What is the difference between Open WebUI and LibreChat?

Both are self-hosted chat interfaces for language models. Open WebUI is geared more toward local models, knowledge bases and broad administration and is licensed under the Open WebUI License with a branding clause. LibreChat is a multi-provider client with Agent Builder and MCP integration, is licensed under the MIT license and needs MongoDB as its database.

Is LibreChat better than Open WebUI?

Neither is better across the board. Open WebUI fits local models, knowledge bases with hybrid search, groups and SCIM. LibreChat fits free branding under MIT, native connection of Anthropic, Bedrock and Vertex AI, SAML and MCP agents. The decision table in the article assigns the use cases.

Are Open WebUI and LibreChat both MIT-licensed?

Only LibreChat. The LibreChat license file contains the standard MIT text without additional clauses. Open WebUI was under MIT up to version 0.5.4, under BSD-3-Clause up to 0.6.5, and has been under the Open WebUI License, which contains a branding clause, since 0.6.6. The claim that both are MIT-licensed is outdated.

Which platform supports SSO via SAML, OIDC, LDAP and SCIM?

Open WebUI supports OAuth and OIDC, LDAP and Active Directory, trusted header sign-in and SCIM 2.0; SAML is not natively documented and runs through an upstream proxy. LibreChat supports OAuth and OIDC, SAML and LDAP; SCIM and trusted header sign-in are not found in the documentation. In LibreChat, at most one of the methods SAML or OpenID is active at a time.

Which platform is better suited for local models such as Ollama?

Open WebUI connects Ollama, OpenAI-compatible servers such as vLLM or llama.cpp, and Open Responses directly; the image with bundled Ollama is officially available. LibreChat reaches local models through custom endpoints, with documentation for Ollama, vLLM and LiteLLM. Both run without a GPU. LibreChat does not run models; Open WebUI runs embedding, reranking and Whisper models locally, on the CPU by default and on the GPU with the `:cuda` image.

Which platform has the better knowledge base (RAG)?

Open WebUI ships with hybrid search using BM25, reranking, 13 supported vector databases and several extraction engines. LibreChat uses a separate RAG service with pgvector; hybrid search and reranking are not documented in the RAG service. In LibreChat, reranking exists only in web search.

Can I customize the branding?

With LibreChat yes; the MIT license contains no branding requirement. With Open WebUI only if at most 50 end users have access within 30 days, the rights holder agrees in writing, or an enterprise license is in place. Without one of these exceptions, name and logo must remain visible, including when operated by a service provider.

Which platform is easier to operate?

Open WebUI runs as a single container with SQLite and an embedded vector database, without further services. LibreChat by default needs MongoDB, Meilisearch and, for files, a RAG service with PostgreSQL. For multiple instances both need Redis and shared data storage; for Open WebUI the embedded ChromaDB is not suitable for this.

Do Open WebUI and LibreChat support MCP?

Yes, both as a client. Open WebUI connects MCP servers via Streamable HTTP, and only administrators may add them. LibreChat supports stdio, SSE and Streamable HTTP; servers can be added at runtime in the interface, stdio servers only in the configuration file. Open WebUI as an MCP server is not documented, and neither is LibreChat as an MCP server.

Who is behind the projects?

Open WebUI is developed by Open WebUI Inc. and offers enterprise licenses to registered organizations. LibreChat belongs to ClickHouse; the acquisition was announced on 4 November 2025, and continuation as an open-source project under MIT was promised. There is no public enterprise or support offering for LibreChat itself.

Does WZ-IT run Open WebUI and LibreChat?

Yes, both as a hosting and operations offering in Germany. At WZ-IT, Open WebUI runs with visible original branding and is not presented as WZ-IT's own product. For LibreChat, WZ-IT operates the application, databases, proxy, updates, monitoring and backup.

Open WebUI vs LibreChat: Comparison 2026

Timo Wevelsiep22.10.2026

#OpenWebUI
#LibreChat
#AI
#SelfHosting
#License
#SSO
#RAG
#MCP

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

Have Open WebUI or LibreChat operated in Germany? WZ-IT takes over hosting and operations for Open WebUI and LibreChat: updates, backups, monitoring and the connection to models. Teams bound by professional secrecy can also get Open WebUI as an AI platform. Book an initial consultation

Open WebUI and LibreChat are the two most widely used self-hosted chat interfaces for language models. They look similar but differ clearly in license, architecture, sign-in and knowledge base. This article compares both by the criteria that matter in operation. All figures come from the GitHub API, license files and vendor documentation as of 21 October 2026.

For comparison with a third platform, there is the article Open WebUI vs AnythingLLM and the overview Open-source AI chat platforms compared.

Short answer
Basic data at a glance
License and branding
Operation and architecture
Sign-in, SSO and provisioning
Permissions, groups and logs
Knowledge base and RAG
Models and providers
Agents, MCP and code
Telemetry and data flow
Security advisories of the last twelve months
Vendor, support and cost
Which platform for which use
Common misconceptions
Data and methodology
How WZ-IT works
Further guides
Sources

Short answer

	Open WebUI	LibreChat
License	Open WebUI License (BSD-3-Clause plus branding clause), not OSI-compliant	MIT, no additional clauses
Changing the branding	only with at most 50 end users, written permission or an enterprise license	free
Data storage	SQLite or PostgreSQL, vector database embedded or external	MongoDB (required), Meilisearch, RAG service with PostgreSQL and pgvector
Sign-in	OAuth/OIDC, LDAP, trusted header, SCIM; SAML via proxy	OAuth/OIDC, SAML, LDAP; SCIM not found in the docs
Knowledge base	hybrid search, reranking, 13 vector databases	RAG service with pgvector, without hybrid search and reranking
Providers	Ollama, OpenAI-compatible; Anthropic, Gemini and Bedrock via compatible interfaces	Anthropic, Bedrock, OpenAI, Azure, Google, Vertex AI natively; custom endpoints
Agents and MCP	tools, functions, MCP client (Streamable HTTP)	Agent Builder, Marketplace, MCP client (stdio, SSE, Streamable HTTP)
Vendor	Open WebUI Inc.	ClickHouse (acquisition announced 4 Nov 2025)

Rule of thumb: Open WebUI for local models, knowledge bases and broad user management with visible original branding. LibreChat for multi-provider operation, agents with MCP and free branding under MIT.

Basic data at a glance

	Open WebUI	LibreChat
Repository	open-webui/open-webui	LibreChat-AI/LibreChat
Latest version	0.12.3 (16 Oct 2026)	0.8.8 (1 Oct 2026)
GitHub stars	around 156,400	around 46,100
Forks	around 22,800	around 9,500
Archived	no	no
Release cadence	0.12.0 to 0.12.3 between 10 and 16 Oct 2026	0.8.6 (1 Jun), 0.8.7 (24 Jun), 0.8.8 (1 Oct 2026)
Desktop app	own repository, AGPL-3.0, early alpha	not available

GitHub marks all 98 LibreChat releases as pre-release; the latest non-RC tag, 0.8.8, is treated as the current version. The LibreChat repository has been under the LibreChat-AI organization since autumn 2026; the former address danny-avila/LibreChat redirects.

License and branding

LibreChat is licensed under the MIT license. The file contains only the standard text, with no branding requirement and no user limit, and has been unchanged since November 2023 except for the year. Two restrictions apply to companion components: the Admin Panel lives in a separate repository under AGPL-3.0 and is included in the official Compose files, and the code interpreter service is under Apache 2.0. The package.json files mostly state the license ISC (packages/data-schemas: MIT); the text of the LICENSE file is authoritative.

Open WebUI has been under the Open WebUI License since version 0.6.6: BSD-3-Clause plus clause 4. The clause prohibits changing, removing, obscuring or replacing the "Open WebUI" branding. Three cases are exempt:

Exception	Condition
Small deployment	at most 50 end users within any rolling 30-day period
Permission	prior written permission from the rights holder
Enterprise license	signed enterprise license with corresponding permission

With unchanged branding, use is also permitted commercially according to the license page, with no user cap for internal deployments. White-label, co-branding and a mere "Powered by Open WebUI" require an enterprise license. The Terminals service for Open Terminal lives in a separate repository under the Open WebUI Enterprise License and may be operated in production only with a license. GitHub lists the license as NOASSERTION ("Other"); Open WebUI itself states that it does not meet the OSI criteria.

The license history of Open WebUI: MIT up to version 0.5.4, BSD-3-Clause for 0.5.5 to 0.6.5, and the Open WebUI License from 0.6.6 (released on 5 May 2025); the code up to and including 0.6.5 remains under BSD-3-Clause. Details are in the article Open WebUI License and Branding.

Operation and architecture

	Open WebUI	LibreChat
Recommended way	Docker, one container	Docker Compose
Services by default	no further services: SQLite and embedded ChromaDB	api, MongoDB, Meilisearch, RAG service with PostgreSQL/pgvector, Admin Panel
Other ways	Compose, Podman, Docker Swarm, pip/uv, Helm chart	Helm chart (official), npm on own host
Minimum values per docs	not given as a minimum; the docs mention about 300 MiB RAM at idle (slim image, explicitly "not a minimum") and at least 4 GB for the frontend build	at least 1 GiB RAM, 1 vCPU (Docker, npm, server); with all Compose services at least 2 GB of memory for Docker
Multiple instances	PostgreSQL, external vector database, Redis, shared file storage	Redis mandatory behind the load balancer
GPU	optional (`:cuda` image) for the built-in embedding, reranking and Whisper models; otherwise only for local LLMs	not required, LibreChat does not run models

Open WebUI starts without external services; the bundled :ollama image additionally contains Ollama. According to the scaling documentation, the embedded ChromaDB, the default vector database, is not suitable for multiple workers or replicas; anyone scaling horizontally switches to PGVector, Milvus, Qdrant or ChromaDB in HTTP mode as a separate server.

LibreChat needs MongoDB for accounts and conversations. The bundled Compose files start MongoDB with --noauth; the database must be secured before production use. CREDS_KEY and CREDS_IV encrypt the credentials stored in the database; they are to be set to fixed values for production use and chosen identically across several replicas.

Method	Open WebUI	LibreChat
Email and password	yes, first account becomes administrator	yes, password reset, passkeys
Second factor	authenticator app (`ENABLE_MFA`, off by default)	authenticator app for local and LDAP accounts, can be enforced
OAuth/OIDC	Google, Microsoft, GitHub, generic OIDC	Google, GitHub, Discord etc., OpenID Connect (guides for Entra ID, Keycloak, Authentik, Auth0)
SAML	not native, via trusted header proxy	yes, without single logout
LDAP/Active Directory	yes	yes
Trusted header	yes (oauth2-proxy, Authentik, Authelia, Cloudflare Access)	not found in the docs
SCIM 2.0	yes, via environment variables	not found in the docs
Groups from the IdP	OAuth group mapping	groups can be synchronized from Entra ID

The Open WebUI documentation does not label any of the sign-in methods as an enterprise feature; the README lists LDAP, SSO and SCIM under the heading "Enterprise Authentication & Provisioning". In LibreChat, everything is part of the MIT core; SAML and OpenID are mutually exclusive, and at most one of the two methods is active at a time.

Permissions, groups and logs

	Open WebUI	LibreChat
System roles	admin, user, pending	USER and ADMIN, custom roles via the Admin Panel
Permission model	roles, permissions (feature switches), groups; additive, nested groups	feature permissions per role, resource ACLs, system grants
Access per model	ACLs for private models, sharing with groups and users	access per endpoint via group and role overrides, per agent via ACL; an access right per individual model is not documented
Access per knowledge base	ACLs for knowledge bases	via agents (ACL), standalone knowledge base not documented
Access per tool	permissions; MCP servers only by administrators, can then be limited via ACL	MCP servers, skills and agents can be shared via ACL
Audit log	`AUDIT_LOG_LEVEL` from NONE to REQUEST_RESPONSE, default NONE	admin audit log (permissions, roles, groups, shares, configuration) with hash chain and CSV export since 0.8.7, mentioned in the docs only in the changelog; token transactions and moderation log
Usage statistics	admin analytics (messages, tokens, activity)	Insights dashboard (opt-in), token quotas per user
Rate limiting	in the docs no message or token quota per user or model; rate limits only for token exchange and encrypted chats, otherwise via filter function	example values for messages per IP and user, ban system
Privacy switches	admin access to chats and export can be disabled, enforced temporary chats	temporary chats, retention period (default 30 days) for temporary or all chats, enforceable for all (`ephemeral`); conversations are stored in MongoDB

The LibreChat Admin Panel is still labeled "Preview" in the documentation, while the repository carries a release 1.0.0 dated 24 June 2026. If roles and groups are managed through the Admin Panel, its maturity should be checked before rollout.

Knowledge base and RAG

	Open WebUI	LibreChat
Architecture	in the core of the application	separate RAG service (FastAPI and LangChain)
Vector databases	13 according to the environment variable docs (README: 9): ChromaDB (default), PGVector, Milvus, Qdrant, Elasticsearch, OpenSearch, Weaviate etc.	pgvector (default), Atlas MongoDB Vector Search
Search	hybrid of BM25 and vector, reranking with CrossEncoder, full-text mode	vector search; full-text mode instead of the top hits; reranking only in web search
Extraction	Tika, Docling, Document Intelligence, Mistral OCR, PaddleOCR-vl, external loaders	Mistral OCR (external API), own OCR, local `document_parser` for PDF, DOCX, XLSX
Embeddings	configurable in the core	OpenAI (default), Azure, Hugging Face, Hugging Face TEI, Ollama, Bedrock, Google GenAI, Vertex AI
Connecting sources	Google Drive, OneDrive/SharePoint; with the separate project oikb 40+ sources	SharePoint Online and OneDrive for Business
Web search	dozens of providers (SearXNG, Brave, Tavily, Kagi etc.)	Serper, SearXNG, Tavily, Keenable

For a knowledge base with specialist documents, Open WebUI offers more adjustment options. In LibreChat, file search is tied to agents and the RAG service; a group-wide standalone knowledge base is not documented.

Models and providers

Provider	Open WebUI	LibreChat
Ollama, vLLM, llama.cpp, LM Studio	yes, directly or via OpenAI-compatible URL	via custom endpoints, docs for Ollama, vLLM, LiteLLM
OpenAI and Azure OpenAI	yes	yes, natively (including Responses API)
Anthropic	via OpenAI-compatible endpoint	natively
Google	via OpenAI-compatible endpoint, tool calling differs	natively, including Vertex AI
AWS Bedrock	via OpenAI-compatible interfaces: Bedrock Access Gateway, stdapi.ai, LiteLLM or AWS Bedrock Mantle (AWS's own endpoint, no installation of your own)	natively
Open Responses	yes	yes (Agents API)

LibreChat offers native clients for the major providers; Open WebUI relies on the OpenAI-compatible interface and Ollama. Models operated in Germany are connected in both via an OpenAI-compatible URL, for example via LLM hosting or LiteLLM.

Agents, MCP and code

	Open WebUI	LibreChat
Extensions	Filters, Actions, Pipes, Tools, Skills (Python on the server)	Agent Builder without code, Agent Marketplace, Skills, Subagents
MCP as client	since 0.6.31, Streamable HTTP, OAuth 2.1; can be added by administrators only	stdio, SSE, Streamable HTTP, OAuth-capable; can be added at runtime in the interface
MCP as server	not documented (MCPO bridge)	not documented
Code execution	Pyodide and Jupyter are considered legacy; Open Terminal (MIT); Terminals (enterprise)	own sandbox service (Apache 2.0) for Python, Node.js, Go, Java, Rust etc.
Artifacts	HTML, SVG, JavaScript, Mermaid	React, HTML, SVG, Markdown, Mermaid
API	OpenAI-compatible (`/api/chat/completions`), the docs call it "experimental"	Agents API (beta), `model` corresponds to an agent ID
Experimental	-	marked experimental or beta in 0.8.8: Code Workspaces, Scheduled Chats, Agent Plugins

LibreChat offers the broader agent integration with Marketplace and stdio MCP. Creating MCP servers through the interface is a security topic: three of the critical advisories of the last twelve months concerned MCP or SSRF (see below).

Telemetry and data flow

	Open WebUI	LibreChat
Vendor telemetry	The Docker image sets `SCARF_NO_ANALYTICS=true`, `DO_NOT_TRACK=true` and `ANONYMIZED_TELEMETRY=false`	Not provided for in the documentation, example configuration and Compose files; Meilisearch analytics is disabled
Update check	`ENABLE_VERSION_UPDATE_CHECK` on by default; `OFFLINE_MODE` disables the update check, model downloads and plugin installation	no update check documented
Observability	OpenTelemetry only with `ENABLE_OTEL`	OpenTelemetry and browser RUM off by default, Langfuse optional
Storage location	SQLite or PostgreSQL, files local or S3, GCS, Azure Blob	MongoDB, files local or S3, Azure Blob, Firebase

For air-gapped environments, OFFLINE_MODE in Open WebUI disables the update check, automatic model downloads and the installation of plugin packages. Connections to models, OAuth providers, web search and external RAG APIs remain in place and belong in the firewall rules. In LibreChat, artifacts load the Sandpack bundler from the public CodeSandbox CDN by default; according to the docs, this can also transmit telemetry. The bundler can be self-hosted.

Security advisories of the last twelve months

Published GitHub security advisories from 21 Oct 2025 to 21 Oct 2026:

	Open WebUI	LibreChat
Advisories in total	163	28
critical	1 (LDAP sign-in with empty password, CVE-2026-44551)	3 (SSRF CVE-2025-69222, MCP stdio command execution CVE-2026-22252, reading server secrets via MCP URL CVE-2026-32625)
high	70	9
medium and low	92	16
Distribution	62 between 4 and 11 May 2026, 28 in August, 26 in September	13 on 2 Jun 2026, none since
Focus areas (keyword count)	XSS/script approx. 21 to 26, sign-in/OAuth/LDAP approx. 14 to 15, SSRF 13, hangs/DoS approx. 17 to 19	MCP 6, SSRF 5, XSS 3, sign-in 3

The number says nothing about the quality of a project. It shows how much was reported and published, and depends on size, attack surface and reporting culture. Open WebUI additionally provides 26 classifications of third-party CVEs in its documentation, for example "Rejected, not a vulnerability". For both platforms: apply updates promptly, release MCP servers and external tools to administrators only, and do not expose the instance to the internet without sign-in.

Vendor, support and cost

	Open WebUI	LibreChat
Vendor	Open WebUI Inc.	ClickHouse, Inc. (acquisition announced 4 Nov 2025, continuation as open source promised)
Software	free with unchanged branding	free (MIT)
Commercial offering	enterprise license for white-label and Terminals, support with account manager; price not public	no public enterprise or support offering; ClickHouse lists LibreChat as the chat interface of the open-source "Agentic Data Stack"; a separate paid LibreChat product is not evidenced
Licensees	registered organizations only	-
Vendor support	consulting, no implementation services	community, contact by email
Partner program	form, generally companies older than five years	-

Neither program carries a license fee for self-installation. Operating costs arise from hosting, updates, backups, monitoring and the connection of the models.

Which platform for which use

Use	Best fit	To note
Local models (Ollama, vLLM) and knowledge bases with hybrid search	Open WebUI	Branding clause, multi-instance operation needs PostgreSQL, Redis and a vector database
Free branding or operation under your own brand without a vendor license	LibreChat	MIT; Admin Panel under AGPL-3.0
Many providers natively (Anthropic, Bedrock, Vertex AI)	LibreChat	Endpoint access per group via override, right per individual model not documented
SAML without an additional service	LibreChat	SAML and OpenID not at the same time
SCIM and trusted header sign-in	Open WebUI	SAML via proxy
Access per model and knowledge base by group	Open WebUI	Audit log off by default
Agents with stdio MCP and Marketplace	LibreChat	MCP security, beta features in 0.8.8
Smallest operating form without additional services	Open WebUI	the embedded ChromaDB not for multiple workers

Common misconceptions

"Both are MIT-licensed." No. Open WebUI has been under the Open WebUI License with a branding clause since version 0.6.6; only LibreChat is under MIT.
"LibreChat has no SAML." It does; SAML is documented, without single logout.
"Open WebUI has no LDAP or SCIM." Both exist. SAML does not run natively but through an upstream proxy.
"LibreChat can only do file attachments, no RAG." LibreChat has its own RAG service with pgvector. Hybrid search and reranking are not documented there.
"Open WebUI needs Ollama." No, Open WebUI also talks to OpenAI-compatible servers, and Ollama is optional.
"Open WebUI and LibreChat are competing products of the same vendor." No. Open WebUI is backed by Open WebUI Inc., and LibreChat by ClickHouse (acquisition announced in November 2025).

Data and methodology

As of: 21 October 2026. The data basis is the GitHub API (license, version, stars, published security advisories), the LICENSE files of the repositories, the documentation of Open WebUI and LibreChat, and the Compose and environment files. Stars are rounded and change daily. Statements marked "not found in the docs" mean that the documentation does not describe the feature; the function may exist in the code. The advisories cover the period from 21 October 2025 to 21 October 2026, and the focus areas are a keyword count of the titles. Where documentation and repository contradict each other (Open WebUI: number of vector databases; LibreChat: maturity of the Admin Panel), this is noted.

Tables and figures may be reused with attribution and a link to this article.

How WZ-IT works

WZ-IT runs Open WebUI and LibreChat as a hosting and operations offering in Germany. With Open WebUI, the original branding stays visible, and WZ-IT does not present Open WebUI as its own product; license questions on number of users and branding are clarified before rollout. As an AI platform, Open WebUI is available with models operated in Germany by German providers, SSO and a Section 203 supplementary agreement from EUR 149.90 net per month. For LibreChat, WZ-IT operates the application, databases, proxy, updates, monitoring and backup and technically secures credentials and model endpoints; which models, user groups and MCP tools are permitted is decided by the customer. For operation in your own network, the platform is available on the App Node and, with its own GPU, on the AI Cube.

Further guides

Open WebUI vs AnythingLLM, the comparison with the third widely used platform.
Open-source AI chat platforms compared, all platforms at a glance.
LibreChat vs AnythingLLM, the comparison without Open WebUI.
Open WebUI vs Onyx, chat interface versus enterprise search.
Open WebUI License and Branding, the clause in detail.
Synchronize an Open WebUI knowledge base automatically, connecting sources with oikb.
AI platforms for businesses compared, hosted offerings by GDPR and Section 203.

Choose Open WebUI or LibreChat, or have them operated? We assess number of users, sign-in, permissions and models, and run both platforms in Germany. Book an appointment