Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| firecracker-microvm/firecracker-containerd firecracker-containerd is a set of components that lets containerd manage containers running inside Firecracker microVMs, combining fast co… | 75 | 2961 | active |
| pquerna/otp A Go library implementing Time-based (TOTP, RFC 6238) and HMAC-based (HOTP, RFC 4228) one-time password algorithms for adding two-factor au… | 35 | 2960 | stable |
| onetimesecret/onetimesecret A self-hostable web service for sharing sensitive information like passwords via single-use, self-destructing links. Written in Ruby with R… | 95 | 2958 | active |
| microsoft/restler-fuzzer RESTler is the first stateful REST API fuzzing tool, automatically testing cloud services through their REST APIs to find security and reli… | 67 | 2957 | active |
| jayofelony/pwnagotchi Pwnagotchi is a Raspberry Pi-based Wi-Fi penetration-testing gadget that leverages Bettercap to passively sniff or actively attack nearby W… | 90 | 2956 | active |
| elseif/MikroTikPatch A Python-based tool that patches MikroTik RouterOS public keys and generates licenses, enabling shell access, container mode, and highest-l… | 87 | 2955 | active |
| i-am-shodan/USBArmyKnife USB Army Knife is firmware for ESP32-based USB devices (like the T-Dongle-S3) that turns them into a close-access penetration testing tool.… | 73 | 2954 | active |
| netwrix/pingcastle PingCastle is a C# tool that assesses the security posture of Active Directory and Entra ID environments, producing risk scores, health che… | 87 | 2953 | active |
| scottyab/rootbeer RootBeer is an Android library that detects whether a device has been rooted using multiple Java and native checks such as scanning for su … | 61 | 2952 | active |
| SnaffCon/Snaffler Snaffler is a C# command-line tool for pentesters and red teamers that enumerates Windows/AD environments to find sensitive files (mostly c… | 62 | 2945 | active |
| Padloc Padloc is an open-source, end-to-end encrypted password manager for individuals and teams, built as a monorepo with a Node.js backend serve… | 25 | 2923 | active |
| Apache Casbin Node-Casbin is an open-source authorization library for Node.js and Browser that enforces access control based on configurable models such … | 91 | 2918 | stable |
| Roave/SecurityAdvisories A Composer package that acts as an exclusion list of known security vulnerabilities, preventing installation of dependency versions with do… | 75 | 2918 | active |
| zinja-coder/jadx-ai-mcp A JADX plugin that bundles an MCP server, allowing LLM clients like Claude to interact with the JADX decompiler for Android APK analysis. I… | 88 | 2915 | active |
| FiloSottile/yubikey-agent yubikey-agent is a seamless ssh-agent that stores SSH keys on YubiKey hardware via the PIV smartcard interface. It runs in the background, … | 32 | 2913 | stable |
| calebstewart/pwncat pwncat is a post-exploitation platform and handler for reverse and bind shells, written in Python. It wraps raw shell communication with an… | 10 | 2913 | active |
| destan19/OpenAppFilter OpenAppFilter (OAF) is a parental control and application filtering plugin for OpenWrt routers, built as a kernel module, service daemon, a… | 91 | 2904 | active |
| pwndoc/pwndoc PwnDoc is a self-hosted web application for writing penetration test findings and generating customizable Docx reports. It supports multi-u… | 94 | 2895 | active |
| pyllyukko/user.js A hardened user.js configuration template for Mozilla Firefox that enforces security and privacy settings. It limits tracking, fingerprinti… | 63 | 2893 | active |
| flozz/p0wny-shell p0wny@shell is a single-file PHP webshell that provides a browser-based terminal for executing commands on a remote server. It is designed … | 35 | 2891 | active |
| zhizhuodemao/js-reverse-mcp An MCP server that gives AI coding agents (Claude, Cursor, Copilot) tools for JavaScript reverse engineering in a headed Chrome browser, in… | 79 | 2881 | active |
| projectdiscovery/dnsx dnsx is a fast, multi-purpose DNS toolkit from ProjectDiscovery for running DNS queries (A, AAAA, CNAME, PTR, NS, MX, TXT, SRV, SOA) with u… | 84 | 2880 | active |
| mrexodia/TitanHide TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and alteri… | 68 | 2872 | active |
| voidauth/voidauth VoidAuth is an open-source single sign-on (SSO) and user management provider for self-hosted applications, acting as an OIDC provider, prox… | 86 | 2870 | active |
| gdbinit/MachOView A macOS GUI application for viewing and exploring Mach-O binary files, revived as a maintained fork with a universal x86_64/arm64 build. It… | 32 | 2869 | active |
| defguard Defguard is a self-hosted zero-trust access management platform combining WireGuard VPN with built-in MFA/2FA, identity and access manageme… | 99 | 2866 | active |
| LimerBoy/Impulse Impulse is a Python-based denial-of-service toolkit that bundles multiple attack methods including SYN, UDP, ICMP, HTTP floods, Slowloris, … | 35 | 2864 | active |
| digininja/CeWL CeWL is a Ruby command-line tool that spiders a target website to a specified depth and collects unique words into a custom wordlist for us… | 59 | 2862 | stable |
| Minisign Minisign is a dead simple command-line tool for signing files and verifying digital signatures using the Ed25519 public-key signature syste… | 67 | 2858 | stable |
| glauth/glauth GLAuth is a lightweight, secure LDAP authentication server written in Go with configurable backends. It serves as a simple alternative to O… | 92 | 2857 | active |
| OpenCVE OpenCVE is a self-hostable Vulnerability Intelligence Platform that aggregates CVE data from sources like MITRE, NVD, CISA KEV, Vulnrichmen… | 90 | 2841 | active |
| acme-dns acme-dns is a simplified DNS server with a RESTful HTTP API designed to automate ACME DNS challenges for Let's Encrypt and other ACME certi… | 77 | 2838 | active |
| gkbrk/slowloris A Python rewrite of the Slowloris low-bandwidth HTTP Denial of Service attack tool. It holds many connections open to threaded web servers … | 32 | 2838 | stable |
| quay/quay Project Quay is an open-source container image registry that builds, stores, and distributes container images. It implements the Docker Reg… | 95 | 2835 | active |
| eycorsican/leaf Leaf is a versatile and efficient proxy framework written in Rust, supporting multiple proxy protocols such as Shadowsocks, Trojan, VMess, … | 86 | 2833 | active |
| evi0s/WMPFDebugger A debugger tweak for WeChat's Mini-Program Framework (WMPF) that exploits the remote debug feature of WeChat devtools to enable full Chrome… | 64 | 2832 | active |
| visa/visa-vulnerability-agentic-harness VVAH is Visa's open-source agentic harness for autonomous vulnerability discovery, remediation, and validation using frontier AI models. It… | 77 | 2830 | active |
| screetsec/TheFatRat TheFatRat is a menu-driven exploiting tool that automates MSFvenom and Metasploit to generate backdoors and payloads for Windows, Linux, Ma… | 23 | 11505 | maintenance |
| bezhanSalleh/filament-shield A Filament plugin that adds role and permission-based access management to Filament admin panels, built on spatie/laravel-permission. It ge… | 95 | 2828 | active |
| Gedsh/InviZible InviZible Pro is an Android application that combines Tor, DNSCrypt, and Purple I2P modules to provide online privacy, anonymity, and acces… | 99 | 2827 | active |
| Piston Piston is a high performance general purpose code execution engine that safely runs untrusted and potentially malicious code in isolated en… | 62 | 2827 | active |
| openalpr/openalpr OpenALPR is an open-source Automatic License Plate Recognition (ALPR) library written in C++ that analyzes images and video streams to dete… | 23 | 11462 | maintenance |
| zema1/suo5 Suo5 is a high-performance HTTP tunneling tool that creates a local SOCKS5 forward proxy by tunneling traffic through a compromised web ser… | 80 | 2815 | active |
| ALTCHA ALTCHA is an open-source, privacy-first CAPTCHA alternative that protects websites, forms, and APIs from bots and spam using a proof-of-wor… | 94 | 2804 | active |
| Tecnativa/docker-socket-proxy A security-enhanced HAProxy-based proxy that sits in front of the Docker socket and restricts which Docker API requests are allowed. It ret… | 83 | 2804 | active |
| libkrun/libkrun libkrun is a dynamic library that lets programs run processes in partially isolated environments using KVM virtualization on Linux and HVF … | 99 | 2802 | active |
| authpass/authpass AuthPass is a free, open-source password manager built with Flutter that is compatible with KeePass 2.x (KDBX 3 and KDBX 4) databases. It r… | 65 | 2802 | active |
| ryfineZ/codex-session-patcher A Python tool that cleans AI refusal responses from Codex CLI, Claude Code, and OpenCode session files so conversations can be resumed, wit… | 73 | 2797 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 37 | 2797 | active |
| panda-re/panda PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and r… | 91 | 2782 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 98 | 2776 | active |
| protectai/vulnhuntr Vulnhuntr is a Python CLI tool that uses large language models combined with static code analysis to autonomously discover exploitable vuln… | 23 | 2775 | active |
| hfiref0x/KDU KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Dri… | 93 | 2770 | active |
| MeowDump/Integrity-Box Integrity Box is a Magisk module toolkit for rooted Android devices that manages Play Integrity attestation and system environment signals.… | 88 | 2769 | active |
| pucherot/Pi.Alert Pi.Alert is a self-hosted WIFI/LAN intruder detector that scans the local network for connected devices using arp-scan, Pi-hole, and dnsmas… | 23 | 2768 | active |
| xnl-h4ck3r/waymore waymore is a Python CLI tool that retrieves URLs from multiple web archive and intelligence sources (Wayback Machine, Common Crawl, Alien V… | 83 | 2762 | active |
| rubysec/bundler-audit bundler-audit is a command-line tool that audits a Ruby project's Gemfile.lock for gems with known vulnerabilities using the ruby-advisory-… | 70 | 2760 | active |
| awnumar/memguard MemGuard is a pure Go library that securely stores sensitive information in memory, encrypting it with XSalsa20Poly1305 and bypassing the g… | 67 | 2760 | active |
| pongoOS PongoOS is a pre-boot execution environment for Apple boards, built on top of the checkra1n jailbreak tool. It provides an interactive shel… | 32 | 2759 | active |
| Bearer/bearer Bearer CLI is an open-source static application security testing (SAST) tool written in Go that scans source code and analyzes data flows t… | 92 | 2758 | active |
| salarcode/SmartProxy SmartProxy is a Firefox, Chrome, and Edge browser extension that automatically enables or disables proxy usage per website based on customi… | 88 | 2748 | active |
| asLody/VirtualApp VirtualApp is an Android virtualization/sandbox engine that lets apps run inside a host app without being installed on the system, acting a… | 76 | 11104 | maintenance |
| calebmadrigal/trackerjacker A Python CLI tool that maps nearby WiFi networks and their connected devices via raw 802.11 monitor-mode packet capture, similar to nmap bu… | 52 | 2743 | active |
| f0rb1dd3n/Reptile Reptile is a Linux kernel module (LKM) rootkit written in C that provides privilege escalation, file/process/network connection hiding, per… | 63 | 2742 | active |
| sheeki03/tirith Tirith is a Rust-based terminal security tool that intercepts shell commands, pasted content, and files to block threats like homograph URL… | 76 | 2741 | active |
| NetSPI/PowerUpSQL PowerUpSQL is a PowerShell toolkit for attacking and auditing SQL Server instances, supporting discovery, weak configuration auditing, priv… | 32 | 2741 | active |
| ROADtools ROADtools is a Python framework for interacting with Azure AD/Entra ID, comprising the roadlib authentication library, the ROADrecon explor… | 72 | 2737 | active |
| aboul3la/Sublist3r Sublist3r is a Python command-line tool that enumerates subdomains of a target domain using OSINT sources such as Google, Bing, Yahoo, Baid… | 23 | 11051 | maintenance |
| securing/IOSSecuritySuite iOS Security Suite is a Swift library for iOS platform security and anti-tampering checks. It detects jailbroken devices, attached debugger… | 80 | 2733 | active |
| ankit0183/Wifi-Hacking A Python-based menu-driven CLI tool that automates Wi-Fi penetration testing by wrapping built-in Kali Linux wireless tools. It supports mo… | 56 | 2733 | active |
| I2P I2P (Invisible Internet Project) is the reference Java implementation of a decentralized, anonymizing peer-to-peer overlay network that rou… | 91 | 2730 | stable |
| ComodoSecurity/openedr OpenEDR is an open-source Endpoint Detection and Response (EDR) agent written in C++ that records endpoint telemetry, process hierarchies, … | 57 | 2730 | active |
| AxtMueller/Windows-Kernel-Explorer Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a ke… | 54 | 2724 | active |
| patterniha/SNI-Spoofing A Python CLI tool that bypasses Deep Packet Inspection (DPI) by manipulating IP and TCP headers, such as spoofing SNI fields. It is used to… | 48 | 2719 | active |
| Checkmarx/kics KICS (Keeping Infrastructure as Code Secure) is an open-source static analysis tool by Checkmarx that scans IaC files for security vulnerab… | 97 | 2717 | active |
| mubeng/mubeng mubeng is a fast CLI tool written in Go that checks the availability of proxies from a list and rotates your IP address per request via a l… | 72 | 2713 | active |
| decompiler-explorer/decompiler-explorer A web service (like Compiler Explorer in reverse) that lets users upload small binaries and compare the decompiled C-like output from many … | 77 | 2711 | active |
| worawit/blutter Blutter is a reverse engineering tool for Flutter mobile applications that compiles the Dart AOT runtime to extract symbols and objects fro… | 69 | 2711 | active |
| openai/privacy-filter OpenAI Privacy Filter is a small bidirectional token-classification model (1.5B total, 50M active parameters) for detecting and masking per… | 46 | 2711 | active |
| cisagov/ScubaGear ScubaGear is a PowerShell-based assessment tool that checks whether a Microsoft 365 tenant's configuration conforms to CISA's Secure Config… | 82 | 2707 | active |
| 7h30th3r0n3/Evil-M5Project Evil-M5Project is a C++ firmware/tool for M5Stack devices (Cardputer, AtomS3, Fire, Core2) that scans, monitors, and interacts with WiFi ne… | 71 | 2703 | active |
| TermuxHackz/X-osint X-osint is an open-source Python-based OSINT framework for gathering information about phone numbers, email addresses, IP addresses, VINs, … | 69 | 2701 | active |
| Bouncy Castle Bouncy Castle is a comprehensive open-source cryptographic library for Java (and C#/.NET) implementing a wide range of algorithms, a JCA/JC… | 76 | 2697 | stable |
| lissy93/networking-toolbox Networking Toolbox is a collection of 100+ free, open-source networking utilities for system administrators and network engineers, covering… | 67 | 2696 | active |
| MetapriseAI/OrgKernel OrgKernel is an open-source trust layer for AI agents providing cryptographic agent identity (Ed25519), scoped execution tokens, SHA-256 ha… | 53 | 2685 | active |
| Packet Sender Packet Sender is a free, open-source cross-platform utility for sending and receiving TCP, UDP, SSL, and DTLS packets, plus HTTP/HTTPS requ… | 83 | 2684 | active |
| Elkeid Elkeid is an open-source cloud workload protection platform from ByteDance that provides host intrusion detection (HIDS), runtime applicati… | 67 | 2683 | active |
| OnionBrowser/OnionBrowser Onion Browser is a free, open-source privacy-focused web browser for iPhone and iPad that tunnels web traffic through the Tor anonymity net… | 95 | 2681 | active |
| samugit83/redamon RedAmon is an AI-powered agentic red team framework that automates offensive security operations end-to-end, chaining reconnaissance, explo… | 80 | 2681 | active |
| rthalley/dnspython dnspython is a DNS toolkit for Python supporting nearly all record types, queries, zone transfers, dynamic updates, TSIG, EDNS0, DNSSEC, an… | 87 | 2680 | stable |
| arthaud/git-dumper git-dumper is a Python CLI tool that reconstructs a full git repository from a website that exposes its .git directory, even when directory… | 83 | 2678 | stable |
| sunscrapers/djoser Djoser is a Python library providing REST endpoints for Django's authentication system via Django REST Framework. It offers views for regis… | 82 | 2678 | active |
| aforensics/HiddenVM HiddenVM is a free, open-source Linux application that lets you run Oracle VirtualBox on the Tails operating system, so almost any desktop … | 23 | 2678 | active |
| scambra/devise_invitable A Ruby gem that extends the Devise authentication framework for Rails with invitation functionality. It lets authenticated users invite oth… | 75 | 2674 | active |
| caido/caido Caido is a lightweight web security auditing toolkit and HTTP proxy for intercepting, viewing, and modifying traffic between browsers and w… | 94 | 2672 | active |
| outflanknl/RedELK RedELK is a self-hosted SIEM built on the Elastic stack (Elasticsearch, Logstash, Kibana) tailored for red team operations. It aggregates a… | 66 | 2671 | active |
| projectdiscovery/vulnx vulnx is a Go-based command-line tool from ProjectDiscovery for searching, filtering, and analyzing vulnerability data such as CVEs. It sup… | 80 | 2670 | active |
| Moham3dRiahi/Th3inspector Th3inspector is an all-in-one Perl CLI tool for information gathering (OSINT reconnaissance). It bundles lookups such as website info, whoi… | 36 | 2668 | active |
| TrackerControl/tracker-control-android TrackerControl is an Android app that monitors and blocks hidden tracking and ads in mobile apps using a local VPN to analyze network traff… | 95 | 2666 | active |
| 0x6d69636b/windows_hardening HardeningKitty is a PowerShell module that audits and hardens Windows systems against security baselines such as CIS Benchmarks, Microsoft … | 80 | 2665 | active |