Kafbat UI vs Kafdrop
ComparisonsKafbat UI vs Kafdrop, compared
Key takeaway
Kafbat UI and Kafdrop both put a web interface over a Kafka cluster you already run, are Apache 2.0 and free on a single tier, and ship as one container against a broker list, so the split is not the feature list. Kafbat UI is the maintained continuation of the Provectus kafka-ui project, which last released in April 2024. Kafdrop does not support KRaft, which Apache Kafka 4.0 runs by default, and three failure reports against it closed as not planned; it also has no authentication. Kpow by Factor House is licensed per cluster at a published price.
What is Kafdrop?
Kafdrop is an open-source Kafka web UI built on Spring Boot, published under Apache 2.0 as obsidiandynamics/kafdrop. It runs as a stateless Java process against the standard broker protocols with no separate datastore, which is what keeps a deployment to one container and a broker list. It needs Java 17 or newer and Kafka 0.11.0 or newer, or Azure Event Hubs, and serves the UI on port 9000.
- view brokers, topics and partition state
- browse messages in JSON, plain text, Avro and Protobuf
- view consumer groups with combined and per-partition lag
- create topics, and view ACLs
- Azure Event Hubs as a first-class target
The newest published release is 4.2.0, of 31 July 2025, while the codebase keeps moving: Java 25 merged in December 2025, Spring Boot 4.1 in August 2026, and community feature work in August 2026 that is in no tagged image. What has stalled is the tagging rather than the project.
What is Kafbat UI?
Kafbat UI is the maintained continuation of the Provectus kafka-ui project, forked by contributors who had been on that project since its inception. Provectus last released v0.7.2 on 10 April 2024 and last took a commit that July, so the original image is abandoned software. Kafbat is free, Apache 2.0, deployed as a container, and one deployment reaches many clusters. There is no paid edition and no source-available restriction on production use.
- Access control: roles across eight resource types, with subjects matched by regular expression.
- Identity providers: OAuth, Google, GitHub, Cognito, LDAP and Active Directory.
- Masking: server-side
REMOVE,REPLACEandMASKpolicies applied to keys, values or named JSON fields. - Audit: a built-in log written to a Kafka topic, to the console, or to both.
- Releases: v1.0.0 in March 2024 through v1.5.0 on 20 April 2026, five of them in 2025.
What is the official 2026 pricing of Kafbat UI and Kafdrop?
Neither product has a price, and both take payment somewhere else. Kafdrop takes nothing and offers nothing: no licence fee, no supported edition, no commercial entity behind it, and no channel beyond GitHub issues. Kafbat UI is free on the same terms, with no seat cap and no cluster cap, and the money sits in named professional services: architecture review, custom UI work, performance and scaling, security and compliance, and 24/7 support. No price is published for any of them.
For five engineers who all already hold cluster credentials, the difference is close to academic, and the cost is one container and one configuration block either way. For fifty it is not. The bill is still zero, and the cost has moved: Kafbat UI asks you to follow a release line, and Kafdrop asks you to own an authentication proxy, because the product has none.
Where does each one run out?
Kafdrop’s first limit decides whether it is viable at all. Apache Kafka 4.0, announced in March 2025, is the first major release to run without ZooKeeper, in KRaft mode by default. Kafdrop does not support KRaft: the topic view becomes unresponsive against a KRaft cluster, and three failure reports were closed as not planned, the last in April 2025. That is a settled position rather than a backlog item. Beneath it sit one cluster per deployment, no message search or filtering by key or value, and message encoding set per topic by hand.
- Authentication: none in the product. The feature request was closed as not planned in February 2026, and the documented answer is an NGINX proxy in front.
- Read-only mode: absent, so anyone who can reach an instance can delete a topic. The pull request adding one has sat since November 2020.
- Scale: around 5,566 consumer groups took the UI past 30 minutes to load.
- MSK IAM: never merged, so a cluster authenticating through IAM is reachable only through a community workaround.
Kafbat UI’s limits are the standing cost of the model it chose. CVE-2025-49127, an unsafe deserialisation flaw in v1.0.0, allowed an unauthenticated user to run arbitrary code on the server. It scored 8.9 HIGH on CVSS v4.0, was published in June 2025, and was fixed in v1.1.0. The remedy is an upgrade somebody on your side performs, and that obligation recurs. Sizing starts as a guess too, because the published resource guidance is example Helm values tied to no cluster, topic or partition count.
- Audit defaults: the default level records changes and not reads, and the audit topic defaults to one partition and must never be compacted.
- Masking: per cluster and pattern-driven, so coverage depends on patterns that match every topic carrying a sensitive field.
- Dynamic config: anything set through the configuration wizard is written inside the container and lost on restart without a mounted volume.
- Metrics: no time-series graphs for consumer lag or throughput. The feature request predates the fork.
Which should you pick?
Pick Kafdrop if:
- the cluster still runs ZooKeeper, and no KRaft migration has a date on it
- the tool is for a handful of engineers who already hold cluster credentials
- the job is local development, or a quick look at what is flowing through a topic
- consumer group count has never been a number anybody had to think about
Pick Kafbat UI if:
- the cluster is on KRaft, or is going there
- more than one cluster has to be reachable from one place
- somebody who must not delete a topic still needs to see one
- an auditor is going to ask who did what
Underneath the four requirements is a question about staffing rather than features. Kafdrop’s scope is settled, so its limits are known in advance and the work of protecting it stays yours permanently. Kafbat UI’s scope moves, so you inherit a release cadence, and in exchange the governance sits inside the product rather than in a proxy in front of it.
Kpow: a published price, not a proxy to build or an upgrade cadence to own
Kafdrop has no authentication of any kind, and the documented answer is an NGINX proxy you build and run yourself; Kafbat UI ships real access control, but staying safe on it means tracking its release line closely enough to have already moved past CVE-2025-49127 before it mattered. Both are free, and both hand the cost to whoever on your side maintains that proxy or watches the release notes. Kpow by Factor House charges the cluster once and stops: licensed per cluster at a published price, unmoved whether five engineers become fifty, running as one stateless container through environment variables, with no external database, and reaching up to 12 clusters from a single instance.
A published price is one less thing to build a proxy for or watch a release feed for. Kpow publishes that per-cluster number in full, so the five-to-fifty math above checks against something real instead of a guess.