Open WebUI vs Onyx: Comparison 2026

Have Open WebUI or Onyx operated in Germany? WZ-IT takes over hosting and operations for Open WebUI and Onyx: updates, backups, monitoring and the connection to models. Teams under professional secrecy will also find Open WebUI as the AI platform. Book an initial consultation

Open WebUI and Onyx are often mentioned in the same breath but solve different tasks. Open WebUI is a self-hosted chat interface for language models with knowledge bases. Onyx, formerly Danswer, is a platform for enterprise search and RAG with connectors to business systems and, in the Enterprise Edition, reconciliation of document permissions. The central question is therefore: a chat platform with knowledge bases, or enterprise search across Confluence, SharePoint, Jira, Slack and further systems with document permissions?

This article compares both by the criteria that matter in operation. All figures come from the GitHub API, license files, source code and vendor documentation, as of 21 October 2026.

For the comparison against further platforms, see Open WebUI vs. LibreChat and Open WebUI vs. AnythingLLM, plus the overview Open-source AI chat platforms compared.

Table of contents

1. Short answer
2. Basic data
3. License and branding
4. Deployment and architecture
5. Sign-in, SSO and provisioning
6. Permissions, groups and document permissions
7. Connectors, index and knowledge base
8. Models and providers
9. Agents, MCP and code
10. Telemetry and data flow
11. Security advisories of the last twelve months
12. Vendor, support and costs
13. Which platform for which use case
14. Common misconceptions
15. Data and methodology
16. How WZ-IT works
17. Further guides
18. Sources

Short answer

Rule of thumb: Open WebUI when the chat with models is the focus and knowledge bases are built from files, drive selection or a sync tool such as oikb. Onyx when business systems such as Confluence, SharePoint, Jira or Slack are connected and search results should respect the access rights of the sources; this permission reconciliation belongs to the Enterprise Edition.

Basic data

Until the end of 2024, Onyx was called Danswer. The rename appears in the repository history as the commit "welcome to onyx" from 13 Dec 2024. The documentation already mentions "Onyx 5.0" (MCP under plugins), although on 21 October 2026 only the beta 5.0.0-beta.2 exists; the stable version is 4.9.2. The documentation runs ahead of the release.

License and branding

Onyx is mixed-licensed. According to the LICENSE, everything outside the ee directories is under "MIT Expat". The contents of the directories backend/ee, web/src/app/ee and web/src/ee are under the Onyx Enterprise License. It permits production use only with Onyx Subscription Terms or a valid enterprise license for the correct number of seats. Copying and modifying for development and testing is allowed without a subscription; redistribution is prohibited. GitHub shows the license as NOASSERTION, the README badge shows "MIT". Commercial use of the MIT part is free. User limits arise only through the seat count of the subscription, and white-labeling is a feature of the Enterprise Edition.

According to the Enterprise Edition documentation, the Enterprise Edition includes:

• OIDC and SAML (the plan assignment is contradictory, see section Sign-in)
• Permission-syncing connectors
• White-labeling
• User groups and RBAC as well as group-based permissions from v4.7 (custom groups and configurable group permissions)
• Usage analytics (plan assignment see section Permissions)
• Encrypted secrets, EE APIs and hook extensions

The EE features are license-bound. Which of them sit in the Business plan and which in the Enterprise plan is assigned partly differently by the billing page, the pricing page and the code. According to license_enforcement_config.py, query history, usage report, analytics, service account keys, groups/RBAC and gateway are on tier BUSINESS, while SCIM, hooks, log export and token rate limits are on ENTERPRISE. The billing page and the pricing page list "Inherit Document Permissions" and "Permission Inheritance" in the Business plan (USD 20); the billing docs name "Self-hosting (Optional)" under Business, while the pricing page lists "On-Premise Deployments" under Enterprise. In this article, "Enterprise Edition only" means a license-bound EE feature, not the Enterprise plan.

Onyx Cloud contains all Enterprise Edition features. At Onyx, the license boundary runs along individual features, not along the installation. The LICENSE was last revised on 14 Feb 2026 (commit note "No change, just touchup"); the repository history shows "Initial EE features" from 3 Oct 2023 and "Prepare EE to merge with MIT" from 15 Feb 2024.

Open WebUI has been under the Open WebUI License since version 0.6.6: BSD-3-Clause plus clause 4. The clause prohibits changing, removing, obscuring or replacing the "Open WebUI" branding. Three cases are exempt:

With unchanged branding, the license page states that use is also permitted commercially, with no user cap for internal deployments. White-label, co-branding and a mere "Powered by Open WebUI" require an enterprise license. The Terminals service for Open Terminal sits in its own repository under the Open WebUI Enterprise License and may be used in production only with a license. GitHub shows the license as NOASSERTION ("Other"). The companion projects oikb and Open Terminal are under MIT, the desktop app under AGPL-3.0. The license history: MIT up to version 0.5.4, BSD-3-Clause from 0.5.5 to 0.6.5, the Open WebUI License from 0.6.6; code up to and including 0.6.5 remains under BSD-3-Clause. Details are in the article Open WebUI license and branding.

The difference in essence: with Open WebUI the restriction applies to the branding, with Onyx to individual features.

Deployment and architecture

Open WebUI starts without external services; the bundled :ollama image additionally contains Ollama. According to the scaling documentation, the embedded ChromaDB (default) is not suitable for multiple workers or replicas; anyone scaling horizontally switches to PGVector, Milvus or Qdrant.

For multiple instances, Open WebUI needs PostgreSQL, an external vector database, Redis and shared file storage.

According to the resource documentation, Onyx has two modes: Lite uses under 1 GB of memory at baseline and starts five services, but does not index documents. Anyone who wants to index documents from connectors runs Standard mode with OpenSearch as the document index. Vespa was gradually replaced by OpenSearch from version 3; the README still mentions MinIO, while the Compose file uses SeaweedFS as object store.

Sign-in, SSO and provisioning

For Open WebUI, the documentation does not mark any of the sign-in methods as an enterprise feature, while the README lists LDAP, SSO and SCIM under the heading "Enterprise Authentication & Provisioning". According to the Open WebUI comparison page, a SAML connection runs through a trusted-header proxy that terminates SAML. The documentation on SCIM describes setup exclusively through environment variables.

In Onyx, SSO providers have been configurable only in the admin panel since v4.4.0; according to the docs, multiple providers at the same time are available from Business. The vendor's statements contradict each other here: the SSO page states "Configuring a single SSO provider is available on every plan". The Enterprise Edition page and the pricing page list OIDC and SAML SSO as an Enterprise feature. A third statement contradicts both: the security FAQ says "SAML and OIDC are supported as part of the Community and Enterprise Editions" and still lists SCIM as a roadmap item; it is therefore recognizably older. Which statement applies to a self-operated Community image is unresolved. According to the docs, SCIM is an Enterprise feature ("This feature requires an Enterprise plan").

Permissions, groups and document permissions

The question of who sees which documents in an answer is where the two platforms differ the most.

The 14 connectors with permission sync in Onyx: Confluence, Jira, Google Drive, Gmail, Slack, Salesforce, GitHub, Box, Canvas, SharePoint, Teams, Outlook, Zoom and YouTrack. The docs state: "Permission-syncing connectors are an Enterprise Edition feature." Without a vendor license, an Onyx deployment remains with the access types Private and Public per connector.

In Open WebUI, the application's permission model applies: a knowledge base receives access rights for groups and users (roles and permissions documentation); access applies to the knowledge base as a whole. The Open WebUI comparison page explicitly calls automatically mirrored permissions from Slack, Drive or Confluence "Not a current Open WebUI feature". For oikb as well, permission sync is not described in the README, docs/guide.md and source code; oikb works with the user's API key and does not bypass the knowledge base's access control. Anyone who mirrors documents from Confluence or SharePoint into an Open WebUI knowledge base sets up the access rights on the knowledge base. Further permission features of Open WebUI: only administrators create MCP servers, which can then be restricted by ACL; administrator access to chats and the export can be disabled, and temporary chats can be enforced.

For the audit log, the Onyx event stream is always on according to the audit page, while in Open WebUI AUDIT_LOG_LEVEL defaults to NONE. Whether the Onyx event stream is active in the Community Edition has not been checked.

For usage analytics and query history, the vendor's statements initially contradicted each other: the feature page marks them as Enterprise, while the billing page lists them under Business. The code (license_enforcement_config.py) assigns query history, usage report and analytics to tier BUSINESS.

Connectors, index and knowledge base

Connecting sources

The vendor's figures for the number of Onyx connectors differ: the pricing page says 40+, the README 50+, and the documentation overview shows 56 tiles. This article uses the countable figure, 56 tiles as of 21 Oct 2026. For Open WebUI, the README names "45+ sources" for oikb, the oikb README 47 supported sources and the Open WebUI docs 44 connectors.

Index and search

Open WebUI provides the settings for search and extraction in the application itself and leaves the choice of vector database open. Onyx uses a hybrid index on OpenSearch and ships the connectors to fill it. Anyone choosing a cloud embedding model checks the data flow to the respective provider.

Models and providers

According to the FAQ, Onyx can be fully air-gapped as long as a local model runs. In Open WebUI, OFFLINE_MODE disables the update check, automatic model downloads and plugin package installation; connections to models and external services remain. Models operated in Germany are connected to both via an OpenAI-compatible URL, for example through LLM hosting.

Agents, MCP and code

The API documentation describes a REST API with JSON and SemVer. The gateway page calls the LLM gateway an Enterprise offering; the billing page and the code (configs.py) assign it to the Business plan. Onyx additionally acts as an MCP server; for Open WebUI this role is not described in the docs.

Telemetry and data flow

Onyx 4.9.2 sends an anonymous usage payload (including customer_uuid, user_id, record, data) to telemetry.onyx.app; in the Enterprise Edition instance_domain is added, the email domain of the first user. The beta versions 5.0.0-beta.1 and 5.0.0-beta.2 additionally contain Fleet Telemetry, introduced with a commit from 9 Oct 2026, at an interval of 5 minutes and also disabled through DISABLE_TELEMETRY. According to fleet-telemetry.md in the repository, it covers resource, queue and heartbeat data, query events (channel, mode, outcome, timing, error category, tool usage, LLM cycles), indexing counters, connector settings, tenant_domain (domains of sign-up emails) and the presence of a license. According to the documentation, names, paths, URLs, email addresses, user IDs, document content, query text and error messages are never sent.

In Open WebUI, ENABLE_VERSION_UPDATE_CHECK is on by default; OFFLINE_MODE disables the update check, automatic model downloads and plugin package installation, and OpenTelemetry runs only with ENABLE_OTEL.

The Onyx 4.9.2 telemetry code is in telemetry.py, Fleet Telemetry in fleet_telemetry.py. There is no dedicated page on telemetry in the product docs. It is mentioned in the security pages (data processing, FAQ), in the changelog (v4.5.0: daily version heartbeat) and in the DISABLE_TELEMETRY entry of the configuration list; the 5.0 beta's Fleet Telemetry is described in deployment/fleet-telemetry.md in the repository. In isolated environments, DISABLE_TELEMETRY=true belongs in the base configuration of Onyx, in addition to firewall rules for outbound connections.

Security advisories of the last twelve months

Published GitHub security advisories from 21 Oct 2025 to 21 Oct 2026:

The number says nothing about the quality of a project. It shows how much was reported and published and depends on size, attack surface and reporting culture. Only published advisories are counted, not all fixed flaws, for example fixes without an advisory. Earlier, Onyx had one critical report on Slack bot tokens (CVE-2024-32881, 24 Apr 2024). In its documentation, Open WebUI additionally provides 26 assessments of third-party CVEs, for example "Rejected, not a vulnerability".

The critical report concerned the LDAP sign-in for Open WebUI and access between users via MCP servers for Onyx. Three of the four Onyx reports concern access between users (IDOR). The same applies to both platforms: apply updates promptly, release MCP servers and external tools only to administrators, and do not expose the instance to the internet without sign-in.

Vendor, support and costs

The Onyx pricing page lists for Business 40+ connectors, RBAC, permission inheritance, secret encryption, query history, basic auth and Google OAuth. Arithmetically, USD 20 per user and month for 100 users comes to USD 2,000 per month, or USD 24,000 per year with annual billing. The Open WebUI enterprise license has no public price; the enterprise page asks for a request with seat count and grants licenses only to registered organizations. Vendor support is consulting, not implementation work; the partner program is generally aimed at companies older than five years. Both programs carry no license fee for self-installation without enterprise features. Operating costs arise from hosting, updates, backups, monitoring and the connection to models; for Onyx in Standard mode, additionally from the resource demand of the index.

Which platform for which use case

Common misconceptions

• "Onyx is entirely MIT-licensed." No. The ee directories are under the Onyx Enterprise License, and GitHub shows NOASSERTION. The README badge shows only "MIT".
• "Onyx has permission sync in the free edition." No. The docs list permission-syncing connectors as an Enterprise Edition feature.
• "Open WebUI carries over document permissions from Confluence or SharePoint." Not part of Open WebUI according to its docs. Access is controlled by groups and ACLs on the knowledge base.
• "Open WebUI and Onyx are interchangeable." Both offer chat, agents and knowledge bases. Onyx brings connectors and a hybrid index on OpenSearch, Open WebUI a broad user administration and operation as a single container; the focus differs.
• "Onyx has 50+ connectors." The vendor's figures say 40+ (pricing page) and 50+ (README), and the documentation overview shows 56 tiles.
• "Onyx runs on Vespa." Vespa was replaced by OpenSearch from version 3.
• "Self-hosted means nothing goes to the vendor." Onyx sends anonymous telemetry by default, which can be disabled with DISABLE_TELEMETRY=true.
• "Danswer and Onyx are different projects." It is the same project; the rename appears in the repository history as a commit from 13 Dec 2024.

Data and methodology

As of: 21 October 2026. The data basis is the GitHub API (license, version, stars, published security advisories), the LICENSE files of the repositories including backend/ee/LICENSE, the Open WebUI and Onyx documentation, the source code of the Onyx telemetry modules and the Onyx pricing page. Stars are rounded and change daily. Statements such as "not found in the docs" or "not documented" mean that the documentation does not describe the feature; the function may exist in the code. The advisories cover the period from 21 October 2025 to 21 October 2026; the focus areas are a keyword count of the titles. The Onyx features were not tested in a test installation.

Contradictions in the vendors' statements that this article does not resolve:

• Onyx, SSO plan: The SSO page names one SSO provider on every plan; the Enterprise Edition page and the pricing page list OIDC/SAML as an Enterprise feature; the older security FAQ lists SAML and OIDC in the Community Edition.
• Onyx, number of connectors: 40+ (pricing page), 50+ (README), 56 tiles and 70 individual pages in the documentation overview.
• Onyx, plan assignment: Usage analytics and query history are Enterprise on the feature pages and Business on the billing page and in the code (license_enforcement_config.py); the code thereby resolves the contradiction. The gateway page calls the LLM gateway Enterprise, the billing page and the code Business. The audit page names no plan. "Self-hosting" appears under Business in the billing docs, "On-Premise Deployments" under Enterprise on the pricing page.
• Onyx, version: The docs describe Onyx 5.0, while 4.9.2 is stable. Fleet Telemetry exists only in the 5.0 beta versions.
• Open WebUI, vector databases: 13 per the environment variable docs, 9 per the README.

For Open WebUI, the telemetry defaults are documented only for the Docker image. The statement that Open WebUI has no reconciliation of document permissions rests on the Open WebUI comparison page on Onyx and on the README, docs/guide.md and source code of oikb; it is a finding from documentation and source code, not a test.

Tables and figures may be reused with attribution and a link to this article.

How WZ-IT works

WZ-IT operates Open WebUI and Onyx as a hosting and operations offering in Germany: updates, backups, monitoring and the connection to models. For Open WebUI, the original branding remains visible, and WZ-IT does not present Open WebUI as its own product; we clarify the license questions on user numbers and branding before rollout. As the AI platform, Open WebUI is available with models operated in Germany by German providers, SSO and a Section 203 supplementary agreement.

For Onyx, WZ-IT operates the freely licensed edition (MIT outside the ee directories). Features under the ee directories, for example permission sync, SCIM, custom groups and white-labeling, are not part of the offering. WZ-IT supports the procurement of a vendor license on request. Whether reconciliation of document permissions is required decides between the two platforms and whether a vendor license is needed for Onyx. Models operated in Germany can be connected through LLM hosting.

Further guides

• Open WebUI vs. LibreChat, the comparison of two chat interfaces.
• Open WebUI vs. AnythingLLM, the comparison with the third widespread platform.
• Open-source AI chat platforms compared, all platforms at a glance.
• Onyx self-hosted: installation, licensing and comparison with Open WebUI, setup and editions.
• Synchronize the Open WebUI knowledge base automatically, connecting sources with oikb.
• Open WebUI license and branding, the clause in detail.
• AI platforms for businesses compared, hosted offerings by GDPR and Section 203.

Choose or have Open WebUI or Onyx operated? We classify sources, document permissions, sign-in and models and operate both platforms in Germany. Book an appointment

Sources

• Open WebUI, repository
• Open WebUI, LICENSE
• Open WebUI Terminals, LICENSE
• Open WebUI oikb, repository
• Open WebUI oikb, LICENSE
• Open WebUI Docs, Knowledge base sync (oikb)
• Open WebUI Docs, Docker (source)
• Open WebUI Docs, Development
• Open WebUI Docs, Vendor dispositions for third-party CVEs
• Open WebUI Docs, License
• Open WebUI Docs, Enterprise
• Open WebUI Docs, Comparison with Onyx
• Open WebUI Docs, Single Sign-On
• Open WebUI Docs, LDAP
• Open WebUI Docs, SCIM
• Open WebUI Docs, Roles and permissions
• Open WebUI Docs, Scaling
• Open WebUI Docs, Environment variables
• Open WebUI Docs, RAG
• Open WebUI Docs, MCP
• Open WebUI Docs, API endpoints
• Open WebUI Docs, Admin analytics
• Open WebUI, Security advisories
• Onyx, repository
• Onyx, LICENSE
• Onyx, ee LICENSE (Onyx Enterprise License)
• Onyx, docker-compose.yml
• Onyx, telemetry.py (v4.9.2)
• Onyx, fleet_telemetry.py
• Onyx Docs, Enterprise Edition
• Onyx Docs, Billing
• Onyx Docs, Subscribing
• Onyx Docs, Resourcing
• Onyx Docs, Docker
• Onyx Docs, Kubernetes
• Onyx Docs, SSO providers
• Onyx Docs, SCIM
• Onyx Docs, JWT
• Onyx Docs, Understanding permissions
• Onyx Docs, Connectors
• Onyx Docs, File connector
• Onyx Docs, Audit logs
• Onyx Docs, Query history
• Onyx Docs, Search configuration
• Onyx Docs, AI models
• Onyx Docs, FAQ
• Onyx Docs, Agents
• Onyx Docs, MCP plugins
• Onyx Docs, Code interpreter
• Onyx Docs, Image generation
• Onyx Docs, Web search
• Onyx Docs, Developer API
• Onyx Docs, LLM gateway
• Onyx Docs, Configuration
• Onyx, Pricing
• Onyx, license_enforcement_config.py
• Onyx, gateway configs.py
• Onyx, fleet-telemetry.md (v5.0.0-beta.2)
• Onyx Docs, Data processing (self-hosted)
• Onyx Docs, Security FAQ
• Onyx Docs, Security hardening
• Onyx Docs, Changelog
• Onyx, Security advisories