Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| cve-search cve-search is a tool-set that imports CVE and CPE data into a local MongoDB to enable fast, private searching of known software vulnerabili… | 82 | 2656 | active |
| thewhiteh4t/pwnedOrNot pwnedOrNot is a Python command-line OSINT tool that checks email addresses against the HaveIBeenPwned v3 API for past breaches and then sea… | 62 | 2656 | active |
| Apache Casbin jCasbin is an Apache-licensed Java authorization library that enforces access control using models such as ACL, RBAC, and ABAC defined in c… | 86 | 2650 | stable |
| LibAFL LibAFL is a Rust library of reusable building blocks for constructing custom coverage-guided fuzzers, developed by the AFL++ team. It scale… | 90 | 2649 | active |
| Keystone Assembler Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework implemented in C/C++ with bindings for many languages. It … | 67 | 2649 | active |
| REhints/HexRaysCodeXplorer HexRaysCodeXplorer is a Hex-Rays Decompiler plugin written in C++ that improves code navigation during reverse engineering. It automates re… | 44 | 2641 | active |
| musana/CF-Hero CF-Hero is a Go-based reconnaissance CLI tool that discovers the real origin IP addresses of Cloudflare-protected web applications. It aggr… | 63 | 2640 | active |
| ScanCode ScanCode Toolkit is a command-line tool and Python library that scans codebases to detect licenses, copyrights, package manifests, dependen… | 91 | 2635 | active |
| botswin/BotBrowser BotBrowser is a privacy-focused browser core (Chromium-based) that unifies and controls browser fingerprint signals across platforms, integ… | 85 | 2632 | active |
| honmashironeko/ProxyCat ProxyCat is a self-hosted tunnel proxy pool middleware that turns short-lived proxy IPs into a stable fixed tunnel endpoint over HTTP/SOCKS… | 85 | 2632 | active |
| KubeArmor KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking behavior of p… | 100 | 2631 | active |
| Ericsson/codechecker CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools like Clang Static Analyzer a… | 97 | 2630 | active |
| SummerSec/ShiroAttack2 A Java-based exploitation tool for the Apache Shiro-550 rememberMe deserialization vulnerability, offering both a JavaFX GUI and a CLI. It … | 82 | 2630 | active |
| rbsec/sslscan sslscan is a command-line tool that tests SSL/TLS enabled services to discover supported cipher suites, protocols, key exchange groups, and… | 88 | 2628 | active |
| JingMatrix/TEESimulator TEESimulator is an Android module that defeats hardware-backed key attestation by running AOSP's reference KeyMint trusted application insi… | 81 | 2627 | active |
| massgravel/TSforge TSforge is a C# command-line tool implementing a collection of activation and evaluation extension methods for Windows Vista through 11, in… | 56 | 2626 | active |
| TestDisk & PhotoRec TestDisk and PhotoRec are free, open-source data recovery utilities written in C. TestDisk recovers lost partitions and repairs boot sector… | 76 | 2625 | stable |
| alexedwards/scs SCS is an HTTP session management library for Go that automatically loads and saves session data via middleware. It supports 19 server-side… | 43 | 2623 | stable |
| auth0/angular2-jwt An Angular library that provides an HttpInterceptor to automatically attach JSON Web Tokens to HttpClient requests. It handles token attach… | 66 | 2622 | active |
| Wasabi Wallet Wasabi Wallet is an open-source, non-custodial, privacy-focused Bitcoin desktop wallet built in C# on .NET. It routes all traffic through T… | 94 | 2621 | active |
| ory/fosite Fosite is a security-first, extensible OAuth 2.0 and OpenID Connect SDK for Go, implementing RFC 6749, RFC 6819, PKCE, and OpenID Connect C… | 54 | 2618 | active |
| snake-4/Zygisk-Assistant A Zygisk module written in C++ that hides the existence of root and Zygisk from apps on Android 5.0 and above. It works with KernelSU, Magi… | 49 | 2618 | active |
| oxsecurity/megalinter MegaLinter is an open-source code quality tool that runs over 50 linters and formatters covering 50 languages, 22 formats, and 21 tooling f… | 93 | 2615 | active |
| segmentio/chamber Chamber is a Go CLI tool for managing application secrets by storing them in AWS SSM Parameter Store (with S3 backend support). It lets tea… | 71 | 2615 | active |
| FreeRADIUS/freeradius-server FreeRADIUS is a high-performance, highly configurable multi-protocol policy server supporting RADIUS, DHCPv4/v6, DNS, TACACS+, and VMPS, wr… | 84 | 2614 | stable |
| googleprojectzero/winafl WinAFL is a Windows fork of American Fuzzy Lop (AFL) for coverage-guided fuzzing of Windows binaries, including closed-source black-box tar… | 61 | 2612 | active |
| EDL (Qualcomm Sahara/Firehose Tools) A Python CLI tool for communicating with Qualcomm devices in EDL (Emergency Download) mode via the Sahara, Firehose, Streaming, and Diag pr… | 66 | 2611 | active |
| shaka-project/shaka-packager Shaka Packager is a media packaging tool and SDK for preparing video content for online streaming via DASH and HLS. It supports VOD and liv… | 91 | 2610 | active |
| gaasedelen/lighthouse Lighthouse is a code coverage explorer plugin for IDA Pro and Binary Ninja that lets reverse engineers interactively visualize execution co… | 49 | 2609 | stable |
| uxmal/reko Reko is a general-purpose binary decompiler that translates machine code executables back into high-level language source. It supports mult… | 89 | 2607 | active |
| lexik/LexikJWTAuthenticationBundle A Symfony bundle that provides JSON Web Token (JWT) authentication for Symfony APIs. It handles token creation, validation, and integration… | 65 | 2605 | stable |
| mas-bandwidth/netcode A C library implementing a secure, connection-oriented client/server protocol on top of UDP for real-time multiplayer games. It handles enc… | 98 | 2599 | active |
| BishopFox/cloudfox CloudFox is an open-source command line tool by Bishop Fox that automates situational awareness and enumeration in cloud environments, prim… | 88 | 2598 | active |
| Keycloakify Keycloakify is a TypeScript build tool that generates Keycloak themes (login, register, email pages) using modern web frameworks like React… | 95 | 2597 | active |
| sidex15/susfs4ksu-module A KernelSU addon module that installs userspace helpers (ksu_susfs, sus_su) to communicate with a SUSFS-patched kernel for kernel-level roo… | 83 | 2597 | active |
| beenuar/AiSOC AiSOC is an open-source, self-hostable AI-powered Security Operations Center that fuses alerts, performs agent-assisted triage, purple-team… | 82 | 2594 | active |
| SysReptor SysReptor is a customizable pentest reporting platform for penetration testers and red teamers, supporting report design in HTML, writing i… | 97 | 2592 | active |
| libpnet/libpnet libpnet is a cross-platform Rust library for low-level networking, providing safe packet construction and parsing, transport protocol imple… | 55 | 2591 | stable |
| mewebstudio/captcha A Laravel service provider package that generates CAPTCHA images for form protection, supporting Laravel 5 through 12. It offers session-ba… | 89 | 2589 | active |
| cisco-ai-defense/skill-scanner A security scanner for AI agent skills that detects prompt injection, data exfiltration, and malicious code patterns using pattern-based de… | 82 | 2587 | active |
| nelenkov/android-backup-extractor A Java command-line utility that extracts and repacks Android backup archives created with adb backup, based on AOSP's BackupManagerService… | 82 | 2585 | active |
| boxlite-ai/boxlite BoxLite is an embeddable micro-VM runtime written in Rust that runs any OCI image inside hardware-isolated virtual machines (KVM on Linux, … | 84 | 2583 | active |
| refraction-networking/utls uTLS is a fork of Go's crypto/tls library that provides low-level access to the TLS ClientHello message, enabling fingerprint mimicry and r… | 79 | 2582 | active |
| pythops/oryx Oryx is a terminal user interface (TUI) application for sniffing and inspecting network traffic in real time using eBPF on Linux. It also p… | 70 | 2581 | active |
| rednaga/APKiD APKiD is a command-line tool that identifies how an Android APK was built, detecting compilers, packers, obfuscators, and app-shielding/RAS… | 75 | 2577 | active |
| lgandx/PCredz PCredz is a Python CLI tool that extracts credentials and authentication tokens (NTLM, Kerberos, HTTP Basic, FTP, SMTP, IMAP, POP3, LDAP, S… | 60 | 2577 | active |
| ajinabraham/nodejsscan nodejsscan is a static application security testing (SAST) scanner for Node.js applications, built on libsast and semgrep. It provides a we… | 66 | 2575 | active |
| s0lst1c3/eaphammer EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks, including credential stealing and hostil… | 23 | 2572 | active |
| onekey-sec/unblob unblob is an extraction suite that parses unknown binary blobs for 78+ archive, compression, and file-system formats, recursively extractin… | 88 | 2570 | active |
| YeQing17-2026/OmniAgent OmniAgent is an open-source Python agent framework that self-evolves across skills, context, memory, and its underlying model during intera… | 54 | 2570 | active |
| NVISOsecurity/AlwaysTrustUserCerts A Magisk/KernelSU module that automatically copies user-installed certificates into the Android system root CA store. It enables TLS traffi… | 43 | 2565 | active |
| splunk/attack_range Splunk Attack Range is a tool that builds instrumented, vulnerable lab environments in the cloud (AWS, Azure, GCP) or locally using Terrafo… | 81 | 2562 | active |
| SPIFFE SPIFFE is a framework and set of standards for issuing cryptographic identities to workloads, and SPIRE (the SPIFFE Runtime Environment) is… | 96 | 2559 | stable |
| mullvad/mullvad-browser Mullvad Browser is a privacy-focused desktop web browser developed jointly by Mullvad VPN and the Tor Project, essentially a Tor Browser de… | 96 | 2554 | active |
| kpcyrd/sn0int sn0int is a semi-automatic OSINT framework and package manager written in Rust that enumerates attack surface by processing public informat… | 66 | 2553 | active |
| rabbitstack/fibratus Fibratus is a Windows security sensor that performs realtime threat detection by analyzing kernel and system telemetry (including ETW event… | 87 | 2552 | active |
| Mattiwatti/EfiGuard EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader, and kernel at boot time to disable PatchGuard a… | 58 | 2551 | active |
| Wire Wire is an open-source, end-to-end encrypted messaging and collaboration platform whose server components are written primarily in Haskell.… | 56 | 2550 | active |
| monoxgas/sRDI sRDI is a shellcode implementation of Reflective DLL Injection that converts DLL files into position-independent shellcode via a compiled P… | 32 | 2550 | stable |
| DidierStevens/DidierStevensSuite A bundled collection of Didier Stevens' security research tools, distributed as a ZIP and GitHub repository of Python scripts and utilities… | 75 | 2546 | active |
| cisagov/Malcolm Malcolm is a containerized network traffic analysis tool suite that ingests full packet capture (PCAP) files, Zeek logs, and Suricata alert… | 98 | 2544 | active |
| x90skysn3k/brutespray Brutespray is a fast, multi-protocol credential brute-forcing tool written in Go. It parses scan output from Nmap, Nessus, Nexpose, JSON, a… | 92 | 2541 | active |
| Barre/privaxy Privaxy is a MITM HTTP(S) proxy written in Rust that blocks ads and trackers at the network level, supporting Adblock Plus and uBlock Origi… | 23 | 2537 | active |
| epsylon/ufonet UFONet is a free, P2P and cryptographic 'disruptive toolkit' written in Python for performing DoS and DDoS attacks at Layer 7 (HTTP) via Op… | 79 | 2535 | active |
| pac4j pac4j is a Java security engine for authenticating users, managing profiles, and enforcing authorizations across web applications and servi… | 77 | 2535 | stable |
| rspamd/rspamd Rspamd is an advanced spam filtering system and email processing framework written in C with an extensive Lua plugin API. It evaluates mess… | 96 | 2534 | active |
| Nidhogg Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, t… | 84 | 2534 | active |
| m4ll0k/SecretFinder SecretFinder is a Python CLI script based on LinkFinder that discovers sensitive data like API keys, access tokens, and JWTs in JavaScript … | 32 | 2534 | active |
| Proton VPN client Official open-source Proton VPN client apps for Android and Windows, built by Proton AG to route traffic through Proton's VPN servers. The … | 93 | 2532 | active |
| Peergos Peergos is a peer-to-peer, end-to-end encrypted global filesystem with fine-grained cryptographic access control, built on IPFS/libp2p with… | 76 | 2530 | active |
| tobiabocchi/flipperzero-bruteforce A Python script that generates .sub files for brute-forcing fixed OOK code subghz protocols using a Flipper Zero device. It supports multip… | 32 | 2529 | active |
| CTurt/FreeDVDBoot FreeDVDBoot is a PlayStation 2 DVD Player exploit written in C that lets users burn homebrew discs which boot on unmodified PS2 consoles. I… | 32 | 2526 | stable |
| jedisct1/piknik Piknik is a command-line tool that securely copies and pastes clipboard content between arbitrary hosts over the network, using end-to-end … | 54 | 2524 | stable |
| Box for Magisk Box for Root (BFR) is a Magisk/KernelSU/APatch module that bundles proxy cores such as clash, sing-box, v2ray, hysteria, and xray to set up… | 77 | 2523 | active |
| Termshark Termshark is a terminal user interface for tshark, the Wireshark command-line packet analyzer, offering Wireshark-like packet inspection in… | 23 | 10040 | maintenance |
| abrahamjuliot/creepjs CreepJS is a web application that performs advanced device and browser fingerprinting to expose weaknesses in anti-fingerprinting browsers … | 67 | 2520 | active |
| ryantm/agenix Agenix is a Nix library and CLI tool for managing age-encrypted secrets in NixOS and Home Manager using existing SSH public/private key pai… | 99 | 2516 | active |
| AirGuard AirGuard is an Android app that protects users from unwanted tracking via AirTags and other Apple Find My accessories. It periodically scan… | 92 | 2516 | active |
| Warden Warden is a general-purpose authentication framework for Rack-based Ruby web applications. It provides a flexible middleware layer for hand… | 64 | 2514 | active |
| aspnet-contrib/AspNet.Security.OAuth.Providers A collection of ASP.NET Core authentication middleware providing OAuth 2.0 social login providers such as GitHub, Twitter/X, and Dropbox. I… | 76 | 2510 | active |
| Epic Awesome Gamer A Python library that solves hCaptcha challenges using multimodal large language models and ONNX vision models (YOLO, CLIP, ResNet) integra… | 80 | 2508 | active |
| axiomatic-systems/Bento4 Bento4 is a C++ class library and set of command-line tools for reading, writing, inspecting, encrypting, and packaging ISO-MP4 files, incl… | 69 | 2507 | stable |
| h9zdev/WireTapper WireTapper is a wireless OSINT tool that passively detects and maps nearby radio-emitting devices such as Wi-Fi access points, Bluetooth de… | 56 | 2504 | active |
| weggli-rs/weggli weggli is a fast semantic search tool for C and C++ codebases that performs pattern matching on abstract syntax trees using a query languag… | 23 | 2498 | active |
| SheepChef/Abracadabra Abracadabra is an open-source text encryption tool that transforms encrypted data into realistic Classical Chinese (wenyan) prose, using AE… | 83 | 2495 | active |
| mCaptcha/mCaptcha mCaptcha is a self-hosted, privacy-respecting CAPTCHA system that uses SHA-256 proof-of-work to rate-limit users instead of image puzzles. … | 39 | 2495 | active |
| usnistgov/macos_security The macOS Security Compliance Project (mSCP) is an open-source tool from NIST that generates security baselines, configuration profiles, co… | 96 | 2493 | active |
| VirusTotal/yara YARA is a pattern matching tool used to identify and classify malware families and other files based on textual or binary pattern rules. It… | 94 | 9907 | maintenance |
| nil0x42/phpsploit PhpSploit is a full-featured command-and-control (C2) framework that persists on a webserver via a stealthy single-line PHP backdoor. It is… | 23 | 2492 | active |
| quasar/Quasar Quasar is a free, open-source remote administration tool (RAT) for Windows written in C#, offering remote desktop, shell, file management, … | 10 | 9906 | maintenance |
| Symfony Security SecurityBundle is the official Symfony bundle that integrates the Security component into the Symfony full-stack framework. It provides con… | 93 | 2490 | stable |
| coreos/go-oidc go-oidc is a mature Go client library for OpenID Connect, built on top of golang.org/x/oauth2. It enables verifying ID tokens and identifyi… | 90 | 2489 | stable |
| bitcoin-core/secp256k1 libsecp256k1 is a high-performance, high-assurance C library for elliptic curve cryptography on the secp256k1 curve, including ECDSA and Sc… | 84 | 2488 | stable |
| sabri-zaki/EasY_HaCk EasY_HaCk is a Termux-based penetration testing menu tool that bundles and installs tools like Metasploit, Nmap, SQLmap, and recon-ng for n… | 39 | 2487 | active |
| 0xd4d/dnlib dnlib is a C# library that reads and writes .NET assemblies and modules, including method bodies and IL code. It supports loading modules f… | 57 | 2486 | stable |
| TH3xACE/SUDO_KILLER SUDO_KILLER is a Shell-based security tool that audits Linux systems for sudo-related privilege escalation vectors, including misconfigurat… | 61 | 2484 | active |
| HACKERALERT/Picocrypt Picocrypt is a very small, simple, and secure file encryption tool written in Go, using modern cryptography like XChaCha20, Argon2, and SHA… | 10 | 2482 | active |
| solemnwarning/rehex Rehex is a cross-platform hex editor designed for reverse engineering binary files, with features like large file support, inline disassemb… | 79 | 2481 | active |
| unode/firefox_decrypt Firefox Decrypt is a Python command-line tool that extracts saved passwords from Mozilla product profiles (Firefox, Waterfox, Thunderbird, … | 76 | 2481 | active |
| m0nad/Diamorphine Diamorphine is a loadable kernel module (LKM) rootkit for Linux kernels 2.6.x through 6.x on x86/x86_64 and ARM64. It demonstrates rootkit … | 64 | 2481 | active |