh oh!

pruivo Oct 3, 2025 Collaborator

Uh oh!

Uh oh!

pruivo Oct 3, 2025 Collaborator

Uh oh!

Uh oh!

pruivo Oct 6, 2025 Collaborator

Uh oh!

Uh oh!

Uh oh!

pruivo Mar 5, 2026 Collaborator

Uh oh!

Uh oh!

Uh oh!

pruivo Mar 8, 2026 Collaborator

Uh oh!

Uh oh!

pruivo Mar 9, 2026 Collaborator

Uh oh!

ahus1
Oct 1, 2025
Collaborator

Replies: 5 comments 10 replies

pruivo Oct 3, 2025
Collaborator

pruivo Oct 3, 2025
Collaborator

pruivo Oct 6, 2025
Collaborator

pruivo Mar 5, 2026
Collaborator

pruivo Mar 8, 2026
Collaborator

pruivo Mar 9, 2026
Collaborator