Kafbat UI vs Lenses
ComparisonsKafbat UI vs Lenses, compared
Key takeaway
Kafbat UI and Lenses both run on top of a Kafka cluster somebody else operates. Kafbat UI is free under Apache 2.0 with no seat or cluster cap, shipping role-based access control, six identity provider types, server-side masking and a built-in audit log at no cost. Lenses meters by user count instead: Community stops at 5, Team starts at 4,000 US dollars a year for up to 15, and HQ needs PostgreSQL plus a database behind every Agent. SQL Studio has no Kafbat equivalent. Kpow by Factor House is licensed per cluster at a published price.
What is Kafbat UI?
Kafbat UI is a free, open-source web dashboard for observing and managing Kafka clusters, licensed Apache 2.0 with no source-available restriction on production use. It deploys as a container rather than per engineer, and one deployment reaches many clusters. The application is stateless and computes its views from the cluster on request, so it runs as ordinary replicas with no attached storage and no external database. A cluster is addressed with bootstrap-servers and ordinary Kafka client properties, so it reaches a KRaft cluster with no broker-side change, and Amazon MSK, Azure Event Hubs and Google Cloud are covered with cloud IAM integration.
The lineage matters more here than it usually would, because two projects answer to nearly the same name. Kafbat UI is the maintained continuation of the Provectus kafka-ui project, carried forward by contributors who were there at that project’s inception. The predecessor has shipped no release since v0.7.2 in April 2024 and taken no commit since that July, and it still carries roughly five times the stars.
What is Lenses?
Lenses is a commercial governance and data-exploration platform for Kafka, and its differentiator is SQL Studio, a SQL interface for querying topics without writing consumer code. That is a different job from the one a cluster console does: Lenses is a query and catalogue layer aimed at somebody who is not Kafka-savvy, and Kafbat UI is an operations console aimed at somebody holding an incident. Celonis acquired Lenses in early 2022, and the 6.x line is active through 6.2.6 in August 2026.
- Architecture: a central Lenses HQ node with lightweight Agents deployed per cluster, connecting as standard Kafka clients.
- Topology and lineage: one view across producers, topics, connectors and consumers.
- Data catalogue: topics grouped by logical domain.
- SQL Processors: Kubernetes-native stream processing built on Kafka Streams, defined in SQL.
What is the official 2026 pricing of Kafbat UI and Lenses?
Kafbat UI costs nothing to license at any size: no paid tier, no seat cap and no cluster cap on the software. What the company sells is professional services around it, covering architecture review, custom implementation, scaling work, security and compliance, and 24/7 enterprise support, none of it publicly priced. At five engineers and at fifty the licence line is the same number, so the real cost is operator time plus whatever support arrangement gets negotiated.
Lenses meters by user count, and the steps are the whole story. Community is free for up to 5 users with Basic Auth, the Lenses UI and MCP. Team starts at 4,000 US dollars a year for up to 15 users, and it is where SSO, SAML, RBAC and Team Support begin. Above 15 users the tier is Multi-Kafka Enterprise at custom pricing. Replication is a second meter: K2K Community is free with a maximum of 5 topic partitions per replication job, and K2K Enterprise starts at 1,000 US dollars a month, includes 5 clusters and charges 200 a month for each cluster after. The last cost is deployment: one of these is a container, and the other is a control plane with a database behind every part of it.
Where does each one run out?
Kafbat UI publishes no support commitment of its own, so response times, escalation and fixes come out of a services engagement. Patching is yours, and there is a record to patch against: three remote-code-execution flaws stand across the two lineages, scored 8.9, 8.8 and 8.1 on NVD, two of them reachable with no authentication at all. On the dormant predecessor the remedy is an upgrade to 0.7.2, the last release it ever made.
- Audit level: defaults to
ALTER_ONLY, so who looked at something is not captured until an operator setsALL. - Audit topic: must not be compacted, because records carry no key, and its partition count defaults to 1.
- Masking: per cluster and pattern-driven, so coverage depends on the patterns somebody wrote.
- Releases: five tags in 2025, then v1.5.0 in April 2026, with commits still arriving between releases.
What Lenses runs out of first is deployment budget. HQ requires PostgreSQL and it is the only supported store. Each Agent needs its own database as well, with the embedded H2 alternative documented for evaluation only, and one Agent connects to one Kafka cluster, so a four-cluster estate is one HQ, four Agents and five databases. The Community edition carries the same dependency.
- Availability: the HQ deployment sets
replicas: 1as a literal and defaults to aRecreateupdate strategy, so an upgrade terminates HQ before starting its replacement. - Masking: data policies match on field name across every registered dataset and are global, so masking cannot vary by who is looking.
- Portability: SQL Processors are proprietary and compiled, while Stream Reactor connectors are open source and survive a move.
- Scaling: the values file exposes no replica count and no autoscaling for HQ.
Which should you pick?
Pick Kafbat UI if:
- the team is engineers, and the questions are about the cluster rather than the records
- a regulated shop needs access control and an audit trail without a purchase order
- the cluster count is going up faster than the headcount
- there should be no database to keep alive
Pick Lenses if:
- the people who need to read the data are analysts and support staff who will never write a consumer
- SQL over a topic is the capability being bought
- the honest answer to who patches this at two in the morning is nobody
The third case is the one the category most often gets wrong. Kafbat UI ships role-based access control scoped per resource type with regular-expression role subjects, six identity provider types, server-side masking with three policy types, and a built-in audit log written to a Kafka topic, all at no licence cost. Neither tool owns the authorisation model underneath, since Kafka enforces ACLs at the broker: what each gives you is a way to read and edit what the cluster already applies.
Kpow: one container, not a second control plane
Lenses needs a control plane of its own before anyone opens a topic: a central HQ node on PostgreSQL, plus a separate Agent and Agent database for every cluster it reaches, and the meter still starts at 5 users and climbs to a negotiated contract past 15. Kafbat UI needs none of that infrastructure, but there is no vendor behind the free build either, so support is an unpriced services engagement rather than a number anyone can budget. Kpow by Factor House needs no second control plane and no negotiated contract: it is licensed per cluster at a published price, running as a single stateless JVM container configured through environment variables, with no external database, no sidecar and no persistent volume.
One container instead of a second control plane is the saving that matters here. Kpow’s product page lays out that per-cluster price in full — the third option, neither metered by user nor free and unsupported.
Sources
- NVD record for CVE-2025-49127
- NVD record for CVE-2023-52251
- Apache Kafka documentation on authorization
- NVD record for CVE-2024-32030