Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Go LDAP Admin A modern web-based admin panel for managing OpenLDAP servers, built with a Go (Gin + Gorm) backend and Vue frontend. It also syncs organiza… | 78 | 2025 | active |
| Evil Limiter A Python command-line tool that monitors, analyzes, and limits the bandwidth of devices on a local network using ARP spoofing and traffic s… | 52 | 2025 | active |
| chris2511/xca XCA is a cross-platform desktop GUI application for creating and managing X.509 certificates, certificate requests, RSA/DSA/EC private keys… | 62 | 2020 | active |
| microsoft/msticpy msticpy is a Python library from Microsoft for security investigation and threat hunting in Jupyter notebooks. It provides data acquisition… | 94 | 2019 | active |
| dqzg12300/fridaUiTools fridaUiTools is a PyQt5 desktop workbench that wraps Frida into a unified GUI for attaching to processes, managing hook script templates, v… | 80 | 2018 | active |
| attr-encrypted/attr_encrypted A Ruby gem that generates attr_accessors which transparently encrypt and decrypt attributes on any Ruby class. It integrates with ActiveRec… | 40 | 2017 | active |
| wyzxxz/jndi_tool A Java-based JNDI exploitation tool that runs malicious RMI/LDAP reference servers to test and exploit JNDI injection vulnerabilities, incl… | 32 | 2017 | active |
| endrazine/wcc The Witchcraft Compiler Collection (WCC) is a set of compilation tools for performing binary manipulation on ELF executables across POSIX p… | 83 | 2014 | active |
| trycompai/comp Comp AI is an open-source, AI-native compliance platform that automates evidence collection, policy generation, and continuous monitoring f… | 80 | 2013 | active |
| xuxueli/xxl-sso XXL-SSO is a lightweight, distributed single sign-on (SSO) framework for Java/Spring applications. It supports login, permission, and role … | 90 | 2011 | active |
| jstedfast/MimeKit MimeKit is a C#/.NET library for creating and parsing MIME email messages, with support for S/MIME, OpenPGP, DKIM, ARC, TNEF, and Unix mbox… | 77 | 2009 | stable |
| Google2FA A PHP library implementing Google-compatible two-factor authentication via HMAC-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-… | 63 | 2009 | stable |
| ggshield ggshield is a CLI application from GitGuardian that detects over 500 types of hardcoded secrets in files, git history, and CI environments … | 98 | 2006 | active |
| ambethia/recaptcha A Ruby gem providing helper methods for Google's reCAPTCHA API, supporting v2 checkbox, invisible, and v3 score-based verification. It offe… | 68 | 2006 | stable |
| EgeBalci/sgn SGN is a polymorphic binary encoder that encodes shellcode using an additive feedback loop similar to an LFSR, producing statically undetec… | 85 | 2005 | active |
| msoedov/agentic_security Agentic Security is an open-source LLM vulnerability scanner and AI red-teaming toolkit that probes large language models and agent workflo… | 83 | 2004 | active |
| pyupio/safety Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local de… | 89 | 1996 | active |
| cnlimiter/codex-manager A self-hosted Python web UI for managing OpenAI/ChatGPT accounts, supporting bulk registration via multiple temporary and IMAP email servic… | 57 | 1995 | active |
| mfontanini/libtins libtins is a high-level, multiplatform C++ library for network packet sniffing, parsing, and crafting. It provides an efficient, endianness… | 80 | 1994 | stable |
| bcrypt-ruby/bcrypt-ruby bcrypt-ruby is a Ruby binding to the OpenBSD bcrypt() password hashing algorithm, provided as a gem with a native C extension. It lets deve… | 76 | 1994 | stable |
| i12bp8/TagTinker TagTinker is a Flipper Zero application for researching infrared electronic shelf label (ESL) protocols, letting users transmit custom imag… | 58 | 1992 | active |
| hBlock hBlock is a POSIX-compliant shell script that aggregates domains serving ads, trackers, and malware from multiple blocklist sources and gen… | 62 | 1991 | active |
| t6x/reaver-wps-fork-t6x Reaver is a C-based command-line tool that performs brute force attacks against Wi-Fi Protected Setup (WPS) registrar PINs to recover WPA/W… | 41 | 1991 | active |
| hfiref0x/WinObjEx64 WinObjEx64 is a 64-bit Windows utility for exploring the Windows Object Manager namespace, viewing detailed object properties, structure du… | 86 | 1986 | active |
| veops/oneterm OneTerm is a lightweight, flexible enterprise bastion host (jump server) built on the 4A model: authentication, authorization, account, and… | 93 | 1985 | active |
| ys1231/MoveCertificate A Magisk/KernelSU/APatch root module that moves user-installed certificates into Android's system CA store, supporting Android 7 through 16… | 94 | 1984 | active |
| manfredsteyer/angular-oauth2-oidc A TypeScript library adding OAuth 2, OAuth 2.1, and OpenID Connect support to Angular applications. It handles token issuance, validation, … | 86 | 1983 | stable |
| 1Password/for-open-source 1Password for Open Source is a program that grants eligible open source projects a free 1Password Teams account for securely storing and sh… | 67 | 1982 | active |
| mikenicholson/passport-jwt passport-jwt is a Passport authentication strategy for Node.js that authenticates HTTP requests using JSON Web Tokens. It extracts a JWT fr… | 32 | 1981 | active |
| mewebstudio/Purifier A Laravel service provider that wraps the HTMLPurifier library for sanitizing HTML input. It provides a simple clean() helper and Purifier … | 69 | 1980 | stable |
| cossacklabs/themis Themis is a cross-platform, high-level cryptographic library providing ready-made building blocks for secure data storage, encrypted messag… | 69 | 1978 | stable |
| anthropics/defending-code-reference-harness A reference implementation from Anthropic for autonomous vulnerability discovery and remediation using Claude, including Claude Code skills… | 54 | 7548 | maintenance |
| dswd/vpncloud VpnCloud is a high-performance peer-to-peer mesh VPN written in Rust that runs over UDP with strong end-to-end encryption (Curve25519 and A… | 23 | 1977 | stable |
| dfunckt/django-rules A Python library providing object-level permissions for Django without requiring a database, built on a generic rule-based predicate framew… | 40 | 1976 | stable |
| chobits/ngx_http_proxy_connect_module An nginx module (also compatible with Tengine and OpenResty) that adds support for the HTTP CONNECT method, turning nginx into a forward pr… | 23 | 1976 | active |
| dromara/MaxKey MaxKey is an open-source IAM/IDaaS product providing Single Sign-On (SSO), identity management, and RBAC-based access control. It supports … | 96 | 1974 | active |
| MichaelGrafnetter/DSInternals DSInternals is a PowerShell module and .NET framework for working with Active Directory internals, including offline NTDS.DIT database pars… | 93 | 1970 | active |
| bit4woo/knife Knife is a Burp Suite extension written in Java that adds useful right-click context menu functions to improve penetration testing workflow… | 67 | 1970 | active |
| rsc/2fa A command-line two-factor authentication agent written in Go that stores TOTP and HOTP keys and generates one-time authentication codes. Ke… | 32 | 1970 | stable |
| Ragnt/AngryOxide AngryOxide is an 802.11 WiFi attack tool written in Rust that provides a single-interface survey capability with automated attacks to captu… | 66 | 1967 | active |
| zs1083339604/FaceWinUnlock-Tauri A Windows face-recognition unlock application built with Tauri, Vue 3, and OpenCV that injects a custom Credential Provider DLL into the Wi… | 82 | 1962 | active |
| guofei9987/text_blind_watermark A Python library that embeds invisible blind watermarks into plain text without changing its appearance or readability, using a password-pr… | 37 | 1960 | active |
| Azure/Microsoft-Defender-for-Cloud The official Microsoft Defender for Cloud community repository containing PowerShell scripts, Azure Policy definitions, Logic App templates… | 76 | 1959 | active |
| dghubble/gologin gologin is a Go library providing chainable http.Handler implementations for login flows with OAuth1 and OAuth2 providers like Google, GitH… | 67 | 1958 | stable |
| airsquared/blobsaver blobsaver is a cross-platform GUI and CLI application for automatically saving SHSH blobs for iOS devices, useful for future downgrades and… | 39 | 1958 | active |
| oidc-client-ts oidc-client-ts is a TypeScript library providing OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript application… | 81 | 1957 | active |
| RustSec RustSec is the Rust ecosystem's security advisory database plus a workspace of tooling crates, including the rustsec client library, cargo-… | 97 | 1956 | stable |
| owtf/owtf OWASP OWTF (Offensive Web Testing Framework) is a penetration testing framework that unites multiple security tools and aligns testing work… | 83 | 1956 | active |
| intruder-io/autoswagger Autoswagger is a Python command-line tool that discovers Swagger/OpenAPI specifications, parses their endpoints, and automatically tests th… | 31 | 1956 | active |
| autoDecoder A modified version of the captcha-killer Burp Suite extension that intercepts captcha images from HTTP responses and recognizes them using … | 36 | 1954 | active |
| ipwndfu ipwndfu is an open-source Python tool that exploits iOS device bootroms, most notably via the checkm8 exploit, to put devices into pwned DF… | 32 | 7430 | maintenance |
| de4dot/de4dot de4dot is an open-source .NET deobfuscator and unpacker written in C# that restores packed and obfuscated .NET assemblies to near-original … | 10 | 7429 | maintenance |
| nymtech/nym Nym is a decentralized privacy platform built in Rust, centered on a mixnet that shuffles Sphinx packets to protect network-level metadata,… | 96 | 1950 | active |
| legba Legba is a fast, multiprotocol credentials bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime.… | 78 | 1950 | active |
| KasperskyLab/hrtng An IDA Pro plugin (C++) providing a rich toolkit for reverse engineering: string/data decryption, deobfuscation of Hex-Rays pseudocode, unf… | 87 | 1949 | active |
| vxunderground/VX-API VX-API is a C++ collection of functions implementing malicious functionality to aid in malware development, maintained by vx-underground. I… | 32 | 1949 | active |
| jeremyevans/rodauth Rodauth is Ruby's most advanced authentication framework, providing a comprehensive set of composable authentication features built on the … | 77 | 1944 | stable |
| varnish/hitch Hitch is a scalable TLS/SSL termination proxy written in C by Varnish Software. It decrypts TLS connections and forwards unencrypted traffi… | 65 | 1944 | active |
| microsoft/openvmm OpenVMM is a modular, cross-platform Virtual Machine Monitor (VMM) written in Rust, developed by Microsoft. It also hosts OpenHCL, a paravi… | 93 | 1942 | active |
| ERC-4337 Account Abstraction reference implementation The reference implementation of ERC-4337 account abstraction for Ethereum, providing the singleton EntryPoint contract, base classes for sm… | 52 | 1942 | active |
| moul/sshportal sshportal is a transparent SSH bastion (jump host) server written in Go that manages users, hosts, and access control without requiring a t… | 66 | 1941 | active |
| GhostManager/Ghostwriter Ghostwriter is an open-source Django-based platform from SpecterOps for managing offensive security engagements, including client/project t… | 95 | 1940 | active |
| Aorimn/dislocker Dislocker is a FUSE-based driver and library that reads and writes Windows BitLocker-encrypted partitions (including BitLocker-To-Go) from … | 74 | 1938 | stable |
| SleepingBag945/dddd dddd is a Go-based batch information gathering and supply-chain vulnerability detection CLI tool designed to streamline red team workflows.… | 19 | 1937 | active |
| nitefood/asn A Bash-based command-line tool and self-hostable server for looking up ASN, RPKI validity, BGP stats, IP prefixes, AS paths, IP reputation,… | 96 | 1936 | active |
| hotyue/IP-Sentinel IP-Sentinel is a lightweight, modular Master-Agent distributed system for maintaining VPS IP assets. It detects IP geolocation misclassific… | 80 | 1935 | active |
| OP-TEE OP-TEE Trusted OS is the secure-world operating system implementation of the OP-TEE project, running on ARM TrustZone-enabled hardware. It … | 75 | 1935 | active |
| wuyoscar/Internal-Safety-Collapse ISC-Bench/TVD is a research framework for studying 'Internal Safety Collapse' in frontier LLMs, where agents placed in adversarial codespac… | 60 | 1935 | active |
| hackerschoice/gsocket Global Socket (gsocket) is a C-based toolkit that lets two machines behind NAT or firewalls establish secure, end-to-end encrypted TCP conn… | 63 | 1934 | active |
| deepfence/PacketStreamer PacketStreamer is a distributed, high-performance remote packet capture tool that runs lightweight sensors on target hosts to stream filter… | 10 | 1934 | active |
| JustasMasiulis/lazy_importer A header-only C++ library for resolving Windows DLL exports at runtime in a way that hides imports from static analysis tools. It uses comp… | 32 | 1930 | stable |
| bee-san/pyWhat pyWhat is a Python CLI tool that identifies what arbitrary text, files, or pcap network captures contain - emails, IP addresses, API keys, … | 67 | 7322 | maintenance |
| fideloper/TrustedProxy A Laravel package that configures trusted proxies so applications behind load balancers or reverse proxies correctly interpret X-Forwarded … | 23 | 7304 | maintenance |
| TweetNaCl.js TweetNaCl.js is a JavaScript port of the TweetNaCl/NaCl cryptographic library, providing high-level APIs for secret-key and public-key auth… | 35 | 1923 | stable |
| Tuya Cloudcutter Tuya Cloudcutter is a Python-based toolchain that exploits a wireless vulnerability in Tuya smart devices using Beken BK7231 and Realtek ch… | 75 | 1919 | active |
| zarfadev/MobaXterm-Keygen A browser-based web tool that generates MobaXterm license key files (.mxtpro) and merges custom MobaXterm settings, running entirely client… | 69 | 1916 | active |
| FGRibreau/mailchecker MailChecker is a cross-language library for validating email format and detecting temporary/disposable email addresses, backed by a databas… | 77 | 1913 | active |
| evildevill/instahack Instahack is a Bash and Python-based brute-force tool for testing Instagram account password strength, routing traffic through Tor for anon… | 58 | 1913 | active |
| Yurii0307/yurikey YuriKey is a systemless root module (for Magisk, APatch, KernelSU and forks) that helps rooted Android devices pass Google Play Integrity's… | 78 | 1911 | active |
| cisagov/cset CSET is a free desktop application from CISA and Idaho National Laboratory that guides organizations through step-by-step cybersecurity ass… | 87 | 1909 | active |
| atmoz/sftp A Docker image providing an easy-to-use SFTP server based on OpenSSH. Users can be defined via command arguments, environment variables, or… | 56 | 1909 | active |
| ECTO-1A/AppleJuice AppleJuice is a Python proof-of-concept tool that spoofs Apple BLE proximity pairing messages to trigger pairing popups on nearby Apple dev… | 29 | 1909 | active |
| sleeyax/burp-awesome-tls A Burp Suite extension that hijacks Burp's HTTP and TLS stack to spoof any browser's TLS fingerprint (JA3). It helps evade WAF bot detectio… | 87 | 1908 | active |
| netero1010/EDRSilencer A C-based Windows command-line tool that uses Windows Filtering Platform (WFP) APIs to block outbound traffic of running EDR agents, preven… | 17 | 1906 | active |
| mainmatter/ember-simple-auth Ember Simple Auth is a lightweight library for implementing authentication and authorization in Ember.js applications. It maintains a clien… | 94 | 1905 | active |
| joaoviictorti/RustRedOps RustRedOps is a collection of red team tools and technique implementations written in Rust, primarily targeting Windows. It provides workin… | 50 | 1904 | active |
| AdguardTeam/AdguardForAndroid AdGuard for Android is a system-wide content blocker for Android that blocks ads, trackers, and malvertising across browsers and apps. This… | 97 | 1903 | active |
| Dyneteq/reconya reconYa is a self-hosted network reconnaissance and asset discovery tool written in Go that scans local networks via ICMP, TCP, and ARP to … | 81 | 1902 | active |
| rust-fuzz/cargo-fuzz cargo-fuzz is a Cargo subcommand that makes it easy to fuzz test Rust code with libFuzzer. It scaffolds fuzz targets, runs them, minimizes … | 75 | 1902 | active |
| PolyHook PolyHook 2.0 is a C++20 library for hooking functions at runtime on x86 and x64 architectures. It supports multiple hooking techniques (inl… | 69 | 1902 | active |
| zitadel/oidc A Go library implementing both the OpenID Connect client (Relying Party) and server (OpenID Provider) sides of the OIDC/OAuth2 standards, c… | 93 | 1900 | active |
| valqore/valqore Valqore is a deterministic infrastructure governance engine that scans Kubernetes manifests, Terraform, Helm, and cloud resources against 1… | 77 | 1900 | active |
| federicodotta/Brida Brida is a Burp Suite extension that bridges Burp Suite and Frida, letting testers invoke and manipulate an application's own methods while… | 43 | 1899 | active |
| Eugeny/russh Russh is a low-level, Tokio-based SSH2 client and server library for Rust, forked from Thrussh. It supports a wide range of ciphers, key ex… | 98 | 1898 | active |
| zema1/watchvuln WatchVuln is a self-hosted Go service that scrapes high-quality vulnerability sources (Aliyun AVD, Chaitin, OSCS, Qianxin TI, Seebug, CISA … | 78 | 1897 | active |
| trustedsec/CS-Situational-Awareness-BOF A collection of situational awareness commands implemented as Cobalt Strike Beacon Object Files (BOFs) in C, letting operators run low-foot… | 97 | 1896 | active |
| devploit/nomore403 NoMore403 is a Go command-line tool that automates testing of HTTP 401/403 access-control bypasses via request path, method, header, and wi… | 81 | 1894 | active |
| cifertech/RF-Clown RF-Clown is an open-source BLE and Bluetooth jammer built on ESP32 and multiple nRF24L01 radio modules, with an OLED display, NeoPixel feed… | 60 | 1894 | active |
| tgalal/yowsup Yowsup is a Python library that implements the WhatsApp protocol, enabling developers to build custom applications and clients that communi… | 23 | 7170 | maintenance |
| nsonaniya2010/SubDomainizer SubDomainizer is a Python CLI tool that discovers hidden subdomains and secrets in webpages, external JavaScript files, GitHub, and local f… | 65 | 1893 | active |