diff --git a/GIDs b/GIDs
index 47fa16129409..7c6869b21d21 100644
--- a/GIDs
+++ b/GIDs
@@ -775,7 +775,7 @@ cirrus:*:828:
 # free: 831
 beehive:*:832:
 # free: 833
-# free: 834
+pocket-id:*:834:
 filebrowser:*:835:
 # free: 836
 # free: 837
diff --git a/UIDs b/UIDs
index c92b5e45e010..0b243bb7eb27 100644
--- a/UIDs
+++ b/UIDs
@@ -781,7 +781,7 @@ cirrus:*:828:828::0:0:Cirrus CI:/usr/local/cirrus:/bin/sh
 # free: 831
 beehive:*:832:832::0:0:beehive user:/nonexistent:/usr/sbin/nologin
 # free: 833
-# free: 834
+pocket-id:*:834:834::0:0:OIDC provider that allows users to authenticate with their passkeys:/var/db/pocket-id:/usr/sbin/nologin
 filebrowser:*:835:835::0:0:Web File Browser:/var/db/filebrowser:/usr/sbin/nologin
 # free: 836
 # free: 837
diff --git a/www/Makefile b/www/Makefile
index e2d4e07e535e..6e56ffb734b4 100644
--- a/www/Makefile
+++ b/www/Makefile
@@ -1453,6 +1453,7 @@
     SUBDIR += plasma6-plasma-browser-integration
     SUBDIR += pmwiki
     SUBDIR += pnews
+    SUBDIR += pocket-id
     SUBDIR += podcastamatic
     SUBDIR += pomerium
     SUBDIR += pound
diff --git a/www/pocket-id/Makefile b/www/pocket-id/Makefile
new file mode 100644
index 000000000000..641ca2d03c15
--- /dev/null
+++ b/www/pocket-id/Makefile
@@ -0,0 +1,39 @@
+PORTNAME=	pocket-id
+DISTVERSIONPREFIX=	v
+DISTVERSION=	1.4.0
+CATEGORIES=	www
+MASTER_SITES=	LOCAL/dtxdf/${PORTNAME}/
+DISTFILES=	${PORTNAME}-${DISTVERSION}.frontend${EXTRACT_SUFX}
+
+MAINTAINER=	dtxdf@FreeBSD.org
+COMMENT=	OIDC provider that allows users to authenticate with their passkeys
+WWW=		https://pocket-id.org
+
+LICENSE=	BSD2CLAUSE
+
+USES=		go:modules
+USE_GITHUB=	yes
+USE_RC_SUBR=	${PORTNAME}
+
+GO_MOD_DIST=	github
+GO_MODULE=	https://github.com/pocket-id/${PORTNAME}
+GO_TARGET=	./cmd:${PORTNAME}
+GO_BUILDFLAGS=	-ldflags "-X github.com/pocket-id/pocket-id/backend/internal/common.Version=${DISTVERSION} -buildid=${DISTVERSION}"
+
+SUB_FILES=	pkg-message
+SUB_LIST=	USER=${USERS:[1]}
+
+WRKSRC_SUBDIR=	backend
+
+USERS=		${POCKET_ID_USER}
+GROUPS=		${POCKET_ID_GROUP}
+
+PLIST_FILES=	bin/${PORTNAME}
+
+POCKET_ID_USER=		${PORTNAME}
+POCKET_ID_GROUP=	${POCKET_ID_USER}
+
+pre-build:
+	@cd ${WRKDIR}/pocket-id-frontend && ${COPYTREE_SHARE} . ${WRKSRC}/frontend/dist
+
+.include <bsd.port.mk>
diff --git a/www/pocket-id/distinfo b/www/pocket-id/distinfo
new file mode 100644
index 000000000000..dea750785956
--- /dev/null
+++ b/www/pocket-id/distinfo
@@ -0,0 +1,7 @@
+TIMESTAMP = 1750475934
+SHA256 (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/pocket-id-1.4.0.frontend.tar.gz) = 28d9a1e390d4caa1d210fb1cd36c2f2839d89e82905e88953847b18a25aeb44d
+SIZE (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/pocket-id-1.4.0.frontend.tar.gz) = 940695
+SHA256 (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/go.mod) = 746b88f292ef6becb08abe2aa09185c44bf44d7679e281534821b0d8cfc4828c
+SIZE (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/go.mod) = 6612
+SHA256 (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/pocket-id-pocket-id-v1.4.0_GH0.tar.gz) = ad76903ab02cd739fb3171df8d18a3192b131dc55dd52fe223634c79d9d82f53
+SIZE (go/www_pocket-id/pocket-id-pocket-id-v1.4.0_GH0/pocket-id-pocket-id-v1.4.0_GH0.tar.gz) = 5506002
diff --git a/www/pocket-id/files/pkg-message.in b/www/pocket-id/files/pkg-message.in
new file mode 100644
index 000000000000..f97cc825952b
--- /dev/null
+++ b/www/pocket-id/files/pkg-message.in
@@ -0,0 +1,17 @@
+[
+{ type: install
+  message: <<EOM
+Pocket ID is installed
+
+1) Configure it in %%PREFIX%%/etc/pocket-id.env
+
+2) Enable it with
+
+     sysrc pocket_id_enable=YES
+
+3) Start it with
+
+     service pocket-id start
+EOM
+}
+]
diff --git a/www/pocket-id/files/pocket-id.in b/www/pocket-id/files/pocket-id.in
new file mode 100644
index 000000000000..04a26a82a74e
--- /dev/null
+++ b/www/pocket-id/files/pocket-id.in
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+# PROVIDE: pocket_id
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+#
+# Configuration settings for pocket-id in /etc/rc.conf
+#
+# pocket_id_enable (bool):     Enable pocket-id. (Default=NO)
+# pocket_id_env_file (str):    Path containing the environment variables
+#                              to be used by pocket-id. (Default: /usr/local/etc/pocket-id.env)
+# pocket_id_logfile (str):     Log file used to store the pocket-id's output. (Default: /var/log/pocket-id.log)
+# pocket_id_pidfile (str):     File used by pocket-id to store the process ID. (Default: /var/run/pocket-id.pid)
+# pocket_id_runas (str):       User to run pocket-id as. (Default: %%USER%%)
+
+. /etc/rc.subr
+
+name="pocket_id"
+desc="OIDC provider that allows users to authenticate with their passkeys"
+rcvar="pocket_id_enable"
+
+load_rc_config $name
+
+: ${pocket_id_enable:="NO"}
+: ${pocket_id_env_file:="/usr/local/etc/pocket-id.env"}
+: ${pocket_id_logfile:="/var/log/pocket-id.log"}
+: ${pocket_id_pidfile:="/var/run/pocket-id.pid"}
+: ${pocket_id_runas:="%%USER%%"}
+
+pocket_id_chdir="/var/db/pocket-id"
+pidfile="${pocket_id_pidfile}"
+procname="/usr/local/bin/pocket-id"
+command="/usr/sbin/daemon"
+command_args="-o '${pocket_id_logfile}' -p '${pidfile}' -u '${pocket_id_runas}' -t '${desc}' -- '${procname}'"
+
+run_rc_command "$1"
diff --git a/www/pocket-id/pkg-descr b/www/pocket-id/pkg-descr
new file mode 100644
index 000000000000..904737283fae
--- /dev/null
+++ b/www/pocket-id/pkg-descr
@@ -0,0 +1,13 @@
+Pocket ID is a simple OIDC provider that allows users to authenticate
+with their passkeys to your services.
+
+The goal of Pocket ID is to be a simple and easy-to-use. There are
+other self-hosted OIDC providers like Keycloak or ORY Hydra but
+they are often too complex for simple use cases.
+
+Additionally, what makes Pocket ID special is that it only supports
+passkey authentication, which means you don't need a password. Some
+people might not like this idea at first, but I believe passkeys
+are the future, and once you try them, you'll love them. For example,
+you can now use a physical Yubikey to sign in to all your self-hosted
+services easily and securely