Best Kafka terminal UIs (TUI)

A Kafka TUI (terminal user interface) is a keyboard-driven program that shows a Kafka cluster’s topics, consumer groups and messages full-screen in a terminal, the k9s model applied to Kafka.

The maintained open-source options are ktea, Kaskade, kafui, Yozefu, kaftui and karat, Kpow ships one as fh tui, and the baseline is the bundled scripts plus kcat. Which one fits depends on six things: what it shows you, what it lets you change and how safely, how it handles several clusters, how it authenticates, how good the keyboard experience is, and what a year of running it costs. Kpow is Factor House’s product, and I work at Factor House as a Solutions Architect, so it is scored on the same rubric and the same sources as every other option. The complete Kafka guide covers the wider tooling picture.

What a Kafka TUI is

A TUI sits between a command-line tool and a web UI. Like the bundled Kafka scripts it runs in a terminal, so it works over SSH on a jump host where no browser can reach. Like a web UI it keeps state on screen, refreshes it, and lets you move from a topic to its partitions to its consumer groups without retyping a bootstrap server. It is lighter than a Kafka web UI: nothing to deploy, one binary or one pipx install.

There is one architectural split that shapes every score below. The open-source TUIs are Kafka clients. They connect straight to the brokers, so the machine running them needs network access to every broker and a credential, usually in a local config file, with whatever rights the tool will use. The Kpow terminal UI is a client of a Kpow server. It talks to Kpow’s API, Kpow talks to the brokers, and the terminal holds a sign-in session rather than broker credentials. That makes access control much stronger and makes the tool useless without a Kpow deployment.

If you are SSH’d into a box and need to look at one cluster once, you may not need a TUI at all. How to inspect Kafka topics, messages and consumer groups from the terminal walks through the same jobs with the bundled scripts and kcat.

How we scored them

Each of the first five criteria comes from a way a terminal session goes wrong in production, and each option is scored 0 to 10 on it from its own README or docs, read on 22 September 2026. The sixth is our own cost model, set out below.

1. What you can see

Brokers, topics and partition health, consumer groups and lag, configs, and the messages themselves. In my talk on Kafka operational incidents I made the case for reading the messages: “Data inspection tooling is essential for handling lost-message complaints, since the large majority of the time, the message was on Kafka all along.” A TUI that shows lag but cannot show you the record at the stuck offset leaves you switching tools mid-incident. The same talk makes the point that lag and under-replicated partitions are “useful for telling you something is wrong, but not why”, so configs and group membership count here too. Kafka brokers in production lists the broker signals worth having on screen.

2. What you can change, and how safely

Creating and deleting topics, resetting offsets, restarting connectors. Every write action is also a way to make an incident worse at 2am. My standing advice from the same talk: “Use latest in production and make offset resets a deliberate, manual operation.” A good TUI makes the deliberate part easy: a confirmation you cannot hit by accident, a diff before an edit, a read-only mode. A tool with no write access at all scores low here, which is the price of being safe to hand to anyone.

3. Multi-cluster

Most teams run dev, staging and production, and larger ones run far more. One enterprise prospect wrote to us that it had “around 75 clusters across all the environments”. What people ask us for, in Factor House’s own notes from conference conversations, is a unified view across clusters and environments with RBAC by environment, for example producing allowed in dev and restricted in prod. For a TUI that means switching clusters without restarting, and making it obvious which one you are on. The best tools to manage multiple Kafka clusters covers the same criterion for web UIs.

4. Auth and access control

Can it connect to your cluster at all (TLS, SASL/SCRAM, OAUTHBEARER, Amazon MSK IAM), and is anything other than broker ACLs deciding what the person at the keyboard may do? The status quo is the jump host. Tom Crowley, our founding engineer, described it in 2021: a team member “must jump through the hoops of configuring the VPN, connecting to the jumpbox, and making sure they execute the right combination of bash commands against the Kafka cluster”, and “the jumpbox generally has full access to the Kafka cluster, and there is no audit log recording the actions being committed.” A TUI that reads a shared admin credential from a local file inherits that problem, and the best tools for Kafka role-based access control compares the tools that put a policy in front of the cluster instead.

5. Keyboard UX

k9s set the expectation: hotkeys for each resource, a filter on /, a help overlay, and a command palette. The test is whether you can go from a lagging group to the topic behind it to the record at the stuck offset without the mouse and without reading the manual first.

6. Annual cost, our estimate

What does a year of this tool cost, at 100 engineers across three clusters, with engineer time at $120 an hour. Maintenance and licence are priced into that answer rather than scored beside it. The figure on every card is our own estimate rather than any vendor’s quote, and it adds three lines.

The licence: $0 for every open-source TUI on this page, and $13,500 a year for three clusters of Kpow Enterprise at the published $4,500 per cluster with 100 users included.

The tool’s own upkeep, in engineer-hours a month, which is where maintenance and the client library now show up. Nearly all the commits to each open-source TUI here come from one developer, Kaskade and Yozefu included, and only Kaskade has more than 500 stars, so a project with write access and nine stars takes more reading before a release goes near production than one with a thousand. In the incidents talk I recommended the official clients or ones that wrap librdkafka “rather than one that reimplements the Kafka protocol itself”. Kaskade, karat, Yozefu, kaftui and kcat sit on librdkafka, while ktea and kafui use sarama, a Go reimplementation.

The governance an open-source TUI leaves to you, which is 12 engineer-hours a month, or $17,280 a year, for every tool here that reads broker credentials from a local file and can change something. That covers one least-privilege principal per engineer per cluster, 300 of them at this size, issued, rotated and revoked, and a record of who changed what that an auditor will accept. A read-only tool carries 5 engineer-hours a month instead, because a read-only principal still has to be issued and nothing needs accounting for afterwards.

Two results are worth stating plainly. At six engineers the same sum favours the free tools, because the governance line grows with headcount and a licence does not. And the two cheapest figures on this page, Yozefu at about $11,520 and kaftui at about $12,960, belong to the tools that cannot change anything, so they buy record viewing rather than cluster operations. The score follows the figure mechanically, 10 below $12,500 and one point lower for each $2,500 band above that.

Kafka TUIs compared

The table scores each option on the criteria above, in the same order. Stars and last-commit dates are from the GitHub API on 22 September 2026.

Rank	Tool	What you can see	What you can change	Multi-cluster	Auth	Keyboard UX	Maintenance, licence and annual cost	Source
1	Kpow terminal UI (fh tui)	Brokers (disk, config, KRaft, ACL), topics, Data Inspect queries, Signals, Kafka Connect, consumer groups. Flink jobs with Factor Platform	Offset reset shown in the demo. No message produce yet	Named contexts per Kpow deployment, and cluster and tenant switching	OIDC sign-in with Kpow RBAC and tenancy on Enterprise. Community Edition connects unauthenticated	Number hotkeys per section, N and P for sub-tabs, I for Data Inspect, six themes	fh 0.7.0 released 22 September 2026. Commercial, Community Edition free for 3 clusters and 10 users. About $16,380/yr all in on our estimate	Factor House demo, GitHub: factorhouse/homebrew-tap
2	kafui	Cluster dashboard, brokers with log dirs, configs and metrics, topics with out-of-sync replicas, messages, groups with lag, Schema Registry, Connect, ksqlDB, ACLs and quotas	Produce, topic, offset, connector, ACL and schema actions, all behind confirmation. --read-only per cluster and a JSONL audit log	Multi-cluster overview with health status	SASL and TLS from kaf’s config file. Permission profiles are enforced locally by the tool	k9s-inspired, command palette, help overlay, row action menu	Active but small: 20 stars, last commit August 2026, Apache-2.0. About $24,480/yr on our estimate	GitHub: Benny93/kafui
3	karat	Clusters, topics, active producers and transactions, groups, Schema Registry, Connect, and a kcat-style consumer with Avro	Topics, configs, partitions, groups and connectors, under read-only, confirm or yolo mode, with a diff before edits	Several clusters, switched while running	librdkafka properties for SASL and SSL. Its franz-go views support PLAIN and SCRAM only	? key reference, bindings always in a bottom bar, action menu per row	Very new: 9 stars, last commit September 2026, MIT. About $25,920/yr on our estimate	GitHub: uraniumdawn/karat
4	Kaskade	Topics, partitions, replicas and ISR totals, groups, members and lag. Records decoded as JSON, Avro or Protobuf with Confluent or Apicurio registries, filtered by key, value, header or partition	Create, edit and delete topics	One cluster per session, from an INI profile file	TLS, SASL, Confluent Cloud and Amazon MSK IAM	Vim and arrow keys with k9s conventions, command palette, custom keybindings	Active, 1,039 stars, last commit 21 September 2026, MIT. About $21,600/yr on our estimate	GitHub: sauljabin/kaskade
5	ktea	Topics with partition and offset details, consumption with search (text, JSON, Avro), groups with members and offsets, lag, Schema Registry, Connect	Create, delete and modify topics, register schemas, update Connect clusters. No confirmation or read-only mode stated	Several clusters, configured and switched inside the TUI, each with its own colour	None or SASL PLAIN, plus TLS	Vi-style navigation, pitched at k9s users	Active, 441 stars, last commit August 2026, Apache-2.0. About $24,480/yr on our estimate	GitHub: jonas-grgt/ktea
6	Yozefu	Records only, with an SQL-inspired query language across topics and WebAssembly filters	Nothing. Consume only, with enable.auto.commit false	Several clusters, each with its own consumer properties	Whatever the consumer properties carry	Keyboard TUI, plus a --headless mode for scripts	347 stars, last commit August 2026, Apache-2.0. Tested on macOS only per its README. About $11,520/yr on our estimate	GitHub: MAIF/yozefu
7	kaftui	Records and headers, topics with config and partitions, schema browser, throughput stats	Nothing written to Kafka	Named profiles	A consumer properties file	Filter with /, pause and resume, themes	21 stars, last commit August 2026, MIT, install from source. About $12,960/yr on our estimate	GitHub: dustin10/kaftui
8	No TUI: bundled scripts and kcat	Everything, one command at a time: kafka-topics.sh --describe --under-replicated-partitions, kafka-consumer-groups.sh --describe, configs, quorum state, and kcat for messages and Avro	The full admin surface. Offset reset prints a dry run unless you add --execute, nothing else asks first	One properties file and --bootstrap-server per cluster, repeated on every command	TLS, SASL and OAUTHBEARER through client properties. Kafka ACLs are the only control	Not interactive. Shell history and watch	Scripts ship with every release (Apache-2.0). kcat’s last commit was November 2022. About $28,800/yr on our estimate	Apache Kafka docs, GitHub: edenhill/kcat, Kafka CLI commands
9	kafka2i	Brokers, groups, topics and partitions metadata, and plain-text messages per partition	Nothing. Producer mode is not yet supported and admin mode is not planned	One bootstrap per launch	SSL, SASL PLAIN and OAUTHBEARER flags	Left and right keys step through offsets	3 stars, last commit June 2026, Apache-2.0. Not scored, so not costed	GitHub: coding-yogi/kafka2i
10	ktui	Topics, topic config, live tail of the selected topic	Nothing	Connects to localhost:9092, no other connection option documented	None documented	Arrow keys, / filter, b back, T topics	4 stars, last commit August 2025, no licence file. Not scored, so not costed	GitHub: shaneikennedy/ktui
11	kcli	Topics, partitions and messages, with search	Nothing, read-only by design	One address list per launch	TLS through environment variables	h toggles help	Stale: last commit January 2020, MIT. Not scored, so not costed	GitHub: cswank/kcli

Rank 1 to 8 is the order of the scored cards below: the Kpow terminal UI first because it is our product, then every other option by total, highest first. Ranks 9 to 11 are the three tools this page names but does not score, placed on what their own cells say: kafka2i shows the most and authenticates, ktui connects only to localhost:9092, and kcli has had no commit since January 2020.

Newer projects I found but did not score, because each has fewer than ten stars and little history: readpanda, kitz for Amazon MSK with IAM, kafe and kplay, a deliberate on-demand message viewer.

How the options score

On what you can see, kafui states the widest surface and Kpow’s terminal UI is close behind. Kpow’s Data Inspect queries run on the Kpow server rather than pulling every record into your terminal, and none of the open-source READMEs describes anything like Signals, Kpow’s automated operational findings. For messages alone, Yozefu’s query language is the strongest free option.

On safe change, kafui and karat lead. Both confirm every destructive action, karat shows a diff before an edit, and kafui adds a read-only switch and an audit log. The Kpow TUI scores lower here, not because Kpow lacks guardrails in the web UI, but because the demo only shows offset reset in the terminal, and I will not score features the demo did not show.

On auth and access control, the Kpow terminal UI is the only option where something other than broker ACLs decides what a user can do, because the same RBAC and tenancy rules govern it as govern the web UI. Among the open-source tools, Kaskade’s documented auth is broadest, and ktea’s SASL PLAIN limit is the biggest single gap.

On maintenance, Kaskade is the clear leader. Most of the rest are one-person projects, which is fine for a read-only viewer and a real risk for a tool with write access to production, and that difference is now priced rather than scored on its own: a nine-star project with write access carries more engineer-hours a month in the cost model than a thousand-star one.

On annual cost, the Kpow terminal UI is the lowest of the options that can change a cluster and satisfy an auditor, at about $16,380 a year on our estimate against about $21,600 for Kaskade and about $24,480 for kafui, because the per-engineer broker principals and the hand-kept record of who changed what are already in the deployment. The two lower figures on the page, Yozefu at about $11,520 and kaftui at about $12,960, belong to tools that cannot change anything. Teams weighing this against a browser will find the same jobs scored in the best Kafka management tools, and the no-licence options on their own in the best free Kafka UI tools.

Totals: the Kpow terminal UI 48, kafui 46, karat 43, Kaskade 39, ktea 36, Yozefu 35, kaftui 33 and the no-TUI baseline 27, out of 60. The option cards below list Kpow first because it is ours, then the rest in order of total. No total has been adjusted to put it there.

1. Kpow terminal UI (fh tui)

The Kpow terminal UI tops the rubric at 48 out of 60, two points clear of kafui, and it is the only option here where something other than broker ACLs decides what the person at the keyboard may do. The section on how Factor House approaches the terminal UI, further down this page, covers the release, the keys and the current limits.

2. kafui

kafui scores 46 out of 60, second on total. It copies k9s most closely of the three modal tools on this page, with a resource list, a key per resource, a filter on /, and actions on the selected row, and it goes furthest on both features and guardrails: its command palette lists every destination and shows actions your permissions do not allow as disabled, with the reason. It is a young project, at 20 stars.

3. karat

karat scores 43 out of 60 and has the most careful confirmation design I read: uppercase Y to confirm, a mode badge on screen, and a consumer that reads under its own ephemeral group id so browsing a topic cannot move anyone’s offsets. It is the newest project here, at 9 stars.

4. Kaskade

Kaskade splits the job into two commands. kaskade admin -b <bootstrap> opens topics, partitions, groups and lag, and kaskade consumer -b <bootstrap> -t <topic> opens a record view that decodes Avro and Protobuf through a registry. It is the most actively maintained TUI on this page and the one with the broadest auth, including Amazon MSK IAM, and its 39 out of 60 rests on that auth score and on keyboard handling that follows k9s conventions.

5. ktea

ktea scores 36 out of 60 and has the most polished first run, because you add and switch clusters from inside the TUI, and it colours each cluster so production looks different. At 441 stars it is the second most starred TUI on this page, after Kaskade.

6. Yozefu

Yozefu does one thing, reading records, and does it with an SQL-inspired query language:

yozf --cluster localhost --headless --topics "orders" --format "json" \
  'from begin value.status == "FAILED" limit 10' | jq '.key'

It scores 35 out of 60 and carries the lowest annual figure on this page, about $11,520 on our estimate, which is what a tool that cannot change anything costs. It cannot produce, cannot manage the cluster and does not commit offsets, which is exactly why it is a reasonable tool to give to someone who needs to find records in production and nothing else. For searching messages across a cluster rather than one terminal session, the best tools to search messages across Kafka topics compares the wider field.

7. kaftui

kaftui scores 33 out of 60, which is what a read-only record viewer scores against tools that manage a cluster, and about $12,960 a year on our estimate, second lowest here for the same reason. It earns its place if Avro, JSON Schema or Protobuf decoding is the hard part of your day.

8. No TUI: bundled scripts and kcat

The baseline for this page is no TUI at all, and it is last on the rubric at 27 out of 60: a 7 on both what you can see and what you can change, a 1 on keyboard UX, and the highest annual figure on the page at about $28,800 on our estimate, because nothing it prints is machine readable. It is worth keeping in view precisely because there is nothing to approve, install or deploy.

How Factor House approaches the terminal UI

Kpow’s terminal UI ships inside fh, Factor House’s command-line tool, released as version 0.7.0 on 22 September 2026. When I demoed it I said “we think platform engineers are going to love this”, and the reason is that it is Kpow rather than a separate tool. In the Kpow CLI, terminal UI and agentic skills demo I walk through brokers (disk, config, KRaft and ACL views), topics, a Data Inspect query that filters on value.destination, Signals, Kafka Connect with its failing connectors, and consumer groups with offset reset. The keys are hotkeys: “I can hit the number 3 to check out our topics, then navigate through the subtabs using N and P”, and I on a topic opens Data Inspect with “all the features of Data Inspect running from the terminal”. The Data Inspect documentation covers what those queries can do, and the kJQ manual covers the query language.

What separates it from the open-source tools is the access model. From the demo: “your CLI users, terminal UI users, and agentic users all get the same control and governance in place”. fh auth login signs in through your OpenID provider, and the rules in Kpow’s role-based access control apply to what the terminal can do. On SSO deployments, fh auth ws-login captures a browser session cookie for the terminal UI’s WebSocket connection. RBAC, multi-tenancy and audit logging are Kpow Enterprise features. Community Edition, free for up to 3 clusters and 10 users, connects without authentication.

brew install factorhouse/tap/fh
fh config configure
fh auth login
fh tui

What it does not do: produce messages, because the CLI does not support data production or consumption yet and Data Inspect is read-only. Flink job views come with Factor Platform, not Kpow alone, and the MirrorMaker 2 replication metrics I showed are still in progress. The Homebrew cask in the Factor House tap installs it on macOS and Linux, and the same release publishes a Windows build. The command-line side of fh is compared with kcat, kcl and kafkactl in the best Kafka CLI tools.

Kpow live demo

Watch the Kpow terminal UI run against a live cluster

See brokers, topics, a Data Inspect query, Kafka Connect and consumer groups driven from the keyboard, under the same SSO and RBAC as the web UI.

Built for platform and data engineers running Kafka in production.

Watch the demo→

Which one to choose

For read-only consumption, pick Yozefu if you need to search records by field value, and Kaskade’s consumer mode or kaftui if the hard part is Avro or Protobuf decoding. For full admin from one person’s laptop, kafui has the widest feature set and the best guardrails, and karat is the one to watch. If your cluster needs Amazon MSK IAM, Kaskade is the only scored open-source option that documents it.

If Schema Registry support is the deciding factor, Kaskade, kafui, ktea, karat and kaftui all decode Avro with a registry, Yozefu’s Avro support is experimental, and the scripts need kcat built with Avro support. For managing the registry itself rather than decoding against it, see the best tools for Kafka schema registry management.

If the terminal has to follow the same access rules as your web UI, because more than one team shares the cluster or because someone will ask for the audit log, the open-source TUIs cannot do it, since each one holds its own broker credential. That is the case for the Kpow terminal UI, and it only makes sense if you already run Kpow or plan to. Consumer offset changes in particular deserve that control. The best tools to reset Kafka consumer group offsets compares that job on its own rubric.

FAQ

Is there a k9s for Kafka?

Several. ktea describes itself as the tool k9s users will like, kafui is “a k9s inspired terminal ui”, and Kaskade follows k9s key conventions. None is k9s itself, which manages Kubernetes rather than Kafka, and none has k9s’s user base yet.

Can a Kafka TUI read Avro messages?

Yes. Kaskade, kafui, ktea, karat and kaftui decode Avro through a Schema Registry, and Kaskade and kaftui also handle Protobuf. Yozefu’s Avro support is marked experimental, and kafka2i and ktui show plain text only.

TUI or web UI for Kafka?

A TUI is lighter and works over SSH, so it suits one engineer with a terminal and a credential. A web UI suits a team, because access control, masking and audit can sit on the server instead of on each laptop. The Kpow terminal UI sits in between: a terminal client in front of the Kpow server’s access rules.

Related reading

• Kafka: the complete guide
• How to inspect Kafka topics, messages and consumer groups from the terminal
• Kafka UI: the ultimate guide
• Kafka offsets
• Kafka brokers in production
• Best Kafka CLI tools