Item: Open WebUI
Author: GILD

GILD verdict

Adopt Open WebUI when chats and documents must stay on your own servers and staff should reach local and hosted models from one assistant.

It fits teams ready to host, secure, and upgrade it, turn on the audit log, and keep the branding or buy a license.

Open WebUI

AI Assistant by Open WebUI

−74 Strong negative

Fit and limits

Who it fits

Chats, uploads, and knowledge bases must stay in your own infrastructure, including on-premise or air-gapped networks.
You want local models served by Ollama or llama.cpp beside hosted model APIs, with an admin choosing the default models.
Your identity stack should run access: SSO through OIDC, LDAP and Active Directory, RBAC, and SCIM 2.0 provisioning.
Your model spend should go to the model makers on your own keys, or to your own hardware, with no per-seat fee.

Where it falls short

You run it. A three-replica deployment rolled back from v0.12.0 to v0.11.4 after containers grew from about 2 GB to 8 to 11 GB on October 12, 2026, and another v0.12.3 user saw memory reach 12 to 35 GB during multi-step tool calling.
Performance at scale needs tuning: a GitHub issue reports chat search on PostgreSQL taking 5 to 15 seconds with a few thousand chats, and PDF OCR can starve the server under several uploads.
Since v0.6.6 in April 2025 the license forbids removing the branding above 50 users in a 30-day period without written permission or an enterprise license, and Hacker News commenters call it no longer open source.
Practitioners report gaps such as no Anthropic prompt caching, no image generation with Ollama, and tools running on the same server as the app.

Host it like a production app
Run Open WebUI on Postgres, add Redis when you run more than one replica, and put it behind a reverse proxy with TLS and expose no raw port. Size for document uploads and tool-heavy chats, which practitioners report driving memory and CPU.
Connect identity first
Turn on SSO through your OIDC provider or LDAP, enable SCIM 2.0 so your identity provider creates and removes users and groups, and map groups to roles so file uploads and knowledge stay off by default and are granted by group.
Turn on the audit log and set retention
Set AUDIT_LOG_LEVEL to METADATA or REQUEST, since it defaults to NONE, and send the log to your SIEM through the container's stdout. Write the retention schedule for chats into your database jobs, because Open WebUI follows whatever your database keeps.
Stage every upgrade
Run each new release on a staging copy with your real backends and tools before production, and keep the previous image ready: the October 2026 v0.12.0 rollback restored stability only by reverting to v0.11.4.

Default models

DEFAULT_MODELS: accepts several model IDs separated by commas.
Overrides: a model or models URL parameter takes precedence over DEFAULT_MODELS, and default models set on a group replace the list for the group's members.

Track memory per replica for two weeks after each minor release; roll back when it grows past twice the previous release's baseline.
Count active users monthly; if the deployment needs your own branding above 50 users, price an enterprise license against a fork-free alternative.
Review the audit log weekly for the first quarter; if security needs request bodies, move to REQUEST level and budget the storage.