Free Developer Tool
Keycloak Realm Export Checker
Pick the JSON file of a realm export and get its security and configuration findings, most severe first, each with the setting, why it matters and what to change.
The JSON file Keycloak exported for one realm. It is read in your browser and never leaves it.
Results
Nothing to report for this realm.
What the checker looks at
Each check reads one part of the realm settings. The admin console's Partial export masks secrets; a kc.sh export writes them in clear, which the checker reports.
- No password policy
- The password policy allows short passwords
- Brute force detection is off
- SSL required is not set to external or all
- OTP and MFA are not required at sign-in
- A client secret is in the file
- The SMTP password is in the file
- An LDAP bind password is in the file
- The export uses deprecated realm fields
- The User Profile Enabled switch is gone
- The X-XSS-Protection header is removed