PWM review

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

PWM is an open-source, web-based password self-service application for organizations running LDAP directories. It supports Microsoft Active Directory, OpenLDAP, eDirectory, and generic LDAP deployments, with password changes, configurable policy enforcement, forgotten-password recovery, account activation, first-time password assignment, and new-user registration. Helpdesk users can reset passwords and clear account lockouts, while end users can access the service through a web interface. PWM is suited to teams that need a focused password service across mixed directory environments and prefer self-hosted software.

Its strongest fit is breadth within password self-service. Recovery can use email, SMS, TOTP, OAuth, or LDAP verification, and the platform also covers registration, activation, account creation, and helpdesk workflows. Administrators get audit records, statistics, online logs, and user debugging, while REST APIs support password, policy, and user-attribute operations. Integrations include LDAP, Microsoft Active Directory, OpenLDAP, eDirectory, OAuth, CAS, and the REST API, giving PWM a practical place in directory-centered environments with existing identity services.

Deployment is self-hosted and available as a Java WAR, executable JAR, or Docker image. A web-based configuration manager exposes more than 500 configurable settings, which provides control over directory behavior, policies, recovery, and workflows but also makes administration a significant part of adoption. PWM should suit organizations seeking open-source password self-service with auditing and API access across LDAP and AD. Teams looking for a broader directory management suite with lifecycle automation, delegated administration, or wider reporting should consider a product with that broader focus instead.

PWM pros and cons

• Where it wins
  • Supports Active Directory, OpenLDAP, eDirectory, and generic LDAP deployments
  • Offers recovery through email, SMS, TOTP, OAuth, and LDAP verification
  • Includes helpdesk resets, auditing, statistics, logs, and REST APIs
• Where it doesn't
  • Self-hosted deployment requires an organization's own installation and operation
  • Focuses on password self-service rather than broader directory lifecycle management
  • More than 500 configurable settings may require careful administration

PWM fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update