Open WebUI Review 2026: 147,000 Stars and One Awkward Licence

Open WebUI is a self-hosted web interface for large language models. You point it at OpenAI, Anthropic, or a fully local model through Ollama, and your team gets a ChatGPT-style interface running entirely on your own infrastructure. With 147,882 GitHub stars it is by a wide margin the most popular tool of its kind.

Two things about it surprise people. First, it is not open source in the strict sense. GitHub classifies its licence as `NOASSERTION`, and the fourth clause prohibits altering or removing Open WebUI branding once you pass 50 end users. Second, and much less discussed: what it charges for is branding, not security.

That second point matters more than it sounds. In Onyx and Flowise, SSO and role-based access control are enterprise-licensed. In Open WebUI, OAuth, OIDC and LDAP are documented standard features you configure with environment variables. It paywalls vanity rather than safety, and that is a genuinely better deal for a European buyer.

All figures retrieved from primary sources on 4 August 2026.

Open WebUI is developed by Open WebUI, Inc., led by founder Timothy Jaeryang Baek. The project is funded through sponsors, GitHub Sponsors donations and enterprise support agreements, and has raised roughly 40,000 US-Dollar in total, through accelerator and incubator rounds backed by the Mozilla Builders Accelerator and the GitHub Accelerator.

Sit with that number for a moment. Onyx raised 10 million. Dust raised 40 million. Glean is valued at 7.2 billion. Open WebUI, with more GitHub stars than all three combined, raised about the price of a used car.

That is the most important thing to understand before you deploy it. It is not a venture-backed company with an enterprise support organisation waiting for your ticket. It is a very popular open project with a small commercial entity attached. The upside is that there is no investor pressure to squeeze you later. The downside is that your escalation path is a support agreement you negotiate individually, not an SLA on a pricing page.

The Open WebUI License is a BSD-style licence with an added fourth clause. It prohibits altering, removing, obscuring or replacing any Open WebUI branding, including the name, logo and any visual or textual identifiers, in any deployment or distribution.

There are exactly three exemptions:

1. Deployments where the total number of end users, defined as individual natural persons with direct access, does not exceed fifty (50) within any rolling thirty (30) day period
2. Specific prior written permission from the copyright holder
3. A duly executed enterprise licence expressly permitting the modification

Above that threshold, removing the branding is described in the licence as a material breach.

Worth knowing: the repository also ships a `LICENSE_HISTORY` file, meaning earlier versions carried different terms, and contributing requires signing a Contributor License Agreement. If your legal team cares about licence stability over time, both are worth reading before you commit.

SSO is free. Open WebUI documents OAuth 2.0 and OpenID Connect single sign-on as standard configuration, working with any OIDC-compliant provider, plus LDAP through environment configuration. There is no licence gate on it.

Compare that with the pattern we found across the rest of the category. Onyx puts SSO in `backend/ee/onyx/auth/`, under the Onyx Enterprise License. Flowise puts `sso` and `rbac` inside a commercially licensed enterprise directory. n8n gates every `.ee.` file. In all three, the security features you need to deploy responsibly are the ones you pay for.

Open WebUI charges for the logo instead. For a company evaluating a self-hosted AI interface under a works council agreement, that is a meaningfully better trade: you can enforce identity and access control on day one, at zero licence cost, and simply live with someone else's name in the corner of the screen.

One documented limitation to plan around: you can configure only one OIDC provider at a time, so mixed Microsoft and Google estates need a workaround.

It is not enterprise search. Open WebUI is an interface layer. It does not ship a document index that crawls Confluence, SharePoint and Google Drive while respecting their permissions, which is the core of what Onyx or Glean do. If your requirement is ask a question, get an answer from our internal documents with a citation, see enterprise search vs an AI context layer, this is the wrong category and you should read our Glean alternatives guide instead.

It is not a compliance product. Self-hosting solves data residency, and that is real. But the EU AI Act documentation, the works council agreement, the transfer impact assessment and the permission model are still yours to build. The software will not produce them for you.

It is not zero-maintenance. It is far lighter than a twelve-service enterprise search stack, but it is still infrastructure you patch, upgrade and back up. Our analysis of what self-hosting really costs applies here in smaller measure.

Open WebUI is not open source and its documentation undersells its own licence terms. Both criticisms are fair and both are checkable in a browser in under a minute.

But compare what it withholds against what its rivals withhold. Onyx, Flowise and n8n all put single sign-on and access control behind a commercial licence, which means their free tier is unsafe to deploy on real company data. Open WebUI gives you all of that for nothing and asks you to keep its logo. Of every open-core arrangement we audited, that is the one that leaves a European buyer in the best position.

For a self-hosted chat interface under 50 users, it is close to unbeatable. Above 50, budget an enterprise conversation for the branding, but keep in mind that the security features that would cost you elsewhere are still included.

What it will never do is tell you how your organisation is actually functioning. That question needs signals from people, not a nicer window onto a language model.

With 147,882 stars and a one-line Docker install, Open WebUI is one of the most common pieces of shadow AI in existence. Someone in engineering has almost certainly run it on a spare machine, pointed it at a company API key, and shared the URL with their team.

That is not automatically a disaster, and it is worth handling calmly. The instance is on your infrastructure, which is better than staff pasting documents into a consumer chatbot. But it is unmanaged: no retention policy, no SSO if nobody configured it, no record of what was uploaded, and an API key that may be billed to a department that has forgotten about it.

The productive move is to find these instances and adopt the good ones rather than shut them down. A team that already built something useful is the best pilot group you will get. Start by finding out which AI tools your people already use, and read our shadow AI audit guide for the full sweep.