Open-source helpdesk software: which fits which team
A team replacing a hosted helpdesk and keeping ticket data inside its own infrastructure should choose Zammad for a full ticketing platform with SSO and Elasticsearch-backed search, FreeScout for a shared-inbox team on a lighter stack, and osTicket for a team already running PHP and MySQL that wants a classic ticket queue. All three are self-hosted, and none needs a paid tier to run the core. Zammad and FreeScout are licensed under AGPL-3.0, while osTicket is GPL2. Both AGPL and GPL are open-source licenses recognized by the OSI, so the core you install carries no license fee. Paid modules, hosted plans and vendor support subscriptions are separate commercial products that you buy only if you want them.
Start by mapping your requirements against what each core includes. Zammad's documented requirements are PostgreSQL 15 or newer and Redis 7 or newer, and its documentation treats Elasticsearch as optional but strongly recommended for faster search, reporting and attachment content search. FreeScout runs on Nginx, Apache or IIS with PHP 7.4 to 8.x and MySQL, MariaDB or PostgreSQL, and its README states no minimum CPU or RAM requirements. osTicket requires Apache or Microsoft IIS, PHP 8.2 to 8.4 with mysqli and MySQL 5.5 or greater. The **stack you already operate** is usually the deciding factor, because a new Redis and Elasticsearch footprint adds recurring operating work that a PHP and MySQL team may not want.
Confirm identity and reporting needs before you commit. Zammad supports third-party login through SAML and OpenID Connect, among other providers. FreeScout's LDAP Integration and SAML SSO are paid modules on its modules page, so budget for them if you need directory login. osTicket's plugins repository holds LDAP, CAS and OAuth2 authentication as core plugins for osTicket 1.8 and later. Ask each vendor to demonstrate group mapping and reporting on your own data in a test instance, and plan the migration path from your current helpdesk, since Zammad ships migrators for Zendesk and other systems while FreeScout and osTicket migrations need separate checks.
Which helpdesk fits which scenario
This table matches common helpdesk scenarios to the platform whose supplied facts best support them, on channels, authentication, hosting and paid modules. Read each row as a starting point, then confirm the named features against the current release in your own environment before you decide.
| Scenario | Best fit | Reason and what to confirm |
|---|---|---|
| Shared support inbox for a small team | FreeScout | Shared inbox is its core model, with email over SMTP, IMAP and POP3, OAuth for Microsoft 365 and Google Workspace, and unlimited agents and mailboxes. Confirm mailbox limits in your own setup. |
| Multi-channel service desk with SSO | Zammad | Supports SAML and OpenID Connect third-party login and documents Docker Compose and Helm installs. Confirm which channels you need, since Zammad's channel set differs from FreeScout's. |
| Multi-channel desk with SSO on a budget for modules | FreeScout | SAML SSO and LDAP are sold as paid modules on a per-instance lifetime license. Confirm module pricing on the modules page before budgeting. |
| PHP-only shop on shared or simple hosting | osTicket or FreeScout | osTicket runs on Apache or IIS with PHP 8.2 to 8.4 and MySQL. FreeScout states no minimum CPU or RAM and can run on shared hosting. Confirm your PHP and database versions first. |
| Regulated team needing LDAP and audit trails | osTicket | osTicket-plugins covers LDAP, CAS, OAuth2, two-factor authentication, password policy and audit. Confirm plugin compatibility with your osTicket version. |
| Team wanting Zendesk-style migration | Zammad | Includes migrators for Freshdesk, Kayako, OTRS and Zendesk. Other systems need the API or custom work, so confirm your source system's export options. |
| Team that needs search and reporting at scale | Zammad | Elasticsearch is optional but strongly recommended for faster search and reporting. Plan for the extra service in your architecture. |
| Team wanting a paid support contract for self-hosting | Zammad | Self-hosted support plans are sold annually, while self-hosted customers handle updates and backups. Ask vendors what their support covers. |
How Zammad, osTicket and FreeScout differ in architecture
The data stack is where these three products differ most, and it sets the patching and backup work your team takes on. Zammad needs more moving parts. It requires PostgreSQL 15 or newer and Redis 7 or newer, with Redis handling realtime websocket communication. Elasticsearch is optional, but without it search is very limited, and the Zammad documentation strongly recommends it for search speed, reporting and searching email attachment content. If you run more than one Zammad instance, such as containers or cluster nodes, you also need Memcached, while a single installation can use the file system cache. Each of these services becomes a component your team must version, patch, monitor and back up.
osTicket and FreeScout keep the stack closer to a classic LAMP or LEMP web application. osTicket runs on Apache or Microsoft IIS with PHP 8.2 to 8.4 (8.4 recommended), the mysqli extension and MySQL 5.5 or greater. FreeScout runs on Nginx, Apache or IIS with PHP 7.4 to 8.x and can use MySQL, MariaDB or PostgreSQL. The practical difference for the patching team is the PHP version band and the database choice. Confirm with each vendor which PHP and database versions your operating system's packages provide, since a supported PHP line may not match the distribution default.
For the team that patches and backs up, plan around three rules. First, the osTicket README asks you to back up attachment files, the database and the codebase before every upgrade, so size your backup target for attachments, not just the database. Second, Zammad's Elasticsearch index is derived data that can be rebuilt, but confirm the rebuild time for your ticket volume in a test environment before you rely on it for recovery. Third, check which component versions your security process must track, because a Zammad deployment has at least four services to keep current, while osTicket and FreeScout mainly require the web server, PHP and the database.
Capability table across Zammad, osTicket and FreeScout
This table sets Zammad, osTicket and FreeScout side by side on license, release, data stores, channels, identity, migration, install paths, reporting and paid options. Where the researched facts are silent, the cell says Not stated in the facts and names what to confirm with the vendor or in a test install before you decide.
| Capability | Zammad | osTicket | FreeScout |
|---|---|---|---|
| License | AGPL-3.0 | GPL2 | AGPL-3.0 |
| Latest release cited | 7.2 (September 23, 2026), security releases 7.2.1 and 7.2.2 | 1.18.4 and 1.17.8 (both June 17, 2026) | 1.8.248 (October 17, 2026) |
| Database and cache | PostgreSQL 15 or newer, Redis 7 or newer; Memcached for multi-instance deployments | MySQL 5.5 or greater with mysqli; PHP 8.2 to 8.4 | MySQL, MariaDB or PostgreSQL; no minimum CPU or RAM stated in the README |
| Search and reporting | Elasticsearch optional but strongly recommended for search, reporting and attachment content | Not stated in the facts; confirm reporting depth in a test install | Not stated in the facts; confirm reporting depth in a test install |
| Channels | Email and web-based ticket intake; confirm other channels per edition | Email, phone and web forms feed a multi-user agent interface | Email over SMTP, IMAP and POP3, plus WhatsApp, Telegram, Facebook, Slack and live chat |
| SSO and LDAP | SAML, OpenID Connect, Microsoft, Google, GitHub and GitLab among others; LDAP not stated in the facts | Core plugins for LDAP, CAS, OAuth2 and passthrough authentication | LDAP Integration and SAML SSO are paid modules; OAuth for Microsoft 365 and Google Workspace is included |
| Migration tools | Migrators for Freshdesk, Kayako, OTRS and Zendesk; other systems via API or custom work | Not stated in the facts; confirm import options | A migration service to FreeScout from other help desks is linked; confirm scope |
| Docker or Kubernetes install | Package, Docker Compose and Helm chart documented; Kubernetes support covers the application only | Deploy from a clone with php manage.php deploy; Docker not stated in the facts | Docker image and one-click installs via Softaculous, Cloudron and managed hosts |
| Paid modules or support | Self-hosted support plans at 2,999, 5,999 and 9,999 euros per year (Zammad pricing page) | Free download with community support only; paid editions per osTicket editions page | Lifetime module licenses for one instance; AI Integration and S3 Storage modules are free |
| Hosted options | Hosted plans from 7 euros per agent per month (Zammad pricing page) | Cloud-hosted edition from $12 per agent per month and a virtual appliance edition with custom pricing | Managed hosts are named; confirm the vendor's own hosted offer |
What the paid editions actually add
Self-hosted Zammad carries no license fee, because the software is AGPL-3.0. What you pay for is support and, if you choose it, hosting. Zammad's pricing page lists self-hosted support subscriptions named Business at 2,999 EUR per year, Enterprise at 5,999 EUR per year and Corporation at 9,999 EUR per year. Hosted plans start at 7 euros per agent per month. The pricing page also states that self-hosted customers handle updates, backups and availability themselves, so the subscription does not replace your operating work.
- No license fee for self-hosting: The AGPL-3.0 code is free to run, and the cost of a self-hosted Zammad is infrastructure plus the staff who operate it.
- Annual support tiers: The supplied Business, Enterprise and Corporation prices are annual and recur until you cancel.
- Hosted plans per agent: Hosted pricing scales with the number of agents, so growth in headcount raises the recurring cost directly.
- Operations stay with you: Self-hosted customers handle updates, backups and availability, so the support tier does not cover your uptime work.
- Dependencies carry cost: PostgreSQL 15 or newer, Redis 7 or newer and optional Elasticsearch all need administration.
Before signing, ask Zammad which support tier covers which response commitments, and confirm in writing what the subscription includes for your version and deployment model.
osTicket is free to download under GPL2, but the free edition comes with community support only. Paid options change who runs the service. The cloud-hosted edition starts at $12 per agent per month, and the virtual appliance edition is priced on request. Neither option is listed as a support subscription for the self-hosted download, so ask the vendor what a paid tier includes before assuming it covers your own servers.
- Free download, community support: The GPL2 release is free, but support comes from the community, not a contract.
- Cloud edition per agent: The cloud-hosted edition starts at $12 per agent per month, which recurs and rises with agent count.
- Virtual appliance pricing on request: The appliance edition has custom pricing, so the figure depends on your quote.
- Plugins sit alongside the core: The osTicket-plugins repository lists LDAP, CAS, OAuth2, two-factor authentication, password policy, audit and attachment storage on the filesystem or S3 as core plugins for osTicket 1.8 and later.
- Upgrade effort stays with you: The README recommends backing up attachments, the database and the codebase before upgrading.
Ask the vendor which edition includes which plugins and support hours, and confirm the appliance scope and upgrade responsibilities before comparing it with a self-hosted deployment.
FreeScout is AGPL-3.0 and free to self-host, with unlimited agents, tickets and mailboxes in the core product. Its paid layer is a set of modules sold as lifetime licenses for a single FreeScout instance, with lifetime updates. The official modules page lists LDAP Integration, SAML SSO, API and Webhooks, Knowledge Base, Satisfaction Ratings, Time Tracking and Workflows as paid modules. The AI Integration and S3 Storage modules are free.
- Lifetime single-instance licenses: Each paid module is licensed for one FreeScout instance, so every additional instance needs its own purchase.
- Lifetime updates: The modules page describes lifetime updates, which means the cost is a one-time purchase rather than a subscription.
- Identity modules are paid: LDAP Integration and SAML SSO are sold as modules, so budget them if your directory or identity provider requires them.
- Free modules: AI Integration and S3 Storage cost nothing according to the modules page.
- Check terms per module: Confirm current license terms, transfer rights and update scope with FreeScout before purchase, since module pricing and terms can change.
Before you buy, list the modules you need, count the instances you plan to run, including test and disaster recovery copies, and confirm the lifetime terms in writing.
How channels, SSO, LDAP and reporting compare
Helpdesk buying decisions often turn on how requests arrive, how agents sign in, and how managers measure the queue. The four cards below show where Zammad, osTicket and FreeScout differ on those points, and where a paid module or plugin changes the answer. Test each claim against your own identity provider and mail flow before you commit.
Inbound channels
FreeScout centralizes email with SMTP, IMAP and POP3 mailboxes, and its README also lists WhatsApp, Telegram, Facebook, Slack and live chat as conversation sources. osTicket integrates inquiries created by email, phone and web forms into one agent interface. Zammad covers email and web intake as its core model. Check which channels you need on day one, since some arrive through add-ons or third-party connectors that you must install, configure and support yourself.
SSO and directory sign-in
Zammad supports third-party login through SAML, OpenID Connect and social providers such as Microsoft, Google, GitHub and GitLab. FreeScout offers OAuth for Microsoft 365 and Google Workspace in its base install, while LDAP and SAML SSO are paid modules sold as lifetime licenses. osTicket provides LDAP, CAS and OAuth2 as free core plugins. Confirm that your identity provider's group claims map to agent roles before go-live, because group-based routing is where integrations most often break.
Reporting and search
Zammad documents that Elasticsearch is optional but strongly recommended, because it enables faster search, reporting features and searching email attachment content. Without it, Zammad search is limited, so budget for an extra service to run and patch. FreeScout and osTicket reporting depth depends on the version and modules you deploy, so ask each vendor for a sample report that matches your SLA and queue metrics. Test reports against a copy of production data.
API and integration hooks
FreeScout provides an API, plus Zapier and Make integrations for connecting ticket events to other tools without custom code. Zammad offers an API and documents a migration path through its API or custom development from Zammad when a source system is not on its migrator list. osTicket extends through its plugin set rather than a broad hosted integration catalog. Decide which systems must receive ticket events, such as an identity directory or a CMDB, and ask each vendor to demonstrate that exact flow.
How to choose and pilot a self-hosted helpdesk
This sequence turns a shortlist of Zammad, osTicket and FreeScout into a tested choice, with a pilot that proves channels, routing, migration and patching work in your own environment before you commit.
Inventory channels and identity sources
The service owner and the messaging or email administrator list every channel the desk must receive from, such as shared mailboxes, web forms, phone logs, chat or social inboxes, and every identity source agents and customers use. Map each channel to the candidate platform's native support, an API route or a paid module, and flag anything that needs custom development. Done when the list has one owner per channel and each identity source is marked as SAML, OpenID Connect, LDAP, OAuth or other. Confirm the exact sign-in methods with each vendor's current documentation, since this page does not claim full coverage for any platform.
Confirm licenses and paid feature boundaries
Procurement and legal read each candidate's license and list which features sit behind paid tiers. Zammad is AGPL-3.0 with paid self-hosted support plans named Business, Enterprise and Corporation. osTicket is GPL2 with community support only, and its cloud and appliance editions are separate products. FreeScout is AGPL-3.0 and sells modules for LDAP, SAML SSO, API and webhooks, knowledge base and workflows under lifetime licenses. Done when a written table shows, for each required feature, whether it is free, paid, a plugin or unconfirmed, with the source page saved alongside.
Size the database, cache and search stack
The platform engineering lead reads each candidate's prerequisites and sizes the stack against expected ticket volume and the number of mailboxes. Zammad requires PostgreSQL 15 or newer and Redis 7 or newer, and recommends Elasticsearch for search and reporting, with Memcached for multi-instance deployments. osTicket requires PHP 8.2 to 8.4 and MySQL 5.5 or greater. FreeScout supports MySQL, MariaDB or PostgreSQL. Done when the team has a documented target architecture, a list of components to be patched and backed up, and a sizing request to the vendor or partner for the expected load.
Run a pilot mailbox with routing rules
The support lead and one platform engineer connect a real but low-risk mailbox to the leading candidate and build the routing rules, auto-replies, SLAs and agent groups the live desk will use. Agents work the pilot tickets for a set period agreed in advance. Done when the pilot shows correct assignment for each rule, duplicate and collision handling is observed, and agents report whether the interface covers their daily work. Record every gap as a requirement, a configuration fix or a paid-module need.
Test a migration export from the current desk
The helpdesk administrator exports a representative sample of closed and open tickets, attachments and customer records from the current system into a staging instance. Zammad documents migrators for Freshdesk, Kayako, OTRS and Zendesk, and other systems through its API or custom development. For osTicket and FreeScout, confirm the import route with the vendor, since the sources do not specify a migrator for every system. Done when the sample imports with ticket history, attachments and requester links intact, and the team has a measured list of records that failed or need manual handling.
Test identity, reporting and admin tasks
The identity engineer tests the sign-in path for agents and administrators, including group mapping and deprovisioning when a user leaves. The reporting owner checks that the dashboards and exports answer the questions leadership asks each month. Done when each sign-in method in the inventory has been tested with a real account, removed accounts can no longer sign in, and each required report can be produced without manual database work.
Set a patching routine from release cadence
The platform owner writes a patching routine that follows each project's published release pattern. Zammad published 7.2 on September 23, 2026, followed by security releases 7.2.1 on October 6, 2026 and 7.2.2 on October 8, 2026, and also shipped 6.5.5 on October 15, 2026 for its older line. osTicket released 1.18.4 and 1.17.8 together on June 17, 2026. FreeScout publishes releases roughly weekly. Done when the routine names who watches each release feed, the staging test window, the backup steps from each project's upgrade guidance, and the rollback owner.
Decide and record the go or no-go
The sponsor reviews the pilot, migration, identity and patching results against the requirements list and records a decision for one platform, or for a second pilot if a gap is unresolved. A go decision names the paid modules or support plans to buy, the quote scope, and the owner for production. Done when the decision record links every gap to a fix, a paid item or an accepted risk, and the written quote scope matches the tested configuration.
What migration and upkeep cost in time and skills
Migration effort is the largest variable in a helpdesk move, and it differs sharply across the three platforms. Zammad ships migrators for Freshdesk, Kayako, OTRS and Zendesk, so a team leaving one of those systems should check whether its export format and data volume match what the migrator expects. Other sources can be brought in through the Zammad API or through custom development from Zammad, which is a separate scoped cost. Verify that the migrator covers your ticket history, attachments and custom fields before you commit to a cutover date. For osTicket and FreeScout, no equivalent migrator is named in the supplied material for osTicket, so the export path from your current system is something you must verify yourself. FreeScout's README does link a migration service to FreeScout from other help desks, which is worth asking about in a written quote.
Cost falls into several buckets, and each is paid to a different party. License fees are usually zero for the open-source core of all three products, but paid support and modules are not. Zammad sells self-hosted support subscriptions named Business at 2,999 EUR per year, Enterprise at 5,999 EUR per year and Corporation at 9,999 EUR per year, according to its pricing page. FreeScout sells lifetime module licenses for a single instance, including LDAP Integration and SAML SSO, which are recurring only if you buy them again. Internal administrator time is recurring for every platform, because someone must apply updates, manage backups and watch availability. External implementation under a fixed written scope is a one-time cost for migration, integration and hardening. Ask any partner for a quote that names each deliverable, the source systems involved and the acceptance criteria.
Upkeep depends on the upgrade path. osTicket's README says upgrades are supported from 1.6-rc1 and later and recommends backing up attachment files, the database and the codebase before every upgrade, so plan a restore test as part of each change window. The same discipline applies to Zammad, which requires PostgreSQL 15 or newer and Redis 7 or newer, and to FreeScout, which relies on a database and PHP runtime you must keep current. Ask each vendor which supported versions they test, and confirm how long your team expects to spend on each patch cycle before choosing a platform.
Questions buyers ask before self-hosting a helpdesk
What does it cost to self-host Zammad, osTicket or FreeScout?
The core products carry no license fee to use, so the cost sits in infrastructure, staff time and any paid add-ons. Zammad has no license fee for self-hosting, but its paid self-hosted support plans are listed at 2,999, 5,999 and 9,999 euros per year (Business, Enterprise and Corporation), and the vendor states that self-hosted customers handle updates, backups and availability. osTicket's free download comes with community support only, while its cloud edition starts at $12 per agent per month. FreeScout's modules are sold as lifetime licenses for a single instance. The main drivers are the hosting footprint, how many people maintain the system, the support tier you pick, and how many paid modules you need. Ask each vendor for a written list of what is included and who handles patching and restores.
How long does a helpdesk migration and pilot take?
The duration depends on data volume, the source system and how many integrations you must rebuild, and no reliable figure applies across all three tools. Zammad includes migrators for Freshdesk, Kayako, OTRS and Zendesk, while other systems need an import through the Zammad API or custom development. Count the mailboxes, attachments, custom fields, macros, SLAs and automation rules you must carry over, because these set most of the work. A pilot usually runs one or two queues in parallel with the old system, so ask each vendor and each implementation partner for a written scope with milestones before you commit to a date.
What skills does a team need to run PostgreSQL, Redis or PHP stacks?
The team needs Linux administration, database backup and restore practice, and working knowledge of the stack the product uses. Zammad requires PostgreSQL 15 or newer and Redis 7 or newer for realtime communication, and it can sit behind Nginx or Apache. Multi-instance deployments also need Memcached. osTicket runs on Apache or Microsoft IIS with PHP 8.2 to 8.4 and MySQL 5.5 or greater. FreeScout runs on Nginx, Apache or IIS with PHP 7.4 to 8.x and MySQL, MariaDB or PostgreSQL. Staff should be able to patch the web server and PHP runtime, tune connection limits, test restores and watch queues. Confirm the PHP and database versions the current release supports before you choose a host image.
Can a small team run a self-hosted helpdesk without outside help?
A team with Linux and database skills can run any of these tools alone, but the work does not stop after the first install. Patch cadence is the main ongoing task: Zammad shipped security releases 7.2.1, 7.2.2 and 6.5.5 in October 2026 across two release lines, and osTicket advises backing up attachments, the database and the codebase before each upgrade. Zammad support also excludes Kubernetes-specific issues. If you lack capacity for those tasks, DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside your own infrastructure. Most engagements are fixed-scope with written deliverables, and ongoing support is available as a retainer.
Do SSO and LDAP require paid modules in these helpdesks?
It depends on the product, so verify each one against its current edition and module list. Zammad documents third-party login through SAML, OpenID Connect, Microsoft, Google, GitHub and GitLab, among other providers, and you should confirm in its documentation whether LDAP is covered by your plan. osTicket's core plugins repository includes LDAP, CAS and OAuth2 authentication for osTicket 1.8 and later, so check the plugin terms for your version. FreeScout sells LDAP Integration and SAML SSO as paid modules, while OAuth for Microsoft 365 and Google Workspace is listed in its README. Get the authentication method, group mapping and login fallback requirements in writing before you price the build.
Does the AGPL or GPL license affect internal use of these tools?
For unmodified software used only inside your organization, GPL and AGPL licenses generally do not require you to publish source code, but the details depend on how you use and change the code. Obligations are usually triggered by distribution, which applies to osTicket under GPL2 if you ship it to others. Zammad and FreeScout are AGPL-3.0, and that license adds a duty when you modify the software and let users interact with it over a network, such as a customer-facing portal. Review your planned modifications and any external access with legal counsel before deployment. This is a licensing question, not legal advice, and the answer depends on your specific use.
Does Elasticsearch add to the operating effort for Zammad?
Elasticsearch is optional for Zammad, but it adds a separate service to deploy, patch and back up. Zammad uses it for faster search, reporting features and searching the content of email attachments, and the vendor describes it as strongly recommended. Without it, the vendor's prerequisites page says search is very limited. Plan for an extra cluster, its memory and disk needs, index rebuilds after restores, and monitoring. Ask whether your reporting needs depend on it, and confirm sizing with the vendor documentation for your ticket volume before you decide on a single-node or clustered setup.
How DeployOpen scopes a helpdesk selection and rollout
DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a helpdesk shortlist, that means starting from your channels, identity setup and reporting needs before choosing which platform fits.
How we scope
- Written scope lists the channels, mailboxes, agent counts and identity sources your helpdesk must handle.
- Scope records which integrations are required, such as SSO, LDAP, ticket exports or reporting, and which are optional.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.
How we build
- Deployment runs in your infrastructure, with the database, search, cache and reverse proxy sized to the chosen platform's documented prerequisites.
- Identity integration is configured and tested against your directory or SSO provider before agents go live.
- Mail routing, migration from an existing help desk where supported, and access roles are built and checked against the agreed scope.
How we hand over
- Handover documentation covers the architecture, configuration, backup and upgrade steps for your team to follow.
- Security testing of the deployed helpdesk, including its API and login paths, is delivered as part of the written scope where agreed.
- Compliance evidence is prepared for your auditors, who issue any attestation or certification; DeployOpen does not issue those itself.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial rollout.
- Retainer scope should confirm which security patch lines, backup tests and upgrade windows your team needs covered.
- Ask any implementation partner to confirm response expectations and exclusions in writing before signing.
