STaurtomation/docs/research/reports/kestra-windmill-activepieces-comparison.md

Ported from earlier research (2026-10-29) and sanitized for clean-room use: source-code-derived details removed. Not legal advice.

Three challengers still keep n8n's paywall

None of the three tools gets you n8n's gated feature set for free. Kestra, Windmill and Activepieces are all open-core, and all three charge for most of the same governance features n8n charges for: audit logs, external secrets managers, log streaming and managed environment promotion are paid in every one of them. They do differ in which gates they open. Windmill Community Edition is the most generous on people. It gives you up to 50 users, 4 groups, folders, default roles, 3 workspaces and SSO for 10 users at no cost, which n8n Community cannot match. Its catch is that job retention is capped at 30 days and Git sync at 2 users. Kestra's Apache-2.0 edition is the most generous on GitOps and scaling. Git sync, purge-based retention and distributed clustering are free, but it allows only one shared Basic Auth login, so it suits a solo operator or a CI pipeline, not a team. Activepieces' MIT Community Edition frees almost nothing on the list beyond retention and horizontal workers. SSO starts on the $200/month Team plan, and Git, environments, audit and secrets sit in a custom-priced Ultimate tier. What it offers instead is the most permissive core license and the most n8n-like no-code experience. The licenses matter as much as the features. Kestra (Apache-2.0) and the Activepieces core (MIT) allow commercial hosting and embedding that n8n's Sustainable Use License forbids. Windmill's official images forbid offering the product as a managed service. No tool has an n8n importer, so every migration is a rewrite. The practical choice comes down to who builds your automations: business users (stay on n8n or try Activepieces), developers (Windmill), or data and platform engineers (Kestra).

Per-tool detail lives in the research notes: Kestra, Windmill, Activepieces. The n8n baseline is covered in n8n gated features reimplementation, with supporting notes on licensing and feature feasibility.

The scorecard: where each tool's free tier beats or trails n8n Community

The table compares self-hosted free editions as of late October 2026: Kestra 2.0.8, Windmill v1.853, Activepieces v0.92 and n8n 2.46. Sources are cited in the sections that follow. "Paid" means the feature requires a commercial plan.

Dimension	n8n Community (baseline)	Kestra OSS	Windmill CE	Activepieces CE
SSO	Paid (Business €667/mo+)	Paid (EE: OIDC, LDAP, SCIM; SAML unconfirmed)	Free for 10 SSO users; SAML, SCIM and custom OIDC paid	Paid (Team $200/mo; SCIM on Ultimate)
Multi-user / RBAC	Owner plus members; no sharing, admin, editor or viewer roles	One shared Basic Auth account; RBAC paid	50 users, 4 groups, folders, default roles free; custom roles and service accounts paid	Standard roles from Team; custom roles on Ultimate
Shared projects / workspaces	Paid (projects are a Business+ feature)	Namespaces free, but useless with one login; multi-tenancy paid	3 workspaces free (dev workspaces and forks count toward the 3)	Team collaboration is a paid-plan feature
Log streaming	Paid (Enterprise)	Paid (EE Log Shipper, CEF syslog)	Paid (OTel, Prometheus, S3 service logs)	Paid (Ultimate "event streaming")
Execution data retention	Free, configurable via env vars	Free via scheduled Purge flows	Capped at 30 days or less; unlimited is paid	Free, configurable (default 30 days)
Multiple environments	Paid (Business+)	DIY with namespaces and Git; Promote is paid	Deploy-to-prod UI paid	Paid (Ultimate releases)
Git version control	Paid (Business+)	Free (Git sync and push tasks, namespace sync)	Free for up to 2 users	Paid (Ultimate)
External secrets	Paid (Enterprise)	Paid (11 backends in EE)	Paid (Vault, Azure KV, AWS SM)	Paid (Ultimate)
Audit logs	Paid (Enterprise)	Paid	Paid	Paid
HA / scaling	Queue mode free; multi-main paid	Distributed cluster free; worker groups paid	Server and worker replicas free; autoscaling paid	Stateless workers, Redis Sentinel free
License	Sustainable Use License + proprietary enterprise code (not OSI)	Apache-2.0 core + closed EE plugins	AGPLv3 source + proprietary code in official images	MIT core + proprietary enterprise-licensed portions
Paid entry point	Business €667/mo (annual)	Per-instance, sales-quoted	From $120/mo; $20 per builder seat, ~$50 per compute unit	Team $200/mo flat (25 users); Ultimate custom
Product model	Free-form node canvas	YAML-first declarative flows, form editor	Code-first scripts and flows in 10+ languages	Linear step builder, Zapier-like
Integrations	1,600+ nodes	2,400+ plugins (data and infrastructure heavy)	50+ resource types + Hub + any npm/PyPI package	Large SaaS "pieces" catalog (check vendor's current count)
Minimal ops stack	Node.js + SQLite/Postgres (Redis for queue mode)	JVM + Postgres	Rust + Postgres only (no Redis)	Node.js + Postgres + Redis
GitHub stars	~185k (older snapshot)	30.1k	18.3k	25.3k
n8n importer	n/a	None	None ("a rewrite, not a conversion")	None

n8n Community is less locked down than its gating suggests

n8n's own documentation lists what self-hosted Community excludes: custom variables, environments, external secrets, external binary storage, log streaming, multi-main mode, projects, SSO (SAML, LDAP), workflow and credential sharing, and Git version control (n8n CE features). Two items on your list are already free. Execution pruning is configurable on self-hosted CE through EXECUTIONS_DATA_PRUNE and EXECUTIONS_DATA_MAX_AGE (n8n executions env vars). Queue mode with workers is also free. The cheapest self-hosted plan with SSO and Git is Business at €667/month billed annually, with 6 shared projects. Log streaming, external secrets and audit logging appear only under the sales-priced Enterprise plan (n8n pricing). Measured against that baseline, each alternative trades some gates for others rather than removing them.

Open-core everywhere: the difference is which gate, and what the license lets you do

Kestra frees the pipeline but locks the door

Kestra's core repository is Apache-2.0. Enterprise features ship as separate proprietary plugins, and the research found no license change in its history (GitHub kestra-io/kestra). In the open-source edition, Git version control runs as ordinary Kestra flows. The documented SyncFlows, PushFlows, SyncNamespaceFiles and bidirectional NamespaceSync tasks can be triggered by a schedule or a webhook (Kestra Git docs). Retention also runs as flows: scheduled PurgeExecutions, PurgeLogs and PurgeKV tasks take date cutoffs and state filters (Kestra purge guide). OSS can run as a distributed cluster with separate components (Kestra OSS vs paid). The weak point is identity. The open-source edition has "one shared Basic Authentication account." SSO through OIDC or LDAP, SCIM, RBAC, multi-tenancy, audit logs, log shippers, external secrets managers (11 backends, from Vault to Bitwarden) and worker groups are all Enterprise-only (Kestra OSS vs paid; Kestra secrets manager). Kestra 2.0 made the paid tier more attractive. It added 159 per-action RBAC permissions with five role presets, and a Git-free Promote feature for moving flows between environments with diffs and drift status (Kestra 2.0 release). It also moved dashboards from OSS into EE, which shows that features can migrate behind the paywall between major versions. Enterprise is priced per instance with unlimited flows and executions, but no price is published (Kestra pricing). On user management, then, Kestra OSS is stricter than n8n Community, which at least gives each person their own login. On Git and scaling it is more generous.

Windmill frees the team but caps the history

Windmill's license is the most complicated of the three. Per its LICENSE file, the backend and frontend source is AGPLv3, and the clients and OpenFlow spec are Apache-2.0, while enterprise-only code is proprietary. The official "Community Edition" Docker images include "proprietary and non-public code." Anyone may use them free, but may not "sell, resell, serve as a managed service, modify or wrap" them without an agreement (Windmill repository, LICENSE file). The proprietary carve-out was added in September 2023. The binary terms were spelled out in March 2025, and white-labeling and embedding restrictions moved into the LICENSE file on 25 October 2026 (LICENSE history). The vendor calls Windmill "AGPLv3 (true OSS)" (windmill.dev/compare/n8n). That is accurate only for a binary you build yourself without the enterprise features. The images most self-hosters actually run behave like freeware on an AGPL core. Internal use, the n8n-replacement case, needs no commercial license.

In return, Windmill CE gives you far more collaboration than any other free tier here. The published CE limits are 50 users, 4 groups, 3 workspaces, 10 SSO users, Git sync for up to 2 users, job retention of 30 days or less, 100 email triggers per day and 10 GiB of object storage. SAML, SCIM, custom OIDC, service accounts, audit logs, external secret backends, the staging-to-prod deploy UI, Prometheus and OpenTelemetry, autoscaling, and Kafka, NATS and SQS triggers are all Enterprise (Windmill pricing). Server and worker replicas run in CE because Postgres holds all state, and autoscaling is the gated part (Windmill self-host docs). The research team inferred that HA is ungated from these docs, but no explicit statement confirms it. Windmill is also the only one of the four vendors with transparent paid pricing. Enterprise starts at $120/month, priced at $20 per builder seat, $10 per non-builder, and about $50 per compute unit (2 worker-GB-month). There is a 40% discount for nonprofits, and a Pro variant for businesses under 10 employees and $250k revenue (Windmill pricing). By the research team's estimate from that formula, five builders and four 2 GB workers come to roughly $300/month at list price, under half of n8n Business. The trade-off runs the other way on retention. Windmill CE caps job history at 30 days, where n8n CE lets you keep executions as long as you like.

Activepieces frees the license but almost nothing else

Activepieces is MIT-licensed except for designated enterprise portions, which fall under an Enterprise license that requires a paid subscription for production use; per the LICENSE file, the split has been stable since February 2023 (Activepieces repository, LICENSE file). The vendor's "fully open source under the MIT license" claim (Activepieces blog) leaves out those portions. Per the pricing page, SSO, roles, audit logs, secret managers, SCIM, environments/releases and event streaming are all paid-plan features; Community Edition is aimed at individual or small-scale self-hosted use. Two things are genuinely free. Retention is configurable via AP_EXECUTION_DATA_RETENTION_DAYS (documented in the Activepieces self-hosting docs). Stateless workers scale horizontally, with jobs from crashed workers requeued and Redis Sentinel supported (same docs).

The paid ladder starts with Plus at $20/month and Team at $200/month flat for 25 users with SSO and standard roles. Ultimate is custom-priced and adds SCIM, custom roles, "releases and Git Sync, audit logs and secrets", and event streaming. Embed starts at $36k/year (Activepieces pricing). Plus and Team can be bought in-app on a self-hosted instance. There is a trap, though: per the Docker Compose install docs, an instance started without AP_EDITION=ee "will not be able to activate a license key later" (Activepieces docs), and the one-click marketplace installs all deploy Community. Against the n8n baseline, Activepieces makes Git and environments harder to reach, since they need a custom Ultimate quote where n8n puts them in Business.

The license is the real differentiator for anyone who hosts for others

n8n's SUL limits use to "your own internal business purposes" and allows distribution only "free of charge for non-commercial purposes" (n8n repository, LICENSE.md). For an internal team replacing n8n, all four licenses are workable. For an agency, MSP or SaaS builder, the differences are large. Kestra's Apache-2.0 edition is the only one whose complete free product can be hosted for clients without conditions. The Activepieces MIT core is similarly free, but its embedding SDK and white-labeling are paid. Windmill's official images forbid managed-service use, which puts it in practice closer to n8n's restrictions than its "true OSS" marketing suggests. See n8n licensing and legal notes for the full SUL analysis.

Three different products, and none of them is a drop-in n8n

Paradigm decides the audience

These tools are not three versions of n8n. They are three different answers to the question of who builds the automation. Kestra describes itself as an event-driven platform for data, AI and infrastructure workflows declared in YAML. A form-based no-code editor, the YAML editor and an AI Copilot all edit the same flow (GitHub kestra-io/kestra; Kestra 2.0 release). Third-party comparisons say business and app-centric automation is "usually easier in n8n" (ZoomInfo comparison). Windmill turns scripts in "TypeScript, Python, Go, PHP, Bash, C#, SQL, Rust, Ruby and R, or any Docker image" into endpoints, flows, UIs and cron jobs (Windmill docs). Its own comparison page concedes that n8n is "the fastest path when the automation is a chain of mainstream SaaS calls" (windmill.dev/compare/n8n). Activepieces is a linear, step-based builder that the vendor positions as easier than n8n's node-based canvas (Activepieces blog). It sits closer to Zapier than to n8n. Its flows are linear, with branches and loops, rather than arbitrary graphs, so complex n8n workflows with merges have no direct equivalent.

Integration counts are not comparable, and only one is close to n8n's catalog

Kestra advertises 2,400+ plugins (Kestra plugins), up from "more than 1,200" in a March 2026 press article (The Next Web). That number most likely counts individual tasks rather than services, and the catalog leans toward databases, warehouses, dbt and cloud infrastructure rather than CRM and marketing apps. Windmill offers only "50+ pre-built resource types" plus a community Hub, and relies on importing any npm or PyPI package. It counts n8n at "1,600+ pre-built nodes" (windmill.dev/compare/n8n). Activepieces markets a large, largely community-contributed catalog of SaaS integrations ("pieces"); check the vendor's site for the current count. It is the only alternative whose SaaS catalog approaches n8n's. Its pieces are distributed as TypeScript npm packages, which the vendor positions as easy to write. All three ship AI agent steps and MCP support. Kestra exposes flows as MCP tools in OSS, Windmill supports a long list of bring-your-own-key providers including Ollama (Windmill AI docs), and Activepieces advertises MCP support. AI is therefore not a reason to pick one over another.

Every migration is a manual rewrite

No tool imports n8n workflow JSON. Windmill says so directly: "Porting is a rewrite, not a conversion" (windmill.dev/compare/n8n). Kestra publishes a migration guide for Pipedream but none for n8n (Kestra Pipedream migration). Activepieces documents no n8n importer. The cost depends on what your n8n workflows contain. Code and HTTP Request nodes port almost one-to-one into Windmill scripts, Kestra script tasks or Activepieces code steps. Workflows built from many SaaS app nodes cost most to move to Windmill and Kestra, because each node becomes SDK code or an HTTP call. They cost least to move to Activepieces, which has matching pieces. Branch-and-merge graphs that rely on n8n's per-item execution model are hard to port to all three. The only documented migration is CFA Institute's SRE team, which moved fully off n8n to Windmill in early 2025 after a year of evaluation. They left to get "real programming capabilities and Git workflows" and needed "only brief training sessions" (CFA Institute case study). That is a vendor-published case study with no effort figures. One consultant's anecdote put a Windmill rollout, including SSO, at 9 days against 3 for n8n, and the author flagged the small sample (automationatlas.io). Credentials never migrate cleanly from any of them, because n8n's documented workflow export leaves credential secrets encrypted with the instance's own key (n8n CLI commands), so every connection has to be re-created in the new tool.

Ops footprint and community health favor different winners

Windmill runs leanest, Activepieces sizes heaviest per flow

Windmill needs only PostgreSQL, which holds both state and the job queue, with no Redis. Its Rust server and workers are stateless. The guideline is "1 worker per 1vCPU and 1-2 GB of RAM", and Compose also brings up an LSP container, native workers and Caddy (Windmill self-host docs). Kestra 2.0 simplified its architecture considerably. A single Postgres instance can serve as both queue and repository, the Kafka Streams engine is gone, and workers connect outbound over gRPC with no database access (Kestra 2.0 release). The JVM means a heavier baseline than lightweight schedulers (aitoolsatlas), and no official RAM minimum is published. Activepieces needs Postgres plus Redis. It offers a single-container PGLite "hobby" mode, but that mode "cannot scale, cannot move to Enterprise." Production guidance is one worker (0.5 vCPU, 1 GB) per concurrent flow, so 50 concurrent flows need 50 workers totalling 25 vCPU and 50 GB (production-setup and Docker pages of the Activepieces docs). For a small team, all three fit on a single modest VM, much like n8n with Postgres. The differences only matter at scale.

All three are active; only Kestra is well funded

Kestra has 30.1k stars, weekly patch releases on two maintained lines, 2.0 as a one-year LTS, and a $25M Series A in March 2026 (about $36M raised in total) (GitHub releases; The Next Web). Activepieces has 25.3k stars and 357 contributors, but is still on pre-1.0 versioning at v0.92 (GitHub; contributors API). Its funding figures conflict, ranging from a $0.5M convertible note to $6.4M depending on the source (CB Insights; startups.fm). Windmill has 18.3k stars, about 172 contributors and 30 releases in the 20 days before 29 October 2026 (GitHub releases). It comes from a YC S22 company that YC lists with 7 people and a sole founder (YC). Its funding data is likewise sparse and conflicting. All three are an order of magnitude smaller than n8n, which an older snapshot put at roughly 184.8k stars (openalternative.co). Expect fewer community templates, forum answers and tutorials than n8n users are used to.

Known criticisms cluster around churn, gating and audience fit

Independent criticism of all three is thin. The research found no substantive Reddit threads and had to rely on review aggregators, which are of uneven quality. Kestra's recurring complaints are that the Enterprise price is unpublished and "requires a sales conversation for RBAC/audit features", the JVM footprint, and the YAML learning curve (aitoolsatlas). Its 2.0 upgrade also breaks a lot: you must reach 1.3.x first, ForEach and pluginDefaults are removed, and the password rehash cannot be rolled back (Kestra 2.0 migration guide). Windmill is criticized as developer-only with a steeper learning curve, and for needing per-language worker pools (automationatlas.io). Its positioning is muddled, and the founder himself admitted that "our positioning is not very clear" (HN via brianlovin.com). It also creates upgrade friction, for example by blocking startup on Postgres 16 data volumes now that the default is Postgres 18 (Windmill self-host docs). Activepieces' own docs carry the sharpest warnings. Code steps run unsandboxed by default in CE, and the default worker concurrency "widens the OOM blast radius" (workers page of the Activepieces docs). Reviewers add that Kubernetes and enterprise SSO documentation is sparse (noviqip), and that n8n is more flexible for code-heavy users (G2). One review claims Activepieces lacks flow versioning and subflows; treat that claim as unverified and check current product docs.

Match the tool to the person who builds the automations

Business users and no-code builders on a SaaS-heavy stack should stay on n8n Community. Use the external tooling from the n8n gated features analysis (CI-driven Git export, a forward-auth proxy, log shipping) rather than switching. No alternative gives this group a better free governance story. Activepieces is the only one with a comparable no-code experience and SaaS catalog, and its Community Edition is weaker than n8n's on collaboration. Activepieces becomes the right pick for one subgroup: agencies, MSPs and SaaS builders who need to host or build on a permissively licensed core, which n8n's SUL forbids. Even then, budget $200/month for SSO and an Ultimate quote for Git and audit. Start with AP_EDITION=ee from day one so you keep the upgrade path open.

Developer-led teams of up to about 50 people who want real multi-user access, RBAC and some SSO for free should choose Windmill. It is the only option on this list where a team gets individual accounts, groups, folders and 10 SSO users at no cost. It also has the cheapest transparent paid path, from $120/month, if you need audit logs, unlimited retention or external secrets later. The price is a rewrite of every SaaS node into code, a 30-day retention ceiling on CE, and frequent upgrades. Avoid it if you plan to offer it to clients as a managed service.

Data, platform and infrastructure engineers who manage everything through Git and CI should choose Kestra OSS, especially when one operator or a pipeline is the only "user". Free Git sync, free purge-based retention, free clustering and Apache-2.0 licensing make it the cleanest free option for GitOps-style orchestration. Its funding and LTS policy make it the lowest abandonment risk. Once more than one person needs their own login, Kestra means buying Enterprise at an unpublished per-instance price.

Teams that need SSO, audit logs, external secrets and log streaming together have no free option among these four. The decision is about price. Windmill publishes rates starting at $120/month. n8n Business costs €667/month and reserves several of those features for Enterprise. Kestra Enterprise and Activepieces Ultimate are both sales-quoted.

Conclusion

The question "which alternative escapes n8n's paywall?" has a dull answer: none of them does. Every open-core vendor here has reached the same conclusion as n8n about which features enterprises pay for, and audit logs, external secrets and log streaming are paid without exception. The useful question is which single gate hurts you most. If it is people (accounts, groups, SSO), Windmill removes it. If it is GitOps and scale, Kestra removes it. If it is the license itself, meaning the right to host or embed commercially, Kestra and the Activepieces core remove it. Retention is not a reason to switch at all: n8n already frees it, and Windmill makes it worse.

That reframes the build-or-buy analysis from the n8n gated features research. The external-tooling approach to n8n remains competitive because the alternatives charge for nearly the same set of features. A switch only pays off when it fits your builders' paradigm, not when it saves on licensing. The trend also points against waiting for things to loosen. Kestra moved dashboards into EE in 2.0 and Windmill tightened its binary and white-label terms in 2025 and again in October 2026. Pick a tool whose free tier fits your needs today, and assume its gates will only get stricter.