Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Zouuup/landrun Landrun is a lightweight CLI tool that sandboxes arbitrary Linux processes using the kernel's Landlock security module, with no root privil… | 77 | 2312 | active |
| Exa-Networks/exabgp ExaBGP is a Python-based BGP protocol implementation that lets network engineers control and interact with BGP sessions through a JSON API … | 99 | 2311 | active |
| auth0/nextjs-auth0 The Auth0 Next.js SDK is a TypeScript library for adding user authentication to Next.js applications via Auth0. It handles sign-in, sign-ou… | 98 | 2310 | active |
| 1N3/BruteX BruteX is a shell-based CLI tool that automatically brute forces all services running on a target, enumerating open ports, usernames, and p… | 23 | 2309 | active |
| jofpin/trape Trape is an OSINT analysis and research tool for tracking people online and executing real-time social engineering attacks, built in Python… | 32 | 9055 | maintenance |
| sglfree/freesky A distribution and documentation hub for free anti-censorship (circumvention) software such as Freegate, Ultrasurf, Psiphon 3, and nthLink,… | 66 | 2307 | active |
| benedmunds/CodeIgniter-Ion-Auth Ion Auth is a simple and lightweight authentication library for the CodeIgniter 4 PHP framework. It provides user registration, login, grou… | 32 | 2306 | stable |
| ckcr4lyf/EvilAppleJuice-ESP32 An ESP32 firmware written in C++ that spams Apple Continuity BLE advertisements to flood nearby iPhones with pop-up notifications. It is ba… | 64 | 2305 | active |
| ggwave A collection of command-line and GUI tools that capture and analyze microphone audio to recover keyboard keystrokes acoustically. Its Keyta… | 23 | 9038 | maintenance |
| a466350665/smart-sso Smart-SSO is a lightweight single sign-on (SSO) authentication and authorization center built on Spring Boot, implementing the OAuth2 autho… | 68 | 2301 | active |
| n1nj4sec/pupy Pupy is an open-source, cross-platform (Windows, Linux, macOS, Android) command-and-control and post-exploitation framework written in Pyth… | 10 | 9000 | maintenance |
| jdx/fnox fnox is a Rust CLI tool for managing secrets via encryption or cloud secret providers, storing them in a git-committed fnox.toml file. It s… | 81 | 2296 | active |
| yuezk/GlobalProtect-openconnect A GlobalProtect VPN client for Linux built on OpenConnect, offering both a CLI and a Tauri-based GUI. It supports SSO authentication includ… | 99 | 2295 | active |
| squat/kilo Kilo is a multi-cloud network overlay for Kubernetes built on WireGuard, providing an encrypted layer 3 network that connects nodes across … | 74 | 2294 | active |
| yeojz/otplib otplib is a TypeScript-first library for generating and verifying one-time passwords (HOTP and TOTP) for two-factor authentication, compati… | 96 | 2292 | active |
| gautamkrishnar/nothing-private Nothing Private is a proof-of-concept website demonstrating that browser fingerprinting can identify and track users even in private browsi… | 66 | 2292 | active |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 50 | 2288 | active |
| allenymt/PrivacySentry PrivacySentry is an Android privacy compliance toolkit combining a Gradle plugin with a runtime SDK, using annotations plus ASM bytecode in… | 46 | 2288 | active |
| Railgun Railgun is a GUI-based penetration testing tool that automates common tasks from manual pentesting experience. It integrates port scanning,… | 30 | 2286 | active |
| sh-dv/hat.sh Hat.sh is a browser-based web application for secure local file encryption and decryption using XChaCha20-Poly1305 with chunked streaming v… | 23 | 2286 | active |
| API-Security/APIKit APIKit is a BurpSuite extension (Java plugin) that discovers, scans, and audits leaked API documentation such as GraphQL, OpenAPI/Swagger, … | 23 | 2286 | active |
| google/boringssl BoringSSL is Google's fork of OpenSSL, serving as the TLS/SSL library in Chrome, Chromium, and Android. It is open source but explicitly no… | 98 | 2282 | active |
| Alarmo Alarmo is a Home Assistant custom integration that turns existing sensors into a full-featured home alarm system, configurable entirely thr… | 89 | 2276 | active |
| Bank-Vaults Bank-Vaults is a CNCF Sandbox umbrella project of tools for cloud-native secret management with Hashicorp Vault. This repository provides t… | 88 | 2276 | active |
| Foxboron/sbctl sbctl is a user-friendly Secure Boot key manager for Linux written in Go. It creates and enrolls UEFI Secure Boot keys, tracks files that n… | 69 | 2276 | active |
| RustCrypto Hashes A collection of cryptographic hash function implementations written in pure Rust, organized as separate crates built on the digest crate's … | 77 | 2274 | active |
| santigarcor/laratrust Laratrust is a PHP package for Laravel that manages roles and permissions (RBAC/ACL) for users, with support for multiple user models, team… | 67 | 2274 | active |
| SafeGroceryStore/MDUT MDUT is a cross-platform desktop application for managing and exploiting multiple databases (MySQL, MSSQL, PostgreSQL, Oracle, Redis) built… | 89 | 2273 | active |
| spyboy-productions/CloakQuest3r CloakQuest3r is a Python-based open-source security research tool that identifies potential origin IP exposure of websites protected by Clo… | 51 | 2269 | active |
| ory/polis Ory Polis (formerly BoxyHQ Jackson) is an open-source Enterprise SSO service that bridges SAML and OpenID Connect login flows to OAuth 2.0/… | 82 | 2266 | active |
| Caligatio/jsSHA jsSHA is a pure TypeScript/JavaScript library implementing the complete SHA hash family (SHA-1, SHA-2, SHA-3, SHAKE, cSHAKE, KMAC) plus HMA… | 79 | 2266 | stable |
| Runnin4ik/dpi-detector A Python CLI tool that detects and classifies Deep Packet Inspection (DPI) based internet censorship, including TCP 16-20KB connection drop… | 79 | 2262 | active |
| ARM-software/arm-trusted-firmware Trusted Firmware-A (TF-A) is a reference implementation of secure world software (EL3 firmware, trusted boot, and a small trusted runtime) … | 76 | 2262 | active |
| BAP (Binary Analysis Platform) CMU Binary Analysis Platform (BAP) is a suite of OCaml libraries and a plugin-extensible CLI tool for analyzing binary programs. It lifts b… | 56 | 2262 | active |
| Storyyeller/Krakatau Krakatau is a Rust-based CLI tool for assembling, disassembling, and decompiling Java bytecode. It is specifically designed to handle obfus… | 75 | 2257 | active |
| gsliepen/tinc Tinc is a peer-to-peer VPN daemon that creates encrypted private networks over the Internet with automatic full-mesh routing and NAT traver… | 74 | 2256 | stable |
| mailpile/Mailpile Mailpile is a free, open-source, privacy-focused email client with built-in PGP encryption, a fast custom search engine, and tag-based orga… | 23 | 8811 | maintenance |
| Caddy Security (AuthCrunch) A security app and plugin for Caddy v2 providing authentication, authorization, and accounting (AAA). It supports Form-Based, Basic, Local,… | 98 | 2254 | active |
| pydio/cells Pydio Cells is a self-hosted, open-core document sharing, collaboration and management platform written in Go with a microservice architect… | 97 | 2253 | active |
| FormidableLabs/react-native-app-auth A React Native bridge around the native AppAuth-iOS and AppAuth-Android SDKs for communicating with OAuth 2.0 and OpenID Connect providers.… | 94 | 2252 | active |
| neurobin/shc shc is a generic shell script compiler that converts shell scripts (bash, sh, zsh, ksh, etc.) into C source code, which is then compiled in… | 23 | 2251 | stable |
| salesforce/cloudsplaining Cloudsplaining is an AWS IAM security assessment tool that identifies violations of least privilege in IAM policies. It generates a risk-pr… | 83 | 2247 | active |
| d3mondev/puredns Puredns is a fast command-line domain resolver and subdomain bruteforcing tool written in Go. It uses massdns for bulk DNS lookups and appl… | 50 | 2246 | active |
| Versent/saml2aws saml2aws is a Go CLI tool that authenticates against SAML-based identity providers such as ADFS and PingFederate and exchanges the SAML ass… | 43 | 2246 | active |
| julian-klode/dns66 DNS66 is an open-source Android app that blocks ads and malicious hosts by intercepting DNS queries through a local VPN service. It uses co… | 10 | 2246 | active |
| kismetwireless/kismet Kismet is a wireless network detector, sniffer, and intrusion detection system for Wi-Fi, Bluetooth, SDR, and other wireless protocols. It … | 77 | 2244 | active |
| e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 74 | 2243 | active |
| irungentoo/toxcore Toxcore is the core C library implementing the Tox protocol, a fully encrypted, peer-to-peer, serverless communication platform for instant… | 32 | 8744 | maintenance |
| grimdoomer/Xbox360BadUpdate A non-persistent, software-only hypervisor exploit for the Xbox 360 that runs unsigned code on the latest dashboard (17559) using a support… | 10 | 2239 | active |
| Ylarod/Florida Florida is an automatically patched, anti-detection build of frida-server for Android, tracking the upstream FRIDA project. It rebuilds fri… | 91 | 2236 | active |
| SysSec-KAIST/LTESniffer LTESniffer is an open-source LTE downlink/uplink eavesdropper built on FALCON and srsRAN that decodes PDCCH, PDSCH, and PUSCH channels to c… | 21 | 2234 | active |
| ToolHive ToolHive is an open-source platform for running, securing, and managing Model Context Protocol (MCP) servers. It wraps MCP servers in isola… | 81 | 2233 | active |
| GrapheneOS/Vanadium Vanadium is a privacy and security hardened variant of Chromium that serves as the standard browser and WebView provider on GrapheneOS. It … | 95 | 2231 | active |
| srvrco/getssl A Bash-based CLI tool for obtaining and automatically renewing free SSL/TLS certificates from the Let's Encrypt ACME server. It can deploy … | 93 | 2230 | active |
| martin-ger/esp32_nat_router Open-source firmware that turns an ESP32 into a WiFi NAT router and firewall, routing between an AP interface and a STA or Ethernet uplink.… | 77 | 2228 | active |
| lefayjey/linWinPwn linWinPwn is a bash script that wraps and streamlines a large set of Active Directory penetration testing tools such as impacket, bloodhoun… | 76 | 2228 | active |
| pen4uin/java-memshell-generator A highly customizable Java in-memory webshell (memshell) generator supporting multiple middleware servers, frameworks, shell types, and out… | 33 | 2228 | active |
| berthubert/googerteller A C++ command-line tool that plays audible beeps whenever your computer sends packets to Google services or known trackers, using tcpdump o… | 32 | 2225 | active |
| kimci86/bkcrack bkcrack is a command-line tool that cracks legacy ZIP encryption (ZipCrypto/PKWARE) using Biham and Kocher's known plaintext attack. Given … | 71 | 2223 | active |
| MatthewKuKanich/FindMyFlipper A FlipperZero application that turns the device into a BLE tracker beacon emulating Apple AirTags, Samsung SmartTags, or Tile trackers. It … | 19 | 2223 | active |
| o-gs/dji-firmware-tools A collection of C command-line tools for extracting, modifying, and repacking firmware of DJI drones such as Phantom, Mavic, Inspire, and S… | 70 | 2221 | active |
| punk-security/dnsReaper DNS Reaper is a Python CLI tool that scans DNS records for subdomain takeover vulnerabilities using over 50 signatures, at roughly 50 subdo… | 40 | 2221 | active |
| shwenzhang/AndResGuard AndResGuard is a tool from the WeChat team that obfuscates and shrinks Android APK resources, working like ProGuard but for resource files … | 23 | 8647 | maintenance |
| RetDec RetDec is a retargetable machine-code decompiler based on LLVM that converts native binaries back into readable C or Python-like source cod… | 57 | 8640 | maintenance |
| lkarlslund/Adalanche Adalanche is an open-source Active Directory attack graph visualizer and explorer written in Go. It collects data via LDAP and SYSVOL, anal… | 100 | 2217 | active |
| mandiant/flare-fakenet-ng FakeNet-NG is a dynamic network analysis tool that intercepts and redirects network traffic while simulating legitimate network services. I… | 60 | 2215 | active |
| login-securite/lsassy Lsassy is a Python CLI tool that remotely extracts credentials from the LSASS process memory of Windows hosts over the network. It uses imp… | 77 | 2214 | active |
| DigitalRuby/IPBan IPBan is a free, open-source security service that monitors failed login attempts from event logs and log files on Windows and Linux server… | 81 | 2212 | active |
| ReClass.NET ReClass.NET is a .NET-based memory inspection and class structure reconstruction tool for analyzing remote processes, a modernized port of … | 23 | 2212 | active |
| aemkei/jsfuck JSFuck is an esoteric JavaScript library that encodes and executes arbitrary JavaScript using only six characters: []()!+. It works both in… | 33 | 8604 | maintenance |
| ZerBea/hcxdumptool hcxdumptool is a C-based command-line tool that captures packets from WLAN devices and runs layer 2 attacks against the WPA protocol to fin… | 76 | 2209 | active |
| ghostunnel/ghostunnel Ghostunnel is a simple TLS proxy written in Go that adds mutual TLS authentication in front of (or behind) non-TLS backend services, in cli… | 99 | 2208 | active |
| rofl0r/microsocks MicroSocks is a tiny, multithreaded SOCKS5 proxy server written in C with minimal resource usage and no config file required. It supports I… | 66 | 2206 | active |
| AntiDebug_Breaker A Chrome browser extension built on the Hook_JS library that assists with JavaScript reverse engineering and penetration testing reconnaiss… | 83 | 2203 | active |
| Remix Auth Remix Auth is a complete open-source authentication library for Remix and React Router applications, inspired by Passport.js and built on t… | 73 | 2203 | stable |
| qwj/python-proxy pproxy is a lightweight asynchronous tunnel proxy implemented in pure Python 3 asyncio, supporting HTTP, HTTP2, HTTP3/QUIC, SOCKS4/5, Shado… | 32 | 2203 | active |
| yandex/gixy Gixy is a Python-based static analyzer for Nginx configuration files that detects security misconfigurations and flaws. It ships as a CLI t… | 23 | 8565 | maintenance |
| m13253/dns-over-https A high-performance DNS-over-HTTPS (DoH) client and server written in Go, supporting both the Google DoH JSON API and IETF RFC 8484 wire for… | 74 | 2201 | active |
| bytecode77/r77-rootkit r77 is a fileless ring 3 (userland) rootkit for Windows that hides files, processes, registry keys, services, and network connections using… | 71 | 2199 | active |
| betterleaks/betterleaks Betterleaks is a fast, configurable secrets scanner for finding leaked credentials in git repositories, filesystems, and platforms like Git… | 82 | 2198 | active |
| pass-with-high-score/blockads-android BlockAds is a free, open-source Android app that blocks ads, trackers, and malware system-wide using local VPN-based DNS filtering, with no… | 83 | 2196 | active |
| lenucksi/aur-malware-check A Python CLI tool that detects compromised AUR packages from the June 2026 atomic-lockfile supply-chain attack and other historical campaig… | 51 | 2196 | active |
| dronesploit/dronesploit DroneSploit is a Metasploit-style console framework for pentesting commercial drones, built on sploitkit. It gathers drone-focused hacking … | 23 | 2194 | active |
| 0vercl0k/rp rp++ is a fast C++ command-line tool that finds ROP (Return-Oriented Programming) gadgets in PE, ELF, and Mach-O binaries for x86, x64, ARM… | 38 | 2193 | active |
| beelzebub-labs/beelzebub Beelzebub is an open-source deception runtime framework written in Go that deploys adaptive, LLM-powered honeypot decoy services across SSH… | 97 | 2192 | active |
| RISC Zero RISC Zero is a zero-knowledge verifiable general computing platform built on zk-STARKs and a RISC-V-based zkVM. It lets developers prove th… | 91 | 2192 | active |
| zmap/zgrab2 ZGrab2 is a fast, modular application-layer network scanner written in Go, designed for large Internet-wide surveys in tandem with ZMap. It… | 73 | 2190 | active |
| ovh/the-bastion The Bastion is a self-hosted SSH bastion/gateway that acts as the single entry point for operational teams to access infrastructure devices… | 84 | 2189 | stable |
| jwt-dotnet/jwt Jwt.Net is a C# library for generating, encoding, decoding, and validating JSON Web Tokens (JWT) per RFC 7519. It includes fluent builder A… | 83 | 2187 | stable |
| a16z/helios Helios is a fast, trustless multichain light client for Ethereum written in Rust that turns an untrusted centralized RPC endpoint into a ve… | 98 | 2185 | active |
| ranisalt/node-argon2 Node.js bindings to the reference Argon2 password-hashing implementation, supporting Argon2i, Argon2d, and Argon2id. It provides a simple a… | 88 | 2185 | stable |
| NeilFraser/JS-Interpreter A sandboxed JavaScript interpreter written in JavaScript that executes arbitrary ES5 code in isolation and safety. It supports line-by-line… | 68 | 2185 | active |
| Harry24k/adversarial-attacks-pytorch Torchattacks is a PyTorch library providing implementations of adversarial attacks to generate adversarial examples against deep learning m… | 23 | 2185 | active |
| safe-fndn/safe-smart-account Safe Smart Account is the set of audited Solidity smart contracts implementing Safe's multisig smart account (contract wallet) for Ethereum… | 66 | 2181 | active |
| ruby-oauth/oauth2 A Ruby gem implementing OAuth 2.0 and 2.1 client functionality, including OpenID Connect (OIDC) support. It handles token requests, grant t… | 93 | 2179 | active |
| Jar Analyzer A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysi… | 90 | 2179 | active |
| log2timeline/plaso Plaso (log2timeline) is a Python-based engine for automatically creating super timelines from timestamped events found in logs and files on… | 87 | 2176 | active |
| Baseflow/flutter-permission-handler A Flutter plugin providing a cross-platform API to request and check device permissions on iOS and Android. It follows the federated plugin… | 75 | 2176 | stable |
| Canarytokens Canarytokens is a self-hostable service by Thinkst that generates tripwire tokens (URLs, DNS names, AWS keys, files, etc.) which alert you … | 76 | 2171 | active |
| microsoft/SysmonForLinux Sysmon for Linux is a Sysinternals tool that monitors and logs system activity such as process lifetime, network connections, and file syst… | 93 | 2170 | active |