Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| animir/node-rate-limiter-flexible A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, … | 96 | 3589 | stable |
| s0md3v/XSStrike XSStrike is a Python command-line Cross Site Scripting (XSS) detection suite that uses hand-written HTML/JavaScript parsers, context analys… | 27 | 15197 | maintenance |
| Joern Joern is an open-source code analysis platform that generates code property graphs (CPGs) from source code, bytecode, and binaries for C/C+… | 95 | 3581 | active |
| google/recaptcha Google's official PHP client library for verifying reCAPTCHA responses server-side, supporting both reCAPTCHA v2 and v3. It wraps the verif… | 97 | 3578 | active |
| JosephSilber/bouncer Bouncer is a PHP library for managing roles and abilities on Eloquent models, with support for ownership checks, forbidden abilities, cachi… | 61 | 3578 | stable |
| microsoft/ebpf-for-windows eBPF for Windows is an MIT-licensed implementation of the eBPF runtime that runs on top of the Windows kernel, letting developers reuse fam… | 86 | 3573 | active |
| CAPEv2 CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior a… | 77 | 3573 | active |
| devise token auth A Ruby gem providing token-based authentication for Rails JSON APIs, built on Devise and OmniAuth. It supports multi-client sessions, token… | 71 | 3570 | active |
| react-native-google-signin/google-signin A React Native library providing Google Sign-In (OAuth2) authentication for Android and iOS apps, including Expo support. It wraps the nati… | 92 | 3554 | active |
| roflcoopter/viseron Viseron is a self-hosted, local-only network video recorder (NVR) with built-in AI computer vision capabilities. It supports object detecti… | 96 | 3552 | active |
| abhinavsingh/proxy.py proxy.py is a fast, lightweight, zero-dependency Python library and CLI tool for building HTTP/HTTPS proxy servers and web servers, with pl… | 67 | 3552 | active |
| bastillion-io/Bastillion Bastillion is a self-hosted, web-based SSH console and SSH key management platform that acts like a bastion host with a dashboard. It provi… | 100 | 3551 | active |
| theajack/disable-devtool A lightweight TypeScript library that disables browser developer tools with one line of code, blocking F12, right-click, and browser menu a… | 57 | 3546 | active |
| SpacehuhnTech/esp8266_deauther ESP8266 Deauther is open-source firmware that turns an ESP8266 microcontroller into a WiFi testing tool capable of scanning networks, sendi… | 23 | 14997 | maintenance |
| epinna/weevely3 Weevely is a weaponized web shell for post-exploitation that generates a small obfuscated PHP agent to upload to a target web server, provi… | 40 | 3541 | active |
| openwrt-xiaomi/xmir-patcher XMiR-Patcher is a Python-based firmware patcher for Xiaomi routers that exploits vulnerabilities to unlock SSH and install custom firmware … | 75 | 3539 | active |
| ascending-llc/jarvis-registry Jarvis Registry is an open-source, enterprise-grade MCP and A2A agent gateway and workflow orchestration platform that gives AI copilots an… | 84 | 3531 | active |
| Meshbird Meshbird is an open-source cloud-native distributed private networking tool that creates encrypted peer-to-peer overlay networks across mul… | 51 | 3530 | active |
| stackrox/kube-linter KubeLinter is a static analysis CLI tool that checks Kubernetes YAML files, Helm charts, and Kustomize manifests against security and produ… | 84 | 3527 | active |
| BlackArch Linux BlackArch Linux is an Arch Linux-based penetration testing distribution bundling over 2,800 security tools for penetration testers and secu… | 76 | 3524 | active |
| Wifiphisher Wifiphisher is a rogue Access Point framework for Wi-Fi security testing and red team engagements, enabling man-in-the-middle positioning v… | 57 | 14873 | maintenance |
| gtworek/PSBits A collection of relatively simple C and PowerShell snippets for digging deeper into Windows internals, security, and forensics. Each folder… | 72 | 3518 | active |
| ConnectBot ConnectBot is an open-source Secure Shell (SSH) client for Android that lets users open encrypted shell sessions and transfer files with re… | 99 | 3515 | active |
| ueberauth/guardian Guardian is a token-based authentication library for Elixir applications, with JSON Web Tokens supported out of the box. It integrates with… | 81 | 3513 | stable |
| onecli/onecli OneCLI is an open-source platform that gives every employee a personal, sandboxed AI agent, with all tool calls routed through a gateway th… | 74 | 3511 | active |
| matthart1983/netwatch NetWatch is a zero-config terminal TUI for real-time network diagnostics, written in Rust and distributed as a single static binary. It sho… | 79 | 3504 | active |
| fofapro/vulfocus Vulfocus is a self-hosted vulnerability integration platform that runs vulnerability environments as Docker images with one-click startup. … | 38 | 3503 | active |
| t3l3machus/hoaxshell Hoaxshell is a Windows reverse shell payload generator and handler that abuses the HTTP(S) protocol to establish a beacon-like reverse shel… | 32 | 3499 | active |
| vulnersCom/nmap-vulners A collection of Nmap NSE scripts that enrich service scans with CVEs, CVSS scores and known exploits from the Vulners database. It fingerpr… | 95 | 3494 | active |
| KOWX712/Tricky-Addon-Update-Target-List A KernelSU/Apatch/Magisk WebUI addon for configuring Tricky Store's target.txt on rooted Android devices. It provides a graphical interface… | 84 | 3493 | active |
| sentient-agi/OML-1.0-Fingerprinting A Python library for embedding secret cryptographic fingerprints into LLMs via fine-tuning, so model owners can prove ownership and detect … | 13 | 3493 | active |
| TrustTunnel TrustTunnel is a modern open-source VPN protocol originally developed by AdGuard VPN, with this repository containing the VPN endpoint (ser… | 81 | 3489 | active |
| BloodHound Community Edition BloodHound Community Edition is a free, open-source application that uses graph theory to reveal hidden relationships and attack paths in A… | 91 | 3487 | active |
| ukanth/afwall AFWall+ is an open-source firewall application for rooted Android devices built on Linux iptables. It provides per-app granular control ove… | 91 | 3487 | active |
| JusticeRage/Gepetto Gepetto is an IDA Pro plugin that queries large language models (OpenAI, Anthropic, Gemini, Ollama, and others) to explain decompiled funct… | 73 | 3487 | active |
| sigp/lighthouse Lighthouse is an open-source Ethereum consensus (beacon chain) client written in Rust, maintained by Sigma Prime. It implements the Ethereu… | 98 | 3477 | stable |
| oblador/react-native-keychain A React Native library providing access to the iOS Keychain and Android Keystore for securely storing credentials such as passwords, tokens… | 66 | 3477 | stable |
| LSPosed/CorePatch Core Patch N is an Xposed module that modifies Android's package manager service to bypass installation restrictions. It disables APK signa… | 86 | 3476 | active |
| TextAttack TextAttack is a Python framework for generating adversarial examples against NLP models, as well as for data augmentation and model trainin… | 80 | 3471 | active |
| osqzss/gps-sdr-sim A C-based software-defined GPS signal simulator that generates GPS baseband I/Q sample streams from user-defined trajectories and broadcast… | 10 | 3468 | active |
| Laravel Auditing A Laravel/Lumen package that keeps a history of Eloquent model changes by adding a trait to models, storing audit records via configurable … | 91 | 3465 | stable |
| ropnop/kerbrute Kerbrute is a Go-based CLI tool for brute-forcing and enumerating valid Active Directory accounts through Kerberos Pre-Authentication. It o… | 23 | 3452 | stable |
| google/OpenSK OpenSK is an open-source Rust implementation of a FIDO2/FIDO U2F security key, developed by Google as a research platform. It can run as fi… | 67 | 3451 | active |
| google/timesketch Timesketch is an open-source web application for collaborative forensic timeline analysis, developed by Google. It lets DFIR investigators … | 95 | 3436 | active |
| L-codes/Neo-reGeorg Neo-reGeorg is a Python CLI tool that generates encrypted tunnel server files (aspx/jsp/php/etc.) to be uploaded to a compromised web serve… | 69 | 3433 | active |
| Snort++ Snort 3 (Snort++) is the next-generation open-source intrusion prevention system (IPS) written in C++17, supporting multi-threaded packet p… | 77 | 3428 | active |
| adrienverge/openfortivpn openfortivpn is a command-line client for PPP+TLS VPN tunnel services, compatible with Fortinet VPN gateways. It spawns a pppd process and … | 76 | 3428 | active |
| decalage2/oletools oletools is a Python package of tools for analyzing Microsoft OLE2 (Structured Storage/Compound File Binary Format) files and MS Office doc… | 49 | 3428 | active |
| EntySec/Ghost Ghost Framework is a Python-based Android post-exploitation framework that leverages the Android Debug Bridge (ADB) to gain remote access t… | 51 | 3425 | active |
| laravel/passport Laravel Passport is an OAuth2 server package for Laravel applications, built on the League OAuth2 server. It issues and manages access toke… | 99 | 3419 | active |
| ph4ntonn/Stowaway Stowaway is a multi-hop proxy tool written in Go, designed for penetration testers to route external traffic through chains of nodes into r… | 51 | 3419 | active |
| iamlive A Go CLI tool that generates IAM policies by monitoring AWS, Azure, or GCP API calls via client-side monitoring or an embedded proxy. It ob… | 77 | 3416 | active |
| opsdisk/pagodo pagodo is a Python CLI tool that automates passive Google dork searches by scraping the Google Hacking Database (GHDB) and running those qu… | 68 | 3412 | active |
| Yamato-Security/hayabusa Hayabusa is a fast, Rust-based Windows event log analysis tool that generates forensic timelines and performs threat hunting using Sigma de… | 95 | 3409 | active |
| endoflife.date A community-maintained website that aggregates end-of-life dates and support lifecycles for hundreds of products, including operating syste… | 77 | 3404 | active |
| paralleldrive/cuid2 Cuid2 is a JavaScript library and CLI for generating secure, collision-resistant unique identifiers optimized for horizontal scaling and pe… | 72 | 3402 | active |
| auth0/jwt-decode A small TypeScript library that decodes JWT tokens (Base64Url-encoded JSON) in browser and Node environments. It does not validate signatur… | 64 | 3399 | stable |
| paragonie/paseto A PHP reference implementation of PASETO (Platform-Agnostic Security Tokens), a secure alternative to JWT/JWS/JWE. It supports PASETO proto… | 36 | 3398 | stable |
| Netw0rkNoob/VulnClaw VulnClaw is an AI-driven penetration testing CLI tool that combines an LLM agent, MCP toolchain, and curated pentest skills to automate the… | 79 | 3397 | active |
| google/honggfuzz Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in bin… | 66 | 3397 | active |
| FairwindsOps/polaris Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration against 30+ built-in best-pract… | 97 | 3396 | active |
| H4ckForJob/dirmap Dirmap is an advanced web directory and file scanning tool written in Python, designed to be more powerful than DirBuster, Dirsearch, cansi… | 65 | 3375 | stable |
| PatchMon/PatchMon PatchMon is a self-hostable, AGPL-licensed Linux patch management and server monitoring platform with a lightweight outbound-only agent and… | 78 | 3368 | active |
| Metorial Metorial is an open-source identity and access control plane for AI agents, providing 1200+ verified MCP integrations with centralized auth… | 65 | 3367 | active |
| AChep/keyguard-app Keyguard is a multiplatform password manager client for the Bitwarden platform and KeePass (KDBX) files, built with Kotlin and Jetpack Comp… | 90 | 3366 | active |
| AdguardTeam/dnsproxy A DNS proxy server written in Go that supports all modern encrypted DNS protocols including DNS-over-TLS, DNS-over-HTTPS, DNSCrypt, and DNS… | 98 | 3365 | active |
| verus-lang/verus Verus is a verification tool for statically proving the correctness of Rust code against developer-written specifications, using SMT solver… | 96 | 3364 | active |
| SteamAutoCracks/Steam-auto-crack A C# tool that automatically cracks Steam games by unpacking SteamStub-protected executables and applying the Goldberg Steam emulator. It a… | 97 | 3360 | active |
| pypykatz pypykatz is a pure Python implementation of parts of Mimikatz, the well-known Windows credential extraction tool. It parses LSASS process m… | 59 | 3359 | active |
| curl/trurl trurl is a command line tool for parsing, manipulating, and normalizing URLs, built on libcurl's URL parser. It is designed like 'tr' but f… | 65 | 3357 | active |
| dbisu/pico-ducky A project that turns a Raspberry Pi Pico into a USB Rubber Ducky-style HID injection device running CircuitPython. It executes Ducky Script… | 65 | 3355 | active |
| RNCryptor RNCryptor is a Swift (and Objective-C) library wrapping CommonCrypto AES encryption, implementing a cross-language encrypted data format (v… | 25 | 3355 | stable |
| golang/crypto golang/crypto is the official supplementary cryptography library for the Go programming language, providing packages beyond the standard li… | 77 | 3351 | stable |
| workos/authkit AuthKit is WorkOS's authentication UI and User Management platform, offering a fully themeable hosted login box or a headless API for build… | 70 | 3346 | active |
| django-oauth/django-oauth-toolkit Django OAuth Toolkit is an OAuth 2.0 authorization server and resource server library for Django projects, built on OAuthLib and RFC 6749 c… | 92 | 3344 | active |
| randombit/botan Botan is a C++ cryptography library offering TLS 1.2/1.3, X.509 PKI, modern AEAD ciphers, post-quantum algorithms, and hardware token suppo… | 77 | 3336 | stable |
| almandin/fuxploider Fuxploider is an open-source penetration testing tool that automates detection and exploitation of file upload form vulnerabilities. It ide… | 28 | 3332 | active |
| chipsec/chipsec CHIPSEC is a Python framework for analyzing the security of PC platforms, including hardware, system firmware (BIOS/UEFI), and platform com… | 98 | 3314 | active |
| express-rate-limit/express-rate-limit A rate-limiting middleware library for the Express web server, written in TypeScript. It limits repeated requests per IP or key over config… | 99 | 3311 | stable |
| basil00/WinDivert WinDivert is a user-mode packet interception library for Windows that allows applications to capture, modify, drop, and re-inject network p… | 23 | 3305 | stable |
| achillean/shodan-python The official Python library and command-line interface for the Shodan search engine, which indexes Internet-connected devices and services.… | 23 | 3301 | stable |
| s0md3v/Smap Smap is a passive port scanner powered by Shodan.io's free API that serves as a drop-in replacement for Nmap, accepting the same command-li… | 83 | 3299 | active |
| goodwithtech/dockle Dockle is a container image linter written in Go that checks Docker images against security best practices and CIS Benchmarks. It runs as a… | 62 | 3298 | active |
| JPCERTCC/LogonTracer LogonTracer is a self-hosted DFIR tool that visualizes Windows Active Directory logon-related event logs as a graph of hosts and accounts t… | 74 | 3290 | active |
| Tunnelblick/Tunnelblick Tunnelblick is a free, open-source graphical user interface for OpenVPN on macOS, managing both client and server connections. It is a nati… | 95 | 3287 | active |
| techgaun/github-dorks A Python CLI tool that automates GitHub code searches using a curated list of dorks to find leaked secrets like credentials, private keys, … | 65 | 3287 | active |
| jsha/minica minica is a small Go CLI tool that acts as a minimal certificate authority for generating root and leaf TLS certificates with keys. It is d… | 37 | 3285 | active |
| deltazefiro/Amarok-Hider Amarok is a lightweight Android privacy app that hides private files and apps with a single click by obfuscating file signatures or permiss… | 72 | 3284 | active |
| vouch/vouch-proxy Vouch Proxy is an SSO and OAuth/OIDC authentication proxy for Nginx that uses the auth_request module to protect upstream sites. It support… | 75 | 3283 | active |
| dafthack/MailSniper MailSniper is a PowerShell-based penetration testing tool for searching email in Microsoft Exchange environments for sensitive terms like p… | 75 | 3281 | active |
| Legrandin/pycryptodome PyCryptodome is a self-contained Python package of low-level cryptographic primitives, forked from PyCrypto with an almost drop-in compatib… | 100 | 3276 | active |
| rustic rustic is a fast, encrypted, deduplicated backup tool written in Rust that reads and writes the restic repository format, making it a drop-… | 89 | 3276 | active |
| assetnote/kiterunner Kiterunner is a fast content discovery tool written in Go that bruteforces files, folders, and API routes on web servers. It uses a dataset… | 60 | 3272 | stable |
| guilhermerodz/input-otp input-otp is an accessible, unstyled React component for one-time passcode input that renders a single invisible real text input with custo… | 77 | 3268 | stable |
| Blokada Blokada is an open-source suite of mobile privacy apps for Android and iOS, including an ad blocker, VPN, and parental control app. It offe… | 67 | 3266 | active |
| QiuChenly/CoreInject CoreInject (successor to InjectLib) is a macOS application injection and binary-patching tool by QiuChenly, distributed alongside a communi… | 80 | 3264 | active |
| Checked C Checked C is an extension to the C programming language that adds bounds checking and improved type safety through opt-in annotations, impl… | 23 | 3263 | active |
| homenc/HElib HElib is an open-source C++ library implementing homomorphic encryption, supporting the BGV scheme with bootstrapping and the CKKS approxim… | 23 | 3252 | stable |
| rtcatc/Packer-Fuzzer Packer Fuzzer is a Python-based security scanner that targets websites built with JavaScript module bundlers like Webpack. It automatically… | 23 | 3250 | active |
| Tink Tink is a multi-language, cross-platform open source cryptographic library from Google that provides secure, easy-to-use APIs for encryptio… | 10 | 13538 | maintenance |