Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| the-tcpdump-group/tcpdump tcpdump is a powerful command-line packet analyzer that captures and dissects network traffic using libpcap, with BPF-based filtering and s… | 77 | 3246 | active |
| Devolutions/IronRDP IronRDP is a modular Rust implementation of the Microsoft Remote Desktop Protocol (RDP), providing PDU codecs, connection/session state mac… | 95 | 3243 | active |
| jherrodthomas/automotive-skills-suite A suite of 152 installable Claude skills (76 builder + 76 reviewer pairs) that generate structured automotive engineering deliverables as x… | 60 | 3243 | active |
| openid/AppAuth-Android AppAuth for Android is a client SDK for communicating with OAuth 2.0 and OpenID Connect providers from Android apps. It follows RFC 8252 be… | 62 | 3241 | active |
| biggerstar/wedecode Wedecode is a fully automated tool that decompiles WeChat mini-program and mini-game wxapkg packages back into readable source code (JS, WX… | 66 | 3239 | active |
| Mic92/sops-nix sops-nix is a NixOS module that provides atomic, declarative secret provisioning based on Mozilla's sops. It decrypts sops-encrypted files … | 68 | 3232 | active |
| tellerops/teller Teller is an open-source, developer-first CLI secret manager written in Rust that fetches secrets from multiple providers (HashiCorp Vault,… | 48 | 3232 | active |
| PartialVolume/shredos.x86_64 ShredOS is a small bootable Linux distribution for securely erasing disks using nwipe on x86 PCs, servers, and Intel-based Macs. It boots d… | 95 | 3231 | active |
| jaykali/maskphish MaskPhish is a simple Bash script that masks phishing URLs under normal-looking URLs (e.g., google.com or facebook.com) as a proof of conce… | 38 | 3230 | active |
| WG Tunnel WG Tunnel is a free and open-source Android client for WireGuard and AmneziaWG VPN tunnels, built in Kotlin with Jetpack Compose. It adds a… | 95 | 3227 | active |
| github/secure_headers A Ruby gem that manages the application of HTTP security response headers such as Content Security Policy, HSTS, and X-Frame-Options with s… | 81 | 3227 | stable |
| D3Ext/WEF WEF is a Wi-Fi Exploitation Framework written in Bash that automates a wide range of wireless attacks against WPA/WPA2/WPA3, WPS, and WEP n… | 48 | 3225 | active |
| matter-labs/zksync-era ZKsync Era is a ZK rollup layer 2 protocol for scaling Ethereum using zero-knowledge proofs, implemented primarily in Rust. It is EVM-compa… | 89 | 3224 | active |
| GuidoBartoli/sherloq Sherloq is an open-source digital image forensic toolset providing an integrated GUI environment for analyzing images for tampering and aut… | 70 | 3223 | active |
| LaurieWired/Malimite Malimite is a Java-based decompiler for iOS and macOS binaries, built on Ghidra, that analyzes IPA files and Application Bundles with direc… | 34 | 3222 | active |
| BinDiff BinDiff is an open-source comparison tool for binary files that finds differences and similarities in disassembled code using graph-theoret… | 62 | 3206 | active |
| pglombardo/PasswordPusher Password Pusher is an open-source Ruby web application for securely sharing passwords, text, files, and URLs via encrypted, self-deleting l… | 93 | 3201 | active |
| qltysh/qlty Qlty CLI is a multi-language code quality tool written in Rust that unifies linting, auto-formatting, maintainability analysis, and securit… | 95 | 3194 | active |
| devanshbatham/ParamSpider ParamSpider is a Python CLI tool that mines URLs for a domain or list of domains from web archives (Wayback Machine), filtering out uninter… | 51 | 3190 | active |
| s0md3v/Photon Photon is a fast Python-based web crawler designed for OSINT (open-source intelligence) tasks. It extracts URLs, emails, social media accou… | 65 | 13243 | maintenance |
| crytic/echidna Echidna is a Haskell-based fuzzer for Ethereum smart contracts that performs property-based testing by generating sequences of contract cal… | 86 | 3186 | active |
| Obfuscar Obfuscar is an open source MIT-licensed obfuscation tool for .NET assemblies that renames metadata to minimal names, making decompiled code… | 96 | 3185 | active |
| DynamoRIO/dynamorio DynamoRIO is a runtime code manipulation system that supports arbitrary code transformations on executing programs, with a powerful instruc… | 95 | 3181 | active |
| tale/headplane Headplane is a feature-complete web UI for Headscale, the self-hosted alternative to Tailscale's WireGuard-based VPN coordination server. I… | 89 | 3181 | active |
| pingc0y/URLFinder URLFinder is a fast, easy-to-use Go CLI tool that extracts JS files, URLs, and sensitive information from web pages, including hidden unaut… | 73 | 3181 | active |
| jhaals/yopass Yopass is a self-hostable web application for securely sharing secrets, passwords, and files via one-time, auto-expiring links. Secrets are… | 100 | 3180 | active |
| GH05TCREW/pentestagent PentestAgent is a Python-based AI agent framework for black-box penetration testing that orchestrates LLM-driven security testing workflows… | 64 | 3180 | active |
| sa7mon/S3Scanner A multi-threaded CLI tool written in Go that scans for misconfigured (open) S3 buckets across AWS and other S3-compatible providers like GC… | 62 | 3176 | active |
| the-tcpdump-group/libpcap libpcap is a system-independent C/C++ library providing a portable API for user-level network packet capture, with BPF-based filtering and … | 76 | 3174 | stable |
| RolifyCommunity/rolify rolify is a Ruby gem providing simple role management for Rails applications, with support for scoping roles to specific resource objects. … | 48 | 3174 | stable |
| pxb1988/dex2jar dex2jar is a set of Java-based command-line tools for working with Android .dex and Java .class files. It converts Dalvik executables (e.g.… | 23 | 13148 | maintenance |
| The Sleuth Kit Autopsy is a Java-based digital forensics platform providing a graphical interface to The Sleuth Kit and other open-source forensic tools f… | 79 | 3166 | active |
| NASA-SW-VnV/ikos IKOS is a static analyzer for C and C++ programs based on the theory of Abstract Interpretation, built on LLVM. It provides reusable abstra… | 57 | 3166 | active |
| aliasvault/aliasvault AliasVault is a privacy-first, end-to-end encrypted password manager with a built-in email alias server, letting users create unique identi… | 86 | 3164 | active |
| feder-cr/invisible_playwright A Python library that provides an antidetect, stealth-patched Firefox build for Playwright, with fingerprints set at the C++ engine level a… | 78 | 3160 | active |
| xiv3r/Burpsuite-Professional A shell-based installer that deploys Burp Suite Professional (a commercial web security testing toolkit) on Linux and NixOS, bundled with a… | 60 | 3159 | active |
| gorilla/sessions gorilla/sessions is a Go library providing cookie and filesystem session storage with infrastructure for custom session backends. It offers… | 23 | 3150 | stable |
| Virtual-Browser/VirtualBrowser VirtualBrowser is a free, open-source anti-fingerprint browser built on Chromium that lets users create and manage multiple isolated browse… | 87 | 3145 | active |
| seladb/PcapPlusPlus PcapPlusPlus is a multiplatform C++ library for capturing, parsing, and crafting network packets. It wraps popular packet processing engine… | 82 | 3144 | stable |
| CyberStrikeus/CyberStrike CyberStrike is an open-source AI-powered offensive security harness that runs automated penetration testing from the terminal. It orchestra… | 79 | 3141 | active |
| pallets/itsdangerous ItsDangerous is a Python library for cryptographically signing data so it can be safely passed to untrusted environments (like cookies or U… | 31 | 3134 | stable |
| nuver-labs/vps-audit A dependency-free Bash script that audits Linux VPS security and performance, running 18 graded checks covering SSH configuration, firewall… | 80 | 3132 | active |
| korcankaraokcu/PINCE PINCE is a GDB front-end and reverse engineering tool for Linux, focused on game hacking but usable for general reverse engineering. It pro… | 96 | 3130 | active |
| m0bilesecurity/RMS-Runtime-Mobile-Security Runtime Mobile Security (RMS) is a NodeJS-powered web interface built on FRIDA for manipulating Android and iOS apps at runtime. It lets us… | 82 | 3130 | active |
| F* F* is a general-purpose proof-oriented programming language combining dependent types with SMT-based proof automation and interactive theor… | 100 | 3123 | active |
| tegal1337/CiLocks CiLocks is a menu-driven Linux CLI toolkit for Android and iOS security testing, bundling lockscreen brute-force/bypass, ADB data extractio… | 23 | 3123 | active |
| Common Expression Language (CEL) cel-go is a Go implementation of the Common Expression Language (CEL), a fast, portable, non-Turing complete expression language with gradu… | 96 | 3121 | stable |
| squid-cache/squid Squid is a mature, full-featured caching web proxy supporting HTTP, HTTPS, and FTP, with extensive access controls, content adaptation via … | 93 | 3121 | stable |
| 21y4d/nmapAutomator nmapAutomator is a POSIX-compatible shell script that automates nmap-based network reconnaissance and enumeration, running scans in the bac… | 32 | 3115 | active |
| hardentools/hardentools Hardentools is a Windows utility that reduces the attack surface by disabling risky features in Windows 10/11, Microsoft Office, LibreOffic… | 35 | 3111 | active |
| adryfish/fingerprint-chromium A fingerprint browser built on Ungoogled Chromium that lets users spoof or control browser fingerprint characteristics to avoid detection. … | 83 | 3110 | active |
| opengrep/opengrep Opengrep is an open-source static application security testing (SAST) engine forked from Semgrep under LGPL-2.1, supporting pattern-based c… | 81 | 3106 | active |
| zegl/kube-score kube-score is a static code analysis tool for Kubernetes object definitions that scores manifests and Helm charts against reliability and s… | 57 | 3105 | active |
| Exegol Exegol is a container-based, community-driven hacking environment for offensive security professionals, managed through a Python CLI wrappe… | 97 | 3101 | active |
| chaterm/Chaterm Chaterm is an open-source AI-native terminal application for cloud and infrastructure management, letting engineers deploy, troubleshoot, a… | 82 | 3098 | active |
| InSpec Chef InSpec is an open-source testing framework for infrastructure that expresses compliance, security, and policy requirements as human- a… | 89 | 3097 | active |
| OpenSC/OpenSC OpenSC is a set of open-source libraries and command-line tools for working with smart cards, focused on cards that perform cryptographic o… | 76 | 3097 | active |
| LukeZGD/Legacy-iOS-Kit An all-in-one shell-based tool for restoring, downgrading, jailbreaking, and saving SHSH blobs on legacy iOS devices vulnerable to bootrom … | 68 | 3092 | active |
| ContainerSSH ContainerSSH is an SSH server written in Go that launches on-demand containers in Docker or Kubernetes for each connecting user. It support… | 77 | 3087 | active |
| jasypt-spring-boot A Spring Boot integration of the Jasypt library that enables transparent encryption and decryption of property sources in Spring Boot appli… | 62 | 3086 | active |
| outroll/vesta Vesta is an open-source (GPLv3) hosting control panel for Linux servers that manages websites, DNS, mail, databases, cron jobs, backups, an… | 62 | 3082 | active |
| darkoperator/dnsrecon DNSRecon is a Python-based DNS enumeration tool for security assessments and network troubleshooting. It supports zone transfer checks, gen… | 89 | 3080 | active |
| hwdsl2/wireguard-install A Bash script that automates setting up a WireGuard VPN server on various Linux distributions, with interactive and fully automatic install… | 75 | 3076 | active |
| SharpAI/DeepCamera DeepCamera is an open-source AI camera skills platform that runs local VLM scene analysis, object detection, face recognition, and person r… | 86 | 3075 | active |
| liboqs liboqs is an open source C library providing implementations of quantum-resistant (post-quantum) key encapsulation mechanisms and digital s… | 84 | 3071 | active |
| projectdiscovery/proxify Proxify is a portable MITM proxy written in Go for capturing, filtering, manipulating, and replaying HTTP/HTTPS and non-HTTP traffic. It su… | 65 | 3070 | active |
| projectdiscovery/uncover uncover is a Go CLI tool that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye, and others) via their APIs to quickl… | 80 | 3064 | active |
| Stacks The reference Rust implementation of the Stacks blockchain, a layer-2 network secured by Bitcoin via Proof of Transfer (PoX) mining. It run… | 94 | 3061 | active |
| chromium/badssl.com badssl.com is a hosted collection of test subdomains, each deliberately configured with a broken or unusual TLS/SSL setup (expired certific… | 67 | 3051 | active |
| thinkst/opencanary OpenCanary is a modular, multi-protocol network honeypot daemon written in Python, designed to detect attackers after they breach internal … | 88 | 3050 | active |
| Alfredredbird/tookie-osint Tookie-OSINT is an open-source Python OSINT tool that finds social media accounts and gathers information based on user inputs. It offers a… | 81 | 3046 | active |
| Inveigh Inveigh is a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers, with a primary C# version and a legacy Power… | 46 | 3043 | active |
| jeremykenedy/laravel-auth A complete Laravel 12 starter application with email registration verification, social authentication via Socialite, user roles and permiss… | 98 | 3041 | active |
| RfidResearchGroup/ChameleonUltra ChameleonUltra is the open-source firmware for an RFID/NFC card emulation device based on the NRF52840, capable of reading, writing, decryp… | 80 | 3040 | active |
| Qianlitp/crawlergo crawlergo is a Go-based browser crawler that uses headless Chrome to discover URLs for web vulnerability scanners. It renders pages, fills … | 24 | 3039 | active |
| mgeeky/Penetration-Testing-Tools A curated collection of 170+ penetration testing tools, scripts, and cheatsheets developed by the author over years of red teaming and IT s… | 32 | 3030 | active |
| aws-actions/configure-aws-credentials A GitHub Action that configures AWS credential environment variables for use in subsequent workflow steps. It supports OIDC federation for … | 97 | 3013 | active |
| evgenyneu/keychain-swift A Swift library providing simple helper functions for securely storing and retrieving text, boolean, and Data values in the Apple Keychain.… | 32 | 3013 | stable |
| Manisso/fsociety Fsociety is a Python-based penetration testing framework that bundles a menu of hacking tools covering information gathering, password atta… | 70 | 12354 | maintenance |
| thewhiteh4t/FinalRecon FinalRecon is an all-in-one automatic web reconnaissance tool written in Python that provides a fast overview of a web target. It bundles h… | 67 | 3006 | active |
| confident-ai/deepteam DeepTeam is an open-source Python framework for red teaming LLM systems, AI agents, RAG pipelines, and chatbots. It simulates adversarial a… | 65 | 3005 | active |
| sepinf-inc/IPED IPED is an open source digital forensic tool developed by the Brazilian Federal Police for processing and analyzing digital evidence from d… | 79 | 3003 | active |
| oritera/Cairn Cairn is a general-purpose AI state-space search engine built on a blackboard architecture with a fact-intent graph, where LLM agent worker… | 71 | 2997 | active |
| strongSwan strongSwan is an open-source, modular IPsec-based VPN solution implementing the IKEv2 (and IKEv1) key exchange protocols for securing IP tr… | 88 | 2994 | stable |
| baidu/openrasp OpenRASP is Baidu's open-source Runtime Application Self-Protection (RASP) solution that embeds a protection engine directly into the appli… | 39 | 2987 | stable |
| laravel/sanctum Laravel Sanctum is a featherweight authentication package for Laravel that issues API tokens and authenticates single-page applications, mo… | 95 | 2986 | stable |
| makoto56/penetration-suite-toolkit A preconfigured Windows 11 penetration testing toolkit distributed as a VM image, bundling a large curated collection of security tools wit… | 30 | 2983 | active |
| oauthlib/oauthlib OAuthLib is a Python framework implementing the OAuth 1.0 (RFC 5849) and OAuth 2.0 (RFC 6749) request-signing and authorization logic in a … | 72 | 2982 | stable |
| eteran/edb-debugger edb is a cross-platform AArch32/x86/x86-64 debugger inspired by OllyDbg, built with Qt and Capstone. It provides a graphical interface for … | 68 | 2980 | active |
| v0id4real/Void-Tools Void-Tools is a Python terminal multitool with a Rich TUI dashboard bundling 150+ utilities for OSINT research, network diagnostics, and Di… | 50 | 2979 | active |
| bethgelab/foolbox Foolbox is a Python library for generating adversarial examples that fool deep neural networks, with state-of-the-art gradient-based and de… | 44 | 2979 | active |
| kamailio/kamailio Kamailio is an open source SIP signaling server (RFC3261) written in C, designed for large-scale VoIP and real-time communication platforms… | 95 | 2978 | stable |
| bytenode/bytenode Bytenode is a minimalist bytecode compiler that compiles JavaScript into V8 bytecode (.jsc files) to protect source code. It works with Nod… | 75 | 2976 | active |
| google/osv.dev OSV (Open Source Vulnerabilities) is Google's open, distributed vulnerability database and triage service that aggregates security advisori… | 90 | 2973 | stable |
| microsoft/AttackSurfaceAnalyzer Attack Surface Analyzer is a Microsoft open-source security tool that scans an operating system's security configuration before and after s… | 81 | 2971 | active |
| ntop/PF_RING PF_RING is a Linux kernel module and user-space framework for high-speed packet capture and processing, offering a consistent API for netwo… | 84 | 2970 | stable |
| appleboy/gin-jwt A JWT authentication middleware for the Gin web framework in Go, built on golang-jwt/jwt. It provides login handling, token refresh, and ro… | 96 | 2969 | active |
| palahsu/DDoS-Ripper DDoS-Ripper (DRipper) is a Python command-line tool that floods a target IP with traffic to simulate a distributed denial-of-service attack… | 68 | 2966 | active |
| TheOfficialFloW/PPPwn PPPwn is a proof-of-concept kernel remote code execution exploit for PlayStation 4 consoles up to firmware 11.00, exploiting CVE-2006-4304 … | 25 | 2965 | active |
| wolfSSL/wolfssl wolfSSL is a lightweight, portable SSL/TLS library written in ANSI C, supporting TLS 1.3 and DTLS 1.3, powered by the wolfCrypt cryptograph… | 94 | 2961 | stable |