AKHQ vs Redpanda Console
ComparisonsAKHQ vs Redpanda Console, compared
Key takeaway
Both are free to install, but only AKHQ stays free once a second person needs to log in: Redpanda Console’s authentication and authorisation both need a Redpanda Enterprise licence, at a price that is not published. AKHQ reaches one cluster or many from a single deployment, where Console has no broker-tier multi-cluster, so three environments means three Consoles. Console’s message viewer is the better one, and AKHQ’s real cost is operator time. Kpow by Factor House is licensed per cluster at a published price.
What is AKHQ?
AKHQ is an open-source Kafka management UI under Apache 2.0, formerly KafkaHQ, self-hosted and built on Micronaut. One deployment reaches one cluster or many, covering topic browsing, live tailing, producing, consumer groups, Schema Registry, Kafka Connect, ACL management and role-based access with LDAP and OIDC. There is no commercial edition, no hosted service and no paid support tier.
- Releases: 0.28.0 in August 2026, after 0.27.1 in May and 0.27.0 in March.
- Maintainership: 441 commits from the lead maintainer, 82 from the next human contributor.
- Access model: LDAP, OIDC, HTTP basic, and external role and claim mapping, all in the free build.
- Reach: one deployment covers one cluster or many, self-managed or managed.
What is Redpanda Console?
Redpanda Console is an open-source web UI for Kafka-compatible clusters, built on Go and React and distributed as a Docker image and a Helm chart. It was originally Kowl, by CloudHut, and Redpanda acquired it in April 2022. It serves Redpanda clusters, where it reads the Redpanda admin API for extra capability, and it also serves vanilla Apache Kafka, Amazon MSK and Confluent Platform. v3.11.0 shipped in August 2026, with three releases in the two months before it.
- Deserialisation: Avro, Protobuf, JSON, XML, CBOR, MessagePack and binary hex, with Protobuf working from local descriptor maps and no schema registry.
- Filtering: JavaScript message filters, and time-travel offset management.
- Observer Mode: browses a topic without joining a consumer group.
Observer Mode matters more than it sounds. A consumer joining or leaving triggers a rebalance, and under the classic protocol that stops the whole group while assignments are recomputed, at a cost that grows with the number of members.
What is the official 2026 pricing of AKHQ and Redpanda Console?
AKHQ costs nothing to license, and its whole cost is operator time. Somebody sizes the JVM, reads the issue tracker before upgrading, and answers for the service when it stops. There is no SLA, because there is nobody to escalate to.
Redpanda Console’s community build is free under the Business Source License, free for internal use with commercial SaaS use restricted, and it covers the message viewer, topic and consumer group management, Kafka Connect management and Schema Registry browsing. Authentication and authorisation are not in it. Both need a Redpanda Enterprise licence, whose price is not published, and that licence is Redpanda’s platform licence rather than a Console product. So a team on Amazon MSK or vanilla Apache Kafka that wants single sign-on in front of a viewer buys a licence from a broker vendor whose broker it does not run. Separately, dev, staging and production means three Console deployments rather than one.
Read that as a team size. Five engineers who all hold cluster credentials anyway: both are genuinely free, and the choice is about which viewer they would rather spend the day in. Fifty people, most of whom should never touch a broker: AKHQ’s access model is already in the free build, and Console’s is a purchase order.
Where does each one run out?
AKHQ’s governance is present and shallow. Masking takes four modes, configured globally in the application YAML and keyed on topic and field path, so what is hidden does not vary by who is looking, and only one filter per topic is supported.
- Audit: opt-in, sunk to a Kafka topic the operator nominates, covering changes rather than reads, with no audit view in the product.
- Metrics: no JMX visualisation and no alerting.
- Reassignment: not exposed. An AdminClient operation a tool either offers or does not, and neither partition increase nor replica change is there.
- Open defects: memory growth reported since July 2022, and OIDC failures still arriving in August 2026.
Redpanda Console’s limits start with the deployment count. There is no broker-tier multi-cluster: reaching several clusters from one Console was requested in September 2021 and again in April 2022, and the later request is still open, so dev, staging and production stay three deployments and three upgrade paths.
- Monitoring: no built-in broker metrics, no alerting and no historical trend analysis, so production monitoring is a separate Prometheus and Grafana stack.
- Write path: no producing a message from the UI, and no native ksqlDB.
- Timeouts: ListMessages at 35 seconds, and DescribeConfigs, DescribeLogDirs and Metadata at 5 and 6 seconds, all hardcoded with no configuration key.
- Degradation: with a single broker offline in a multi-node cluster, every consumer group query fails with a shard error.
Which should you pick?
Pick AKHQ if:
- the access model has to be in the free build
- several clusters have to be reachable from one place
- audit and masking configuration belongs in source control
- the team will own a JVM service and read a Micronaut stack trace
Pick Redpanda Console if:
- the daily work is debugging payloads rather than governing access
- Protobuf without a registry removes a real step from incident work
- inspection currently disturbs consumer groups
- you already run Redpanda and the admin API integration is on the table
Michelin took the AKHQ trade far enough to build resource-level permissions on top of the project and contribute them back, on the judgement that qualifying, selecting and training a team on a replacement cost more than fixing what they already ran. Underneath, the question is who the tool is for: engineers who already hold cluster credentials are choosing a viewer, and a population that should never hold them is buying an access model.
Kpow: role-based access as a feature, not a tier
Neither of these puts access control cleanly inside the tool at no extra cost. Redpanda Console’s authentication and authorisation both need a separate Redpanda Enterprise licence from the broker vendor, priced apart from Console entirely, and AKHQ’s access model, free as it is, is LDAP, OIDC and external role and attribute claim mapping that a team still has to wire up itself. Kpow by Factor House is licensed per cluster at a published price, so adding an engineer doesn’t change the number, and role-based access lives in the product itself rather than behind a tier or a separate licence. One stateless container configured through environment variables, no external database, and up to 12 clusters from a single instance.
Access shouldn’t be a second purchase or a wiring project. Starting Kpow against your own cluster shows what role-based access looks like when it’s just there.
Sources
- KIP-848: the consumer rebalance protocol
- KIP-455: the replica reassignment API