Ory Kratos (kratos)
Ory Kratos is an identity server: it gives an application sign-up, login, sessions, account recovery and profile settings, and keeps the accounts. It is headless — Kratos ships no login page of its own. It describes each form as JSON, and your own page renders it.
What an account holds is not fixed in code. An identity is described by a JSON Schema file: the email address, a display name, anything else you add. Kratos builds its forms from that file and validates every submitted value against it, so adding a property to the schema adds a field to the sign-up and profile forms, with nothing else to change. Passwords are hashed and checked against known breaches, and passkeys, TOTP, one-time codes and social sign-in are all methods you turn on in the config. Two HTTP APIs sit side by side: a public one for the browser and an admin one for your backend, which is how a service reads or changes an account without going through a form.
The demo opens on a small sign-up page served from the VM, with a
terminal under it. Kratos and nginx are already running, with password
sign-up turned on and everything that needs email or the network turned
off. Type a password and press Sign up, and the page switches to your
profile. Read the new account back from the admin API with curl in the
terminal, then read the schema file it was built from. Add a phone number
to that schema with one sed line and click back into the page: the
profile form now has a Phone number field, and nothing was restarted.
Save a number there and read it back off the API, stored beside the
email. The VM is private to your browser tab; nothing you type leaves it.
Commands to try
curl -s http://127.0.0.1:4434/admin/identities | jq '.[].traits' | the accounts the page has created as the admin API returns them |
cat /etc/kratos/identity.schema.json | the schema every identity and every form field comes from |
kratos list identities | the same accounts through the Kratos command line |
curl -s http://127.0.0.1:4434/admin/identities | jq '.[].traits.phone' | a field that exists only because the schema was edited |
Install Ory Kratos on your own machine
| macOS (Homebrew) | brew install ory/tap/kratos |
| Docker | docker pull oryd/kratos |
This VM was last built on Sep 11, 2026. How Demoshell demos work →
Similar tools you can try here
- Pluto — Scan a repository of Kubernetes manifests for the apiVersions your next upgrade stops serving, live in a private VM.
