Skip to content

Best tools to reset Kafka consumer group offsets

Comparisons
Chad Harris·September 22, 2026·11 min read·Updated

The tools that reset Kafka consumer group offsets are the kafka-consumer-groups.sh CLI (a dry run by default, --execute to apply), the Admin API’s alterConsumerGroupOffsets for scripted resets, the Kafka Streams application reset tool, and UIs such as Kpow, AKHQ, Kafbat UI and Conduktor Console. Every one of them needs the consumer group to be inactive first.

They differ on whether you can preview the change, how finely you can scope it, what they do when the group is still running, and whether anyone can see who did it afterwards. What an offset is, and how lag is read from it, is covered in Kafka offsets, part of the complete Kafka guide.

At a glance

Seven options are scored here on this page's five weighted criteria, 70 points in all. The rubric is weighted: Access control and audit counts three times, and Preview the change, Scope, Strategies and When the group is running count once. The five listed first, of seven, each out of 70: Kpow 59, which takes its best score on Scope (10 out of 10) and its lowest on Preview the change (3 out of 10); AKHQ 40; Kafbat UI 39; kafka-consumer-groups.sh 33; Admin API alterConsumerGroupOffsets 19.

Reset offsets with the native CLI: dry run, then execute

Stop every consumer in the group first. The Apache Kafka operations documentation says to “first make sure that the consumer instances are inactive”, and the Admin API rejects offset changes for a group with members. Confirm the group is empty:

kafka-consumer-groups.sh --bootstrap-server <broker:9092> \
  --describe --group <group> --state

The STATE column should read Empty. Before changing anything, export the current offsets so you can put them back:

kafka-consumer-groups.sh --bootstrap-server <broker:9092> \
  --group <group> --all-topics \
  --reset-offsets --to-current --export > offsets-before.csv

Then plan the reset. Without --execute the command only prints the plan, with a NEW-OFFSET per partition. --dry-run makes that explicit:

kafka-consumer-groups.sh --bootstrap-server <broker:9092> \
  --group <group> --topic <topic> \
  --reset-offsets --to-datetime 2026-09-22T09:00:00.000 --dry-run

Read every row. If it is what you intended, run the same command with --execute in place of --dry-run. If it goes wrong, the export restores the old positions:

kafka-consumer-groups.sh --bootstrap-server <broker:9092> \
  --group <group> --reset-offsets --from-file offsets-before.csv --execute

The scope is one group at a time, and one of --all-topics, --topic <topic>, or --topic <topic>:0,1,2 for specific partitions. The strategies are --to-earliest, --to-latest, --to-offset, --to-datetime, --by-duration, --shift-by (positive or negative), --to-current and --from-file. Out-of-range results are clamped to the partition’s available offsets, so shifting 15 past an end offset of 10 lands on 10.

A Kafka Streams application needs its own tool. kafka-streams-application-reset.sh resets the input topics and deletes the internal topics, and the application reset tool documentation warns it “makes irreversible changes”. Unlike kafka-consumer-groups.sh, it runs for real unless you pass --dry-run.

Offset reset tools compared

The table scores each tool on the five criteria in order. Managing offsets inside Kpow step by step, with a local environment you can run, is covered in manage Kafka consumer offsets with Kpow.

Rank Tool Preview Scope Strategies When the group is running Access control and audit Source
1 Kpow Its docs do not describe a preview step. Scheduled resets can be cancelled before they run, and staged mutations add an approval Whole group, host, topic or partition Offset, timestamp, local datetime, clear to earliest, skip one offset Scheduled, runs once the group is EMPTY, up to 15 minutes by default GROUP_EDIT permission, staged mutations, temporary policies, audit log (Enterprise) Kpow docs
2 kafka-consumer-groups.sh Yes, dry run is the default, --execute applies One group, all topics, a topic, or topic:partitions Earliest, latest, offset, datetime, duration, shift-by, current, from file Fails, you stop the consumers and rerun Whoever holds CLI credentials, no audit Apache Kafka docs
3 AKHQ The form shows each partition’s current, first and last offset before you submit Per partition, in a form Earliest, latest, timestamp or a typed offset per partition Kafka rejects the change UPDATE_OFFSET role, opt-in audit events to a Kafka topic GitHub: tchiotludo/akhq
4 Kafbat UI The form states the target, with no dry-run step in its reset API A topic, optionally specific partitions Earliest, latest, timestamp, offset Refused unless the group is EMPTY or DEAD RESET_OFFSETS permission, audit log to a topic or console GitHub: kafbat/kafka-ui
5 Admin API alterConsumerGroupOffsets Only what your code prints Any set of partitions you pass Any offset you compute Fails, “the group must be empty”, and may partially succeed Your code’s responsibility Apache Kafka Javadoc
6 kafka-streams-application-reset.sh Only with --dry-run, it runs for real by default One Streams application: input topics reset, internal topics deleted Earliest by default, plus other positions All instances must be stopped Whoever holds CLI credentials, no audit Apache Kafka docs
7 Conduktor Console Yes, a Preview step shows current and new offset per partition All partitions, specific topics, or specific topic-partitions Earliest, latest, offset, timestamp, shift-by Must be inactive (Empty or Dead) RBAC with a consumer group Reset permission, audit log Conduktor’s documentation, Consumer groups and RBAC pages

How the options score

On preview, the CLI and Conduktor Console lead: both show the new offset for every partition before anything changes. AKHQ’s form shows current, first and last offsets per partition as you edit, which works as a preview. Kpow’s documentation does not describe a preview step, so a Kpow reset relies on scheduling, cancellation and approval rather than a dry-run table. That is a real gap next to the CLI.

On scope, Kpow is the most flexible, because it can reset from any dimension of the group’s topology: the whole group, one host’s assignments, a topic, or a single partition. The CLI and Conduktor both reach partition level. Kafbat UI works one topic at a time.

On strategies, the CLI has the longest list, including --by-duration, --from-file and negative --shift-by, and it is the only tool here with a built-in export and restore. Conduktor comes closest in a UI with shift-by.

On a running group, Kpow is the only tool here that schedules the reset and applies it the moment the group reaches EMPTY, so you can queue the change, scale the consumers down, and not race them. Everything else fails and waits for you to try again. Kpow also reads offsets for EMPTY groups directly from the AdminClient, so a group taken offline by a poison message can still be reset.

On access and audit, Kpow gives the most options: a GROUP_EDIT permission, staged mutations that put an administrator’s approval in front of the reset, temporary policies that grant GROUP_EDIT on one group for a fixed window, and an audit log of the request and the policies it was checked against. Conduktor, AKHQ and Kafbat UI all have role-based permissions and audit logs. The CLI and the Admin API have neither.

Each tool in detail

Rank 1

59 out of 70 Total

Try Kpow in the live demo No signup needed.

Type
Kafka UI
Running group
Scheduled until EMPTY, 15 minutes by default
Edition
Staged mutations, temporary policies and audit log are Enterprise
Preview the change
3 out of 10
Scope
10 out of 10
Strategies
6 out of 10
When the group is running
10 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
10 out of 10
Why these scores for Kpow
Preview the change 3 out of 10
The summary has its docs not describing a preview step, “a real gap next to the CLI”, leaving only cancellation of a scheduled reset and staged approval.
Scope 10 out of 10
The summary says “Kpow is the most flexible”, resetting from the whole group, one host’s assignments, a topic or a single partition.
Strategies 6 out of 10
This page’s table gives offset, timestamp, local datetime, clear to earliest and skip one offset, and its prose records no export or restore of offset plans, so it sits below the CLI and Conduktor.
When the group is running 10 out of 10
The summary calls it “the only tool here that schedules the reset and applies it the moment the group reaches EMPTY”.
Access control and audit 10 out of 10
The summary says “Kpow gives the most options”, namely GROUP_EDIT, staged mutations with approval, temporary policies on one group, and an audit log of the request and policies checked.

What it does. Resets, clears or skips offsets from the consumer group topology or the consumer details view, scoped to the group, a host, a topic or a partition, by offset, timestamp or local datetime.

Where it wins. Scheduling against the EMPTY-group rule, the widest scope options, and governance: approval, temporary access and an audit trail. It also manages simple consumers that use manual partition assignment, in their own tab.

Where it falls short. No documented dry-run table, and no export or restore of offset plans. Staged mutations, temporary policies and the audit log are Enterprise features.

Staying patched. Kpow’s release notes name the CVEs each release remediates, and the 96.4 image built on 5 August 2026 bundles 311 dependencies of which one carries a high or critical advisory, none of them published before that release. That is not a claim to patch faster than a community project: Kpow’s own dependency remediation has run from 14 to 128 days, and the current image still ships CVE-2026-75595 in netty, a 9.1 critical public since 19 August 2026, unpatched. What a licence buys here is not a different deployment model, because Kpow is self-hosted too. It is a company contracted to ship the fix. Every dependency figure on this page was read on 24 September 2026 from the published artefacts and from nvd.nist.gov.

Rank 2

40 out of 70 Total

Type
Open-source Kafka UI
Permission
UPDATE_OFFSET role
Preview the change
7 out of 10
Scope
7 out of 10
Strategies
6 out of 10
When the group is running
2 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
6 out of 10
Why these scores for AKHQ
Preview the change 7 out of 10
The summary has the form showing current, first and last offsets per partition as you edit, “which works as a preview”, rather than a dry-run table of new offsets.
Scope 7 out of 10
This page’s table gives it per partition, in a form, and its prose has the per-partition form making the target explicit. There is no host or topology scope.
Strategies 6 out of 10
This page’s table gives earliest, latest, timestamp or a typed offset per partition, with no shift-by, duration or export.
When the group is running 2 out of 10
This page’s table has Kafka rejecting the change, and its prose puts it that “timing is on you”.
Access control and audit 6 out of 10
This page’s table gives an UPDATE_OFFSET role and audit events to a Kafka topic, and its prose has the audit trail opt-in, so it sits below Conduktor and Kafbat UI.

What it does. An open-source UI whose consumer group update form lets you set each partition’s offset, or fill the form from earliest, latest or a timestamp.

Where it wins. Free, and the per-partition form makes the target explicit.

Where it falls short. Kafka rejects the change if members are active, so timing is on you, and the audit trail is opt-in and lives in a Kafka topic.

Staying patched. AKHQ has no CVE filed against its own code, and that is the wrong number to plan against. Release 0.28.0, cut on 6 August 2026, bundles 270 libraries and 18 of them carry a high or critical advisory. Sixteen were already public, with fixed versions already on Maven Central, on the day it shipped, and five are netty advisories Kpow had remediated three weeks earlier in 96.2: CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691 and CVE-2026-50010. The oldest has been open 108 days. That is exposure and remediation latency rather than a working attack, and every figure resolves against the published jar and nvd.nist.gov. Four releases in two years, and no security policy at any path GitHub reads.

Rank 3

39 out of 70 Total

Type
Open-source Kafka UI
Permission
RESET_OFFSETS
Scope
One topic per reset
Preview the change
4 out of 10
Scope
6 out of 10
Strategies
6 out of 10
When the group is running
2 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
7 out of 10
Why these scores for Kafbat UI
Preview the change 4 out of 10
This page’s table has the form stating the target, with no dry-run step in its reset API.
Scope 6 out of 10
This page’s table gives a topic and optionally specific partitions, and the summary says “Kafbat UI works one topic at a time”.
Strategies 6 out of 10
This page’s table gives earliest, latest, timestamp and offset, with no shift-by, duration or export.
When the group is running 2 out of 10
This page’s table has it refused unless the group is EMPTY or DEAD, and its prose has it refusing rather than scheduling.
Access control and audit 7 out of 10
This page’s table gives a dedicated RESET_OFFSETS permission and an audit log to a topic or the console, with no approval step named.

What it does. An open-source UI that resets a topic’s offsets for a group, optionally for specific partitions, to earliest, latest, a timestamp or an offset.

Where it wins. Free, with a clean reset form and a dedicated RESET_OFFSETS permission.

Where it falls short. One topic at a time, and it refuses the reset unless the group is already EMPTY or DEAD.

Staying patched. Kafbat UI released v1.5.0 in April 2026 and has not shipped since. In the 157 days since, at least 20 high or critical advisories have been published against libraries that release bundles, including the same netty critical CVE-2026-75595 that the current Kpow image carries. Only 150 of its 266 bundled jars resolved to a Maven coordinate, so that count is a floor and the state of the release itself is unmeasured. Kafbat does publish a security policy, which AKHQ and Kafdrop do not, and the one CVE filed against its own code, CVE-2025-49127, was already fixed in the release that preceded the advisory. Six releases in two years.

Rank 4

kafka-consumer-groups.sh

kafka.apache.org

33 out of 70 Total

Type
Command-line tool
Ships with
Apache Kafka
Default
Dry run, --execute applies
Preview the change
10 out of 10
Scope
8 out of 10
Strategies
10 out of 10
When the group is running
2 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
1 out of 10
Why these scores for kafka-consumer-groups.sh
Preview the change 10 out of 10
This page’s summary of how the options score has “the CLI and Conduktor Console lead”, and the dry run is the default and prints NEW-OFFSET per partition.
Scope 8 out of 10
This page’s table gives one group, all topics, a topic, or topic:partitions, and the summary has it reaching partition level. It sits below Kpow, which the page calls the most flexible.
Strategies 10 out of 10
The summary calls it “the longest list”, including --by-duration, --from-file and negative --shift-by, and it is the only tool with a built-in export and restore.
When the group is running 2 out of 10
This page’s table has it failing, so you stop the consumers and rerun, and the summary says “Everything else fails and waits for you to try again”.
Access control and audit 1 out of 10
This page’s table gives access to whoever holds CLI credentials, with no audit, and the summary says “The CLI and the Admin API have neither”.

What it does. Plans and applies offset resets for one group, with export and import of offset plans as CSV.

Where it wins. Dry run by default, the fullest set of strategies, and --export plus --from-file for backup and restore.

Where it falls short. No access control beyond cluster credentials and no audit. --topic <topic> without partitions resets every partition, which is easy to type by mistake.

Rank 5

Admin API alterConsumerGroupOffsets

kafka.apache.org

19 out of 70 Total

Type
Java Admin API method
Transactional
No, may partially succeed
Preview the change
2 out of 10
Scope
8 out of 10
Strategies
5 out of 10
When the group is running
1 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
1 out of 10
Why these scores for Admin API alterConsumerGroupOffsets
Preview the change 2 out of 10
This page’s table gives only what your code prints, and its prose leaves the preview yours to build.
Scope 8 out of 10
This page’s table gives any set of partitions you pass, so partition level, but only through code you write.
Strategies 5 out of 10
This page’s table gives any offset you compute, with no named strategies, so the targets are yours to calculate.
When the group is running 1 out of 10
The Javadoc quoted on this page has “the group must be empty” and says it “may succeed for some partitions while fail for others”, which is worse than a clean failure.
Access control and audit 1 out of 10
This page’s table makes it your code’s responsibility, and the summary has the Admin API carrying neither access control nor audit.

What it does. Sets committed offsets for any partitions of a group from code.

Where it wins. Automation, such as a runbook step or a replay job that computes its own targets.

Where it falls short. Not transactional, so a failure can leave some partitions moved and others not. Preview, logging and approval are all yours to build.

Rank 6

kafka-streams-application-reset.sh

kafka.apache.org

18 out of 70 Total

Type
Command-line tool
Default
Runs for real without --dry-run
Also deletes
Internal topics
Preview the change
5 out of 10
Scope
3 out of 10
Strategies
5 out of 10
When the group is running
2 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
1 out of 10
Why these scores for kafka-streams-application-reset.sh
Preview the change 5 out of 10
This page’s table gives a preview only with --dry-run, because it runs for real by default, and the first criterion says this “catches people who assume it behaves like its sibling”.
Scope 3 out of 10
This page’s table gives one Streams application, with all its input topics reset and internal topics deleted, and the second criterion counts whole-unit resets as turning a small fix into a large one.
Strategies 5 out of 10
This page’s table gives earliest by default plus other positions, the page lists no export or restore, and the docs call its changes irreversible.
When the group is running 2 out of 10
This page’s table requires all instances to be stopped, so it fails rather than schedules.
Access control and audit 1 out of 10
This page’s table gives access to whoever holds CLI credentials, with no audit.

What it does. Resets a Streams application’s input topic offsets and deletes its internal topics so it can reprocess from scratch.

Where it wins. It is the only tool that understands a Streams application’s internal topics.

Where it falls short. Irreversible, runs for real without --dry-run, and local state stores on every instance still need deleting by hand.

Rank 7

Conduktor Console

conduktor.io

52 out of 70 Total

Type
Commercial Kafka console
Strategies
Five, including shift-by
Preview
Current and new offset per partition
Preview the change
10 out of 10
Scope
8 out of 10
Strategies
8 out of 10
When the group is running
2 out of 10
Access control and audit ×3 weight, this criterion counts 3 times toward the total
8 out of 10
Why these scores for Conduktor Console
Preview the change 10 out of 10
The summary says “the CLI and Conduktor Console lead”, and this page’s table gives a Preview step showing current and new offset per partition.
Scope 8 out of 10
This page’s table gives all partitions, specific topics, or specific topic-partitions, and the summary has it reaching partition level.
Strategies 8 out of 10
The summary says “Conduktor comes closest in a UI with shift-by”, with five strategies and no export or restore.
When the group is running 2 out of 10
This page’s table requires the group to be inactive (Empty or Dead), and its prose has it needing the group inactive “rather than scheduling the change”.
Access control and audit 8 out of 10
This page’s table gives RBAC with a consumer group Reset permission and an audit log, with no approval step or temporary access named, which Kpow adds.

What it does. A commercial console with a reset flow that takes a topic-partition scope, five strategies including shift-by, and a preview before applying.

Where it wins. The most CLI-like safety in a UI, with a preview and partition scope.

Where it falls short. Like the CLI, it needs the group inactive before you start, rather than scheduling the change.

How Factor House approaches offset resets

Kpow is built around the idea that an offset reset should be quick to do correctly and hard to do by accident. The consumer group documentation covers the actions: reset by offset, timestamp or datetime at group, host, topic or partition level, clear to earliest, and skip one offset on a partition. Every group action is scheduled and runs once the group’s state is EMPTY, for up to 15 minutes by default (MUTATION_SCHEDULER_EXPIRES_MS), and you can watch or cancel it from the Mutations tab. Staged mutations add an approval step, temporary policies grant GROUP_EDIT on one group for a fixed window, and the audit log records each request with the user, the action and the policies it was checked against. In the live Kpow demo, open a consumer group’s topology and select the group, a topic or a partition to see the reset, clear and skip options at each scope. The Kpow product page covers the rest of the product.

If a reset is needed because consumers are falling behind, measure the lag first with one of the tools to monitor consumer lag. What is Kafka rebalancing? and Kafka consumers in production cover the causes a reset will not fix.

Kpow live demo

Preview an offset reset before you run it

Open the Kpow demo to see consumer group offsets by partition and how a reset is scoped, permissioned and logged.

Built for platform and data engineers running Kafka in production.

Try the Kpow demo

FAQ

How do I reset a Kafka consumer group’s offsets?

Stop every consumer in the group, then run kafka-consumer-groups.sh --reset-offsets with a scope (--all-topics, --topic, or --topic <topic>:<partitions>) and a strategy such as --to-earliest or --to-datetime. Check the dry-run output, then rerun with --execute. Export the current offsets first with --to-current --export so you can restore them.

Can I reset offsets while consumers are running?

No. Kafka only accepts offset changes for a group with no active members. Kpow can schedule the reset so it runs the moment the group empties, and every other tool here makes you stop the consumers first and then run it.

What is the difference between auto.offset.reset and resetting offsets?

auto.offset.reset is a consumer setting that only applies when a group has no committed offset for a partition, such as a brand-new group. Resetting offsets changes the committed offsets of an existing group. Use latest for auto.offset.reset in production and treat resets as deliberate operations.

How do I reset offsets for a Kafka Streams application?

Use kafka-streams-application-reset.sh, not kafka-consumer-groups.sh, because it also deletes the application’s internal topics. Stop every instance, run it with --dry-run first, and delete the local state stores on each instance before restarting.

How these tools were scored

An offset reset rewrites where a consumer group will resume reading. Done right, it replays a window after a bad deploy or skips a backlog nobody needs. Done wrong, it silently drops data or reprocesses a topic from the beginning. Five criteria decide how likely each is with a given tool.

1. Can you preview the change?

A dry run that prints the new offset for every partition is the single most important safety feature. The CLI previews by default. The Streams reset tool does not, which catches people who assume it behaves like its sibling.

2. How finely can you scope it?

Group, topic and partition are the scopes that matter. Skipping one bad record needs a single partition, the case walked through in how to find and skip a poison pill. Replaying after a bad deploy usually needs one topic. A tool that only resets a whole group, or makes partition scope awkward, turns a small fix into a large one.

3. What happens when the group is still running?

Kafka refuses an offset change while the group has active members. The Admin API documentation for alterConsumerGroupOffsets states that “the group must be empty”, and adds that it “is not transactional so it may succeed for some partitions while fail for others”. As Derek Troy-West, Factor House’s co-founder and CEO, puts it, that requirement is Kafka’s, and tools work with what Kafka allows. They differ on what they do about it: fail and make you retry, or schedule the change until the group empties.

4. Does it keep resets deliberate?

Chad Harris’s rule is that production consumers use auto.offset.reset=latest, and any reset is a deliberate, manual operation. Setting earliest just in case is easy to forget, and the day a consumer group ID changes, even for an innocent reason like renaming a service, the group reprocesses everything from the beginning. A tool should make the reset an explicit act with a named target.

A reset is also not always the right tool. In one incident he covered in a talk on Kafka operational issues, a partition count increase plus auto.offset.reset=latest meant hundreds of messages per partition, across around a hundred partitions, were silently skipped. The system was real-time and could not stop processing, so instead of rewinding the group, a parallel consumer replayed the missed offsets, tens of thousands of messages, without interrupting live traffic.

5. Who is allowed to do it, and is it recorded?

A reset in production usually happens during an incident, under pressure. Tom Crowley, Factor House’s founding engineer, described the typical path in 2021, a problem now covered in break-glass access with temporary policies: a VPN, a jumpbox, and “the right combination of bash commands against the Kafka cluster”, from a jumpbox that “generally has full access to the Kafka cluster” with “no audit log recording the actions being committed”. The better tools gate resets behind a role, can require approval, and log who reset which group to where. The best tools to control destructive Kafka operations applies the same question to deletes, truncation and config changes.

F1 The default that keeps resets deliberate /resources/kafka/

Use latest in production and make offset resets a deliberate, manual operation.

Chad Harris, Solutions Architect at Factor House
Setting auto.offset.reset to earliest just in case means a renamed consumer group silently reprocesses a topic from the beginning. Things that go bump in the night

Every option is scored from 0 to 10 on each criterion, from the evidence and sources this page cites, and the reason for each score is on its card. The criteria are weighted: Preview the change counts once, Scope counts once, Strategies counts once, When the group is running counts once and Access control and audit counts three times, for a total out of 70. Access control and audit counts three times here, because resetting an offset replays or skips production data, and it is the destructive operation most often run with no record of who asked for it. Preview the change, scope, strategies and behaviour when the group is running count once. This page is published by Factor House, which makes Kpow. Every option is scored on the same rubric and the same sources: Kpow's per-criterion scores are set the same way as every other option's and are not adjusted, and the weights apply to every option alike. Kpow ranks first on its total of 59 out of 70. The other options follow by total. Conduktor Console is listed last whatever its total; on its total of 52 it would place second.

Related reading