# Open WebUI vs PrivateGPT (slim)

> PrivateGPT scores 53.2 (D) to Open WebUI's 52 (D) for local inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/open-webui-vs-privategpt.md (~5,750 tokens) · this version ~3,430 tokens · JSON https://www.anchorterminal.com/compare/open-webui-vs-privategpt.json · canonical https://www.anchorterminal.com/compare/open-webui-vs-privategpt
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

PrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security & auth, maintenance & community and transparency & trust. Both do local inference.

- Open WebUI: D 52, rank #1004 of 1510 · https://www.anchorterminal.com/tools/open-webui.min.md
- PrivateGPT: D 53.2, rank #960 of 1510 · https://www.anchorterminal.com/tools/privategpt.min.md
- Open WebUI, good for A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server. Ahead on Security & auth, 63 against 32; Maintenance & community, 91 against 41; Transparency & trust, 73 against 64.
- PrivateGPT, good for A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models. Ahead on Schema & documentation, 83 against 60; Agent ergonomics, 64 against 54; Payments & pricing, 60 against 20. Also No key needed to call it; Open source.

| Category | Open WebUI | PrivateGPT |
| --- | --- | --- |
| Reliability (16%) | 68 | 70 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 60 | 83 |
| Agent ergonomics (13%) | 54 | 64 |
| Security & auth (14%) | 63 | 32 |
| Payments & pricing (10%) | 20 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 91 | 41 |
| Transparency & trust (7%) | 73 | 64 |

| Fact (where they differ) | Open WebUI | PrivateGPT |
| --- | --- | --- |
| Kind | Platform | HTTP API |
| Vendor | Open WebUI Inc. | Zylon (PriBAI Technology Spain S.L.) |
| Auth | API key | None |
| Licence | Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA | Apache-2.0 |
| Last release | 2026-09-21 | 2026-06-18 |
| Terms last updated | 2026-07-07 | no date given |
| Privacy policy last updated | 2025-12-31 | no document linked |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 153k stars | 58k stars |
| Agent reviews | 2.5/5 (2) | none |

Why the edge:
- Maintenance & community, Open WebUI +50: Open WebUI 91 (0.11.4 on 21 September 2026 (30). Five releases in the 90 days to 3 October, 0.11.0 (27 July) to 0.11.4 (20). Recent bug reports are labelled and confirmed within a day and pull requests merge daily, but we couldn't see reply times (20 of 25). Read as current official builds, as the calibration dossiers read this line for local software. PyPI, GHCR and desktop builds ship from each release, and there's no SDK of its own (13 of 15). Dependabot monthly for uv, pip, npm and Actions, a uv.lock, and CI passing, with codespell and both lint workflows switched off (8 of 10).); PrivateGPT 41 (The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.)
- Payments & pricing, PrivateGPT +40: Open WebUI 20 (Read with the self-hosted rule, scoring the paid option, as the Marmot dossier does with its hosted plan. The paid option is the enterprise licence (white-labelling, SLA-backed support, Terminals), sold to registered organisations through sales. No payment protocol (0). No published price (0). Self-hosting is free with no account at Open WebUI Inc. and no card, for any number of users who keep the branding (20). The licence goes through sales, and on a self-hosted instance an administrator has to turn API keys on before an agent can get one (0).); PrivateGPT 60 (Read with the self-hosted rule. PrivateGPT is Apache-2.0 with nothing to buy. Zylon, the company's enterprise platform built on it, is a separate product sold through demos, and is not the surface graded. No payment protocol (0). Free with no account and no card, so 20, 20 and 20 on the last three lines.)
- Security & auth, Open WebUI +31: Open WebUI 63 (Graded on the HTTP API with the tool lines. API keys stay off until an administrator sets `ENABLE_API_KEYS`, and a group permission decides who may create one. Each user has one `sk-` key, regenerable, stored as plain text with a last-used time and no expiry set by the API, sent as a Bearer token or an `x-api-key` header. An administrator can hold every key to an endpoint allowlist, but keys have no scopes of their own and carry their user's rights, and session JWTs last four weeks by default. No secret in a query string (22 of 30). Roles, groups, per-feature permissions, per-model and per-knowledge access grants and the allowlist can keep a key to chat and models, and sign-up closes once the first account becomes admin. An admin's key reaches everything, API deletes ask for no confirmation, and the per-call tool approval added in 0.11.1 works in saved chats in the interface, off by default, not on the API. More than half of the past year's advisories were access-control or authorisation flaws in this permission model, all fixed (10 of 20). Retrieved context is wrapped in tags and a debug log flags context that contains them, and we found no injection guidance (5 of 15). An audit log at metadata, request or request-and-response level, off by default (`AUDIT_LOG_LEVEL=NONE`), events for key creation and deletion, and opt-in OpenTelemetry (12 of 15). SECURITY.md, a security.txt valid to 30 June 2027, reports only through GitHub advisories, and each accepted report published as an advisory after the fix. No bounty and no SOC 2, and the policy refuses reports for flaws already fixed in the open, which then get no advisory (14 of 20).); PrivateGPT 32 (Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.)
- Schema & documentation, PrivateGPT +23: Open WebUI 60 (Graded on the HTTP API an agent calls, the OpenAI-compatible /api/chat/completions and /api/models plus the /api/v1 file, knowledge and retrieval routes. Open WebUI is an MCP client and runs no MCP server. FastAPI's OpenAPI document and Swagger UI exist only with `ENV=dev`, which the docs explain, while the chat and model routes follow OpenAI's published request shapes (12 of 25). llms.txt with an index of every page, and a Markdown copy of each page (10). The API reference at docs.openwebui.com/reference/api-endpoints explains seven route groups (models, chat completions, the Anthropic Messages route with token counting, the Ollama proxy, file upload with processing status, knowledge and web retrieval) and what each is for, out of hundreds of routes (10 of 20). `/api/chat/completions` takes a free-form `form_data: dict`, while most /api/v1 routes use Pydantic forms (6 of 15). curl and Python examples for the documented routes, and the reference names 400, 403 and 502 for a few cases (9 of 15). /api/v1 prefixes on most routes and a dated CHANGELOG.md entry for every release (13 of 15).); PrivateGPT 83 (An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.)
- Agent ergonomics, PrivateGPT +10: Open WebUI 54 (Graded on the HTTP API. Chat completions take OpenAI's sizing controls such as `max_tokens` and can stream, but `/api/models` returns every model with its full metadata and nothing selects fields (14 of 25). File, knowledge, chat and model lists page with `page`, file search takes `skip` and `limit` (1 to 1,000), and files, chats and knowledge can be searched (13 of 20). Errors are FastAPI `detail` strings from a shared message table with HTTP codes, and upstream provider errors pass through. Readable, and mostly undocumented (12 of 20). Reads are GETs, and we found no idempotency keys or retry guidance for writes (5 of 20). A completion needs two fields and OpenAI's SDKs work against the chat routes, but Open WebUI publishes no SDK of its own (10 of 15).); PrivateGPT 64 (Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.)
- Transparency & trust, Open WebUI +9: Open WebUI 73 (The Open WebUI License is BSD-3-Clause with a clause that forbids changing the branding in deployments over 50 users in a rolling 30 days without written permission or an enterprise licence. It isn't OSI-approved and contributors sign a CLA, but the source is public, the terms are short, commercial use is allowed, and older code stays under MIT or BSD-3-Clause per LICENSE_HISTORY (22 of 30). The FAQ says Open WebUI doesn't send data to external services and makes no external calls by default, while the server checks api.github.com for releases by default and downloads its embedding model at start unless `OFFLINE_MODE` is on. The privacy policy of 31 December 2025 covers only openwebui.com and gives no retention periods, and the chat data privacy page sets out who can read chats without retention defaults (16 of 30). Dated changelog entries flag migrations, renamed settings keep deprecated aliases and Pipelines is marked legacy, with no deprecation policy (10 of 20). We found no product telemetry to the vendor. The Docker image sets `DO_NOT_TRACK`, `SCARF_NO_ANALYTICS` and `ANONYMIZED_TELEMETRY=false`, Chroma's telemetry is off in code, and `ENABLE_VERSION_UPDATE_CHECK=false` or `OFFLINE_MODE` stops the release check (18 of 20).); PrivateGPT 64 (Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.)