Open WebUI vs LibreChat vs Onyx: which fits your rollout
Choose Open WebUI when your staff need a shared chat workspace and your team wants to run models locally or stay offline. It is built around Ollama and OpenAI-compatible APIs, and its official install paths include Docker, Kubernetes with Helm and pip. Its licensing is the deciding factor at scale. Since v0.6.6, the Open WebUI License forbids altering or removing branding in deployments above 50 users in any rolling 30-day period unless you hold an enterprise license or written permission from the copyright holder. Count your likely end users before you pick a version, and ask the vendor how seat counts are measured for your organization. If you expect to rebrand the interface for staff, plan that cost into the enterprise conversation from the start.
Choose LibreChat when you want an MIT-licensed chat front end across many cloud providers and custom endpoints, and your team is comfortable operating MongoDB and Meilisearch. Its reference stack adds a separate RAG API service, so the number of moving parts is larger than a single chat container. ClickHouse acquired the project and has said existing deployments continue unchanged, but confirm the current release status and support path with the maintainers before you commit, since the latest tagged release at the time of writing is a pre-release. LibreChat fits teams whose main requirement is provider choice and an MIT license without branding conditions.
Choose Onyx when the central need is answers grounded in company knowledge, with each user seeing only documents they already have access to in the source application. Its connectors cover sources such as SharePoint, Confluence, Jira and Slack, and it syncs source permissions. That capability is what separates it from the two chat front ends, and it brings a heavier footprint: Postgres, Vespa or OpenSearch, Redis and model servers. Confirm which connectors your sources need, and whether permission sync and SSO through OIDC or SAML are part of the open-source Community Edition or the Enterprise Edition for your use. If the work is only general chat, Onyx adds infrastructure you may not need.
Which scenario points to which platform
This table maps common company rollout scenarios to the platform that fits best, with the supplied facts behind each answer. Read it by matching your primary requirement to a row, then checking the reason before you shortlist. Where a row depends on a fact you have not verified, the answer is to confirm first.
| Scenario | Best fit | Why |
|---|---|---|
| Offline or air-gapped chat over local models | Open WebUI | Built to run entirely offline and connects to Ollama and OpenAI-compatible APIs. Confirm that your model runtime and any plugins work without outbound access. |
| Multi-provider chat with a broad provider list | LibreChat | Its README lists Anthropic, AWS Bedrock, OpenAI, Azure OpenAI, Google, Vertex AI, Groq, Mistral, DeepSeek and custom endpoints. Confirm each provider you need against current docs. |
| Staff questions over SharePoint or Confluence with source permissions | Onyx | Connects to SharePoint and Confluence and syncs source permissions, so answers only use documents the user can already see. Confirm the connector and permission sync for your tenant before committing. |
| Rebranding for customer-facing use | LibreChat | Its MIT license carries no branding clause. Open WebUI's License restricts altering branding above 50 users in a rolling 30-day period unless you hold an enterprise license or written permission. Confirm the terms with the copyright holder. |
| Small pilot team with limited ops capacity | Open WebUI | A single container can run with its default setup, and scaling to PostgreSQL and Redis is needed only for multiple replicas. Confirm the team's expected user count and growth before choosing. |
| Permission-aware answers across many sources | Confirm the requirement first | Onyx is the only one of the three with documented source permission sync, but coverage varies by connector and edition. Confirm which sources, which permission model and which edition (community or enterprise) you need before deciding. |
| Chat with a shared knowledge base and a self-hosted model | Open WebUI or Onyx | Open WebUI offers built-in knowledge and hybrid retrieval over many vector databases. Onyx adds connectors and permission sync, at the cost of Postgres, Vespa or OpenSearch, Redis and model servers. |
How the licenses and paid editions differ
Open WebUI changed its license partway through its history. Code merged up to and including v0.6.5 remains under BSD-3-Clause. From v0.6.6, released April 19, 2025, the code is distributed under the Open WebUI License, which adds a branding clause. That clause forbids altering or removing Open WebUI branding unless one of three conditions applies: the deployment has no more than 50 end users in a rolling 30-day period, the copyright holder gives written permission, or the licensee holds an enterprise license.
- Pre-v0.6.6 code: Versions through v0.6.5 stay under BSD-3-Clause, so a fork based on that code carries no branding restriction from the original license.
- The 50-user threshold: A company-wide rollout that exceeds 50 users in any rolling 30-day window falls outside the free branding allowance unless another condition applies.
- Enterprise license: Open WebUI offers enterprise licenses that allow white-labeling and custom branding, along with dedicated support options. Pricing is not published, so you must request a quote with an expected seat count.
- Written permission: The copyright holder can grant written permission in place of an enterprise license. Get any such permission in writing before rollout.
- Cost drivers: Seat count, branding requirements and support level determine the quote. Ask whether the quote covers future seat growth and upgrade rights.
Confirm your user count against the 30-day window with your counsel, and confirm the license version you deploy.
LibreChat is MIT licensed, which permits commercial use, modification and redistribution with a short notice requirement and no branding clause in the license itself. ClickHouse announced on November 4, 2025 that it had acquired LibreChat. ClickHouse said existing LibreChat deployments continue unchanged and that it will keep investing in the open-source project. The latest tagged GitHub release is v0.8.8, published October 1, 2026 and marked as a pre-release.
- MIT terms: The license does not restrict user count or require a paid tier to rebrand the interface, so the license cost of a company-wide rollout is zero.
- Ownership change: ClickHouse's acquisition sits behind the project. Confirm whether ClickHouse offers any commercial support, hosted service or enterprise terms, and what they cost, because none of these are part of the MIT license.
- Pre-release status: The latest tagged release is a pre-release. Decide with your platform team whether you pin a stable tag or wait for a general release.
- Dependencies: MongoDB, Meilisearch and the RAG API service are open components with their own licenses. Check each component's terms before you approve the stack.
- Your own support cost: Without a vendor support contract, the cost of upgrades, patching and incident response sits with your staff or an implementation partner.
Check the license of every bundled component, and ask ClickHouse in writing about any commercial support or roadmap commitments you plan to rely on.
Onyx is open core. Onyx Community Edition is MIT licensed and covers retrieval-augmented generation, AI chat, agents and actions. Code in directories named ee sits under the Onyx Enterprise License, and the Enterprise Edition is the self-hosted tier that lists premium features such as role-based access control. Onyx v4.9.2 was released on October 15, 2026, and the project publishes a Helm chart at version 0.9.17 as of October 16, 2026.
- Community Edition: The MIT-licensed core includes RAG, chat and agents. Confirm that the features you need are in that core and not in an ee directory.
- Enterprise features: Onyx lists SSO through Google OAuth, OIDC or SAML, SCIM user provisioning, role-based access control, usage analytics and query history auditing as enterprise features. Confirm which of these your edition includes.
- RBAC as a premium feature: The Enterprise Edition lists RBAC among its premium features, so ask for the feature matrix before you assume Community Edition meets your access model.
- Onyx Cloud: A managed option exists alongside self-hosting. A cloud subscription changes where data runs and who operates the platform, so review it separately.
- Quote scope: Ask for the written scope listing which SSO, SCIM and RBAC features are included in the license you buy.
Before approval, get the edition feature matrix and the Enterprise License terms in writing for the exact features your access model requires.
Open WebUI vs LibreChat vs Onyx feature by feature
This table compares the three assistants on license, identity, retrieval, permission sync, model providers, install methods and required services. Read each row against your own rollout: a chat front end governs who can use models, while Onyx governs what company content answers can draw on. Confirm edition-dependent cells with each vendor before you commit.
| Row | Open WebUI | LibreChat | Onyx |
|---|---|---|---|
| License | Open WebUI License since v0.6.6 (April 19, 2025), with a branding clause above 50 users in a rolling 30-day period; code through v0.6.5 is BSD-3-Clause | MIT licensed; ClickHouse acquired the project and says existing deployments continue unchanged | Community Edition is MIT licensed; code in ee directories falls under the Onyx Enterprise License |
| Primary use | Shared, offline-capable chat workspace with knowledge bases and tools | Multi-provider chat interface with agents, MCP support and a sandboxed code interpreter | Chat and agents grounded in connected company applications |
| Model providers | Ollama, OpenAI, Anthropic and any OpenAI-compatible provider from one interface | Anthropic, AWS Bedrock, OpenAI, Azure OpenAI, Google, Vertex AI, Groq, Mistral, DeepSeek and custom endpoints | Ollama, LiteLLM and vLLM for self-hosted models, plus Anthropic, OpenAI and Gemini |
| Identity: SSO and directory | OIDC and LDAP | OAuth2, LDAP and email login | Google OAuth, OIDC or SAML; confirm which are included in your edition |
| Identity: provisioning, RBAC and MFA | SCIM 2.0 user and group provisioning, role-based access control with groups and per-resource permissions, API keys and authenticator-app MFA | Admin panel for user and configuration management; confirm SCIM and MFA support in your version | SCIM user provisioning and role-based access control; RBAC is listed as an Enterprise Edition feature, so confirm the tier |
| Document retrieval and vector options | Retrieval across 13 vector databases including ChromaDB, PGVector, Qdrant, Milvus and Elasticsearch, with hybrid search and reranking | Separate RAG API service backed by Meilisearch for search; confirm retrieval options in your release | Built-in indexing with Vespa or OpenSearch as the document index, plus keyword and vector search |
| Permission sync from source systems | Not described as a core feature; access control is managed inside the platform | Not described as a core feature; access control is managed inside the platform | Connects to 50+ applications and syncs source permissions so answers only use documents the user can already see |
| Install methods | Docker and Docker Compose, Kubernetes with Helm, or pip install open-webui then open-webui serve | Docker, Kubernetes through a Helm chart, and one-click cloud options such as Railway, Zeabur and Sealos | Docker, Kubernetes, Helm or Terraform; Helm chart version 0.9.17 as of October 16, 2026 |
| Required services | SQLite for a single instance; PostgreSQL, Redis and shared file storage for multiple replicas | MongoDB, Meilisearch and a separate RAG API service in the reference compose file | Postgres, Vespa or OpenSearch, Redis and model servers; Onyx Lite drops the vector database and background workers |
How permission sync changes what the assistant can answer
The most important difference in this comparison is what each assistant is allowed to read. Open WebUI and LibreChat retrieve from content that someone uploads or attaches to a knowledge base or collection, so the access boundary is whatever the operator loaded into that store, governed by permissions set inside the chat platform. Onyx connects to more than 50 applications and syncs their permissions, so its answers only draw on documents the user can already see in the source application, such as a SharePoint site, a Confluence space or a Google Drive folder. For a company-wide rollout, the first question is whether copied documents keep the access rules of their origin. Confirm that with a pilot before you assume it.
Identity is a separate decision from retrieval. Open WebUI documents SSO through OIDC and LDAP, SCIM 2.0 user and group provisioning, role-based access control with groups and per-resource permissions, API keys and authenticator-app MFA. LibreChat documents multi-user authentication with OAuth2, LDAP and email login, plus an admin panel for users and configuration. The material available to this page does not list SCIM or SAML for LibreChat, so confirm both before you commit. Onyx lists SSO through Google OAuth, OIDC or SAML, SCIM user provisioning and role-based access control among its enterprise features, and RBAC sits in its paid Enterprise Edition. Whichever platform you choose, write down which identity provider group or SCIM group maps to which role or group in the platform, and who is allowed to change that mapping.
Test the boundary before rollout. Create two test users in different identity groups, one with access to a restricted SharePoint site and one without, then ask each the same question that the restricted document answers. Repeat the test after a group change and after a user is removed from the identity provider. For Open WebUI and LibreChat, check whether every user who can open a shared knowledge base can also see its contents, since the access decision is made inside the chat platform's own permissions. For Onyx, ask the vendor or partner to show how permission changes reach the index, how often they refresh, and what happens to already indexed content when access is revoked. These answers determine whether an assistant can be given access to restricted files.
What drives the running cost of each platform
Software licenses are only part of the bill for a company-wide assistant. Each platform adds recurring services, and model usage and license terms add costs that depend on your user count and document volume. Use the cards below to scope a quote and to see which costs scale with people, data and replicas.
Open WebUI services and replicas
A single container with SQLite is the simplest setup, but the scaling guide requires PostgreSQL for multi-instance deployments. Multiple replicas also need Redis for sessions and WebSocket state and shared file storage for uploads and knowledge. Each added replica raises compute, database and storage load, and an external vector database adds another service to run. Ask whether the quote covers these services or only the application.
LibreChat services and search
The reference Docker Compose setup runs MongoDB, Meilisearch for search and a separate RAG API service alongside the application. Message volume and search index size drive storage and memory for MongoDB and Meilisearch, and document uploads drive the RAG service. Ask your team to size these components for expected conversation history and file volume, and confirm who operates the Helm chart or Compose stack after handover.
Onyx index and connector sync
Onyx Standard runs Postgres, Vespa or OpenSearch for the index, Redis, model servers and object storage. Connector count, indexed document volume and sync frequency all raise index size, background worker load and model inference demand. Onyx Lite removes the vector database and background workers, which lowers the footprint but drops indexing. Request the edition, the connectors in scope and the sync schedule in writing before comparing totals.
Model usage: hardware or tokens
None of the three platforms sets the cost of model usage. Local models consume GPU or CPU capacity and memory that you provision, while cloud providers bill per token based on the models and volumes you choose. Prompt length, conversation history, reranking and the number of active users drive token counts. Ask for a model usage estimate from your own traffic sample, and confirm which provider accounts the implementation will connect to.
Licensing decisions and quotes
Open WebUI's branding clause applies above 50 end users in a rolling 30-day period unless you hold an enterprise license or written permission. Onyx's Enterprise Edition adds features such as RBAC under a separate license. Request the exact edition, the expected seat count, the required connectors and the services that must run, because each changes the license scope and the infrastructure total.
How a company-wide rollout of these platforms unfolds
This sequence turns a shortlist into a rollout decision by settling license, identity and infrastructure questions before any user logs in, so the team can judge each platform against the same checkpoints.
Confirm the license position against user count
Start by estimating how many end users will hold accounts within a rolling 30-day window, since that number decides whether Open WebUI's branding clause applies. Legal or procurement owns this step, with the platform owner reading the license text. Open WebUI code from v0.6.6 onward carries the Open WebUI License, while LibreChat (MIT) and Onyx Community Edition (MIT) carry no branding threshold, though Onyx Enterprise Edition code under ee directories has its own license. Done means a written note recording the expected user count, the license that applies and whether an enterprise license or written permission is needed.
Decide the identity source and provisioning model
Choose the directory that will authenticate staff, such as an existing identity provider over OIDC or SAML, LDAP, or local accounts for a pilot. Open WebUI documents OIDC, LDAP, SCIM 2.0 provisioning and group-based RBAC, LibreChat documents OAuth2, LDAP and email login with an admin panel, and Onyx lists Google OAuth, OIDC or SAML, SCIM and RBAC in its enterprise features. Confirm which of these features sit in the edition you will run, because Onyx places RBAC and some SSO features in its Enterprise Edition. Done means a mapping from directory groups to platform roles, reviewed by the identity team.
Choose the deployment method
Pick the install path your platform team already operates. Open WebUI supports Docker and Docker Compose, Kubernetes with Helm, and pip install open-webui followed by open-webui serve, though pip suits single-user testing rather than a shared service. LibreChat documents Docker and a Kubernetes Helm chart. Onyx documents Docker, Kubernetes, Helm and Terraform, with a published Helm chart. Done means a written deployment target, such as a specific cluster or Compose host inside your own cloud account or data center, with the vendor documentation version recorded.
Size the required backing services
Map the services each platform needs before provisioning. Open WebUI needs PostgreSQL rather than SQLite for multi-instance use, plus Redis and shared file storage for multiple replicas. LibreChat's reference Compose file runs MongoDB, Meilisearch and a separate RAG API service. Onyx's documented infrastructure includes Postgres, Vespa or OpenSearch, Redis and model servers, and Onyx Lite removes the vector database and background workers. Done means a sizing sheet listing each service, its owner, its backup approach and what your infrastructure team has confirmed in a test environment.
Connect model providers and set access policy
Configure which models staff can reach, whether local runtimes such as Ollama or vLLM, or cloud providers such as OpenAI, Anthropic or Azure OpenAI. Open WebUI and LibreChat both accept OpenAI-compatible endpoints, and Onyx supports Ollama, LiteLLM, vLLM, Anthropic, OpenAI and Gemini. Record which provider data flows leave your network and set approval rules for each. Done means a tested list of enabled models per user group and a documented decision on any external provider, confirmed against each vendor's current terms.
Load knowledge or connect sources with permission checks
Decide how company knowledge reaches the assistant. Open WebUI and LibreChat use uploaded documents and knowledge bases, with Open WebUI supporting 13 vector databases and hybrid retrieval. Onyx connects to 50+ applications and syncs source permissions so answers only draw on what the user can already see. Validate permissions with test accounts from different groups, checking that restricted documents never appear in answers or citations. Done means a signed test record showing each account's visible and hidden documents, and a rerun after any connector or group change.
Pilot with a limited group before wider rollout
Give a small, representative group access under the same identity, model and retrieval settings planned for production, and collect usage and security feedback. Review audit or query history where each platform provides it, and confirm backup and restore on the pilot stack. Done means a documented pilot report with open issues, a go or no-go decision signed by the platform owner and security lead, and a list of settings that must change before wider rollout. Confirm upgrade procedures with the vendor, since release cadence differs across the three projects.
Questions buyers ask before comparing Open WebUI vs LibreChat vs Onyx
What drives the cost of running Open WebUI, LibreChat and Onyx?
Cost depends on who pays for each component: infrastructure, databases and search services, model access, and the software license tier. All three are self-hosted, so the platform software itself is not the main variable. Open WebUI's branding clause and Onyx's Enterprise Edition features can add a license cost at scale. Recurring costs include compute, storage, model API usage, upgrades and support. Costs rise with user count, document volume, the number of connectors and the number of model providers. Ask any vendor or partner for a quote that lists infrastructure, licensing, implementation, upgrades and support as separate lines, with what is one-time and what recurs.
Can our internal team run one of these platforms without outside help?
A team with container and database skills can run any of the three, but the work is more than installing a container. Each platform needs a persistent database, and each has its own supporting services. LibreChat's reference setup uses MongoDB, Meilisearch and a RAG API service. Onyx's documented infrastructure includes Postgres, Vespa or OpenSearch, Redis and model servers. Open WebUI needs PostgreSQL, Redis and shared file storage once it runs on multiple replicas. Upgrades, backups, identity configuration and monitoring fall to your team unless you contract them out. DeployOpen plans, implements, hardens, backs up, upgrades and supports self-hosted platforms in your own infrastructure, under a written scope or a retainer.
How long does a company-wide rollout take, and what does it depend on?
The timeline depends on scope, not on a fixed duration. The main variables are how many users and sources are in scope, which identity provider you connect, how many model providers you configure, and whether you need document connectors with permission sync. Onyx rollouts often take longer because connectors and permission mapping need review for each source. Open WebUI and LibreChat rollouts are usually gated by identity integration, database sizing and the approval process for model access. Your infrastructure team's change windows and security review cycles also set the pace. Ask for a timeline built from a written scope with named milestones, and confirm which items depend on your team's decisions.
What does the internal team need to provide for the deployment?
Before work starts, the team needs an identity provider and an integration path, databases and storage, access to model endpoints, and a named owner. For identity, Open WebUI documents OIDC, LDAP and SCIM 2.0 provisioning, LibreChat supports OAuth2, LDAP and email login, and Onyx lists Google OAuth, OIDC, SAML and SCIM. Your team should also supply hosting capacity, network rules for model providers, and the source systems for any connectors. Decide who approves model use, who reviews the document access model and who answers when a user reports a problem. Without a named owner, upgrades and security patches tend to slip after launch.
Does Open WebUI need an enterprise license above 50 users?
The Open WebUI License only restricts one thing: altering or removing Open WebUI branding. That restriction applies to deployments with more than 50 end users in a rolling 30-day period. Above that threshold, you need an enterprise license, written permission from the copyright holder, or you must keep the branding intact. If you keep the branding unchanged, the clause does not require a paid license for internal use. Confirm how your organization counts end users, whether contractors count, and how a deployment behaves when a user count spikes. Read the license text in the official documentation and confirm your reading with Open WebUI's enterprise sales team or legal counsel before rollout.
Does ClickHouse owning LibreChat change how we deploy it?
ClickHouse announced its acquisition of LibreChat on November 4, 2025, and said existing deployments continue unchanged while the open-source project keeps receiving investment. The MIT license is unchanged by that announcement. Your deployment is affected only if your plans change. Confirm the long-term roadmap, release cadence and any hosted or commercial offerings with ClickHouse and in the project's repository before you commit. Check that your stack still matches the reference setup, which uses MongoDB, Meilisearch and the RAG API. The current tagged release, v0.8.8, is marked as a pre-release, so plan your upgrade path and test it in a non-production environment first.
Can Onyx run air-gapped, and what does it need?
Onyx documents an air-gappable, self-hosted deployment in which the document index, database and processing run in a self-contained set of services. It can be deployed with Docker, Kubernetes, Helm or Terraform. The Onyx Standard setup needs Postgres, Vespa or OpenSearch, Redis, model servers and object storage. Onyx Lite removes the vector database and background workers for a lighter chat and agents deployment. For local models, Onyx supports Ollama, LiteLLM and vLLM. Confirm which connectors need outbound network access, because most cloud sources will not work inside a closed network. Enterprise Edition features such as RBAC fall under the Onyx Enterprise License, so check which features your scope requires before you plan the network design.
Can Open WebUI, LibreChat and Onyx run side by side?
Yes, the three platforms are separate services with their own databases, so they can run in the same environment. The practical question is whether running them together helps your users. Open WebUI and LibreChat are chat front ends over local and cloud models, while Onyx is chat grounded in connected company knowledge with permission sync. Many teams pilot one platform for a defined group, then add another for a different purpose. Running two chat tools can confuse users and split usage data, so decide which tool is the default for each use case. Keep identity groups, model access policies and backup schedules separate for each platform, and assign one owner per platform so upgrades are not missed.
How DeployOpen works on this
DeployOpen helps teams decide between Open WebUI, LibreChat and Onyx by first mapping who will use the assistant, which models and document sources it must reach, and which identity and licensing terms apply. Once the choice is made, DeployOpen implements the chosen platform inside your own cloud accounts, data centers or air-gapped network, with the supporting services it needs.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Scope covers user count, model providers, document sources and whether Onyx connector permissions must match existing access.
- The written scope states which license terms apply, including the Open WebUI branding threshold and any enterprise license need.
- Quotes follow from the written scope, so the scope document is the basis for comparing proposals.
How we build
- Deployment covers the chosen platform and its required services, such as PostgreSQL, Redis and shared storage for Open WebUI.
- For LibreChat, the build covers MongoDB, Meilisearch and the RAG API service from the reference setup.
- For Onyx, the build covers Postgres, Vespa or OpenSearch, Redis and model servers, with identity configured against your provider.
- Identity integration, role mapping and model provider connections are configured and tested inside your environment.
How we hand over
- Handover includes documentation of the architecture, configuration, backup and upgrade steps for the deployed platform.
- Access controls, group mappings and permission settings are documented so your administrators can review them later.
- Security testing of the deployed applications and APIs can be included in the written scope if you request it.
- Compliance readiness documentation prepares systems and evidence for your assessors, who issue any audit reports.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- Upgrades track each platform's own release line, so the retainer scope should name the versions you run.
- Ask whether the retainer covers license-related checks, such as branding requirements after user counts grow.
- Confirm response expectations and support windows in the written retainer before go-live.
