Open WebUI vs LibreChat vs AnythingLLM: The Ranking Is Upside Down

Open WebUI, LibreChat and AnythingLLM are the three self-hosted chat platforms people actually compare, and every listicle ranks them by GitHub stars. That ranking is close to useless, because the popularity order is almost exactly the inverse of the licence order.

Open WebUI has 147,882 stars, roughly three and a half times LibreChat, and the most restrictive terms of the three: a custom licence GitHub flags as `NOASSERTION`, with branding locked above 50 users. LibreChat has the fewest stars of the three at 41,673, plain MIT, and ships SAML, OIDC and LDAP with no paid tier mentioned anywhere in its documentation. AnythingLLM sits in between: genuinely MIT with a three-role permission model, but its own security docs document no native SAML or OIDC at all.

So the honest answer to which one depends on one question that has nothing to do with stars: can you connect it to your identity provider, and are you allowed to?

Everything below comes from the official documentation of each project, checked on 5 August 2026.

LibreChat is built by Danny Avila and is the most complete of the three on the things a European IT department has to answer for. Its authentication documentation lists email, OAuth2 and OIDC, SAML, LDAP/Active Directory and social login, and mentions no paid tier, enterprise licence or gating anywhere.

Put that next to the rest of our seven-tool licence audit and it stands out sharply. Onyx, Flowise and n8n all put SSO behind a commercial licence. Open WebUI gives SSO away but charges for branding. LibreChat gives away both, under MIT, with SAML on top, which none of the others manage.

Feature-wise it is not a stripped-down option either: agents, Model Context Protocol support, artifacts, a code interpreter, conversation search, model switching across OpenAI, Anthropic, Azure, Mistral, Gemini and local models, plus reusable skill bundles and subagents. Release cadence is roughly every week and a half.

One honest limit: the authentication docs do not describe a role-based access control model. Multi-user auth is documented, RBAC is not, so if fine-grained roles are a hard requirement, verify it before committing rather than assuming.

Open WebUI is the most popular self-hosted AI interface in the world and deserves that position: the interface is the most polished of the three, the community is enormous, and OAuth, OIDC and LDAP are included for free, which is more than Onyx or Flowise offer.

The asterisk is the licence. It is not OSI-approved, and clause four prohibits altering or removing Open WebUI branding once a deployment passes 50 end users in any rolling 30-day period. Below that threshold you may rebrand freely. Above it you need written permission or an enterprise licence.

Our full Open WebUI review goes through the details, including a documentation inconsistency worth knowing about: the enterprise page describes the free tier as requiring branding exactly intact and omits the 50-user exemption its own licence file grants.

One practical limitation for larger organisations: only one OIDC provider can be configured at a time, so a mixed Microsoft and Google estate needs a workaround.

AnythingLLM from Mintplex Labs is MIT-licensed with no carve-out, and it is the most explicit of the three about data handling. Its self-hosted terms state that Mintplex Labs does not host, store or access your documents, chat history or embeddings, and that the software can run fully air-gapped.

In multi-user mode, which requires the Docker server rather than the desktop app, it documents three roles: Administrator with full system access, Manager who can see all workspaces but not change LLM, embedder or vector database settings, and Default who can only chat in workspaces they were explicitly added to. That is a real permission model, and more than LibreChat's auth docs describe.

What is missing is enterprise identity. The official security and access page documents no native SAML or OIDC. For a company that requires SSO against Entra ID or Okta, that is the blocker, regardless of how good the licence is.

One honest caveat the project documents itself: some default embedding models are fetched from its CDN on first use, so a genuinely air-gapped install needs those downloaded in advance.

All three are interface layers over a language model. That is a real and useful thing, and self-hosting one on European infrastructure genuinely solves the data residency question better than any contract can.

What none of them does is index your company. There is no crawler pulling Confluence, SharePoint, Google Drive or Salesforce while respecting the permissions those systems already enforce. If your requirement is ask a question, get an answer from our own documents with a citation, you need something like Onyx or Glean, and our Glean alternatives guide covers that category properly. Be aware that Onyx puts exactly that permission-sync layer behind a commercial licence.

And none of them answers the question underneath most AI projects: not what does this document say but how is my organisation actually doing. That needs continuous signals from people, which is a different category with a different data source. Before you compare tools at all, it is worth checking what your teams already use and reading our self-hosting cost analysis, because free is the licence, not the bill.

If you rank these three by popularity you end up with the one whose licence restricts you most. If you rank them by what a European IT department has to sign off, LibreChat comes first, and it is the least starred of the three.

That is not a criticism of Open WebUI, which is genuinely excellent and gives away SSO that Onyx, Flowise and n8n all charge for. It is a criticism of how these comparisons are usually written. Star counts measure enthusiasm. Licence files and authentication docs measure whether you are allowed to deploy the thing.

Both take about ten minutes to read, and both are public.