Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Pangolin Pangolin is an open‑source SASE platform that unifies a WireGuard‑based VPN, zero‑trust reverse proxy, privileged access management, and an… | 85 | 23082 | active |
| Pangolin Pangolin is an open-source, identity-aware remote access platform built on WireGuard that combines VPN and tunneled reverse proxy capabilit… | 85 | 23082 | active |
| Magic Wormhole Magic Wormhole is a Python library and command-line tool for securely transferring arbitrary-sized files, directories, or short text betwee… | 77 | 23006 | stable |
| Renovate Renovate is a cross-platform CLI tool that automatically detects outdated dependencies in repositories and creates pull requests to update … | 96 | 22789 | active |
| NemoClaw NVIDIA NemoClaw is a reference stack that runs AI agents like OpenClaw, Hermes, and LangChain Deep Agents inside secure OpenShell sandboxes… | 69 | 22754 | active |
| NemoClaw NVIDIA NemoClaw is an open-source reference stack for running AI coding agents such as OpenClaw, Hermes, and LangChain Deep Agents Code sec… | 69 | 22754 | active |
| SafeLine SafeLine is a self‑hosted Web Application Firewall and reverse‑proxy written in Go. It protects web services by filtering malicious HTTP tr… | 96 | 22725 | active |
| SafeLine SafeLine is a self-hosted web application firewall (WAF) that acts as an Nginx-based reverse proxy to protect web apps from attacks like SQ… | 96 | 22725 | active |
| HyNetworks/hysteria Hysteria is an open‑source proxy solution built on a custom QUIC implementation. It provides SOCKS5, HTTP, TCP/UDP forwarding and TUN/TProx… | 99 | 22671 | active |
| smicallef/spiderfoot SpiderFoot is an open-source OSINT automation tool that integrates with over 200 data sources to gather and analyze intelligence about targ… | 54 | 22608 | active |
| lissy93/personal-security-checklist Personal Security Checklist is an open‑source, web‑based guide that compiles 300+ actionable tips for protecting digital security and priva… | 77 | 22581 | active |
| Unleashed Firmware Unleashed is an open‑source alternative firmware for the Flipper Zero handheld hacking tool. It adds extensive radio protocol support, a la… | 94 | 22491 | active |
| Unleashed Firmware Unleashed Firmware is an unofficial custom firmware (CFW) for the Flipper Zero multitool device, written in C. It extends the stock firmwar… | 94 | 22491 | active |
| Frida Frida is a dynamic instrumentation toolkit that lets developers, reverse-engineers, and security researchers inject JavaScript or native li… | 95 | 22266 | active |
| opa334/TrollStore TrollStore is a permanently signed jailed iOS app that exploits an AMFI/CoreTrust bug to install any IPA with arbitrary entitlements and ro… | 63 | 22205 | active |
| mack-a/v2ray-agent v2ray-agent is a shell-based one‑click script that installs and configures multiple proxy cores (Xray, sing‑box, etc.) with support for man… | 100 | 22135 | active |
| MobSF/Mobile-Security-Framework-MobSF MobSF is an automated all-in-one mobile application security testing framework for Android, iOS, and Windows Mobile apps. It performs stati… | 94 | 21980 | active |
| gentilkiwi/mimikatz mimikatz is a well-known Windows security tool written in C that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memo… | 54 | 21909 | active |
| Ciphey Ciphey is a command‑line utility (and library) that automatically detects and decodes encrypted or encoded text without needing the key or … | 85 | 21662 | active |
| Ciphey Ciphey is a Rust-based CLI tool and library that automatically decrypts encryptions without a known key or cipher, decodes encodings, and c… | 85 | 21662 | active |
| elastic/kibana Kibana is an open‑source browser‑based analytics and visualization UI for Elasticsearch. It lets users explore, query, and monitor data thr… | 95 | 21315 | active |
| Vulhub Vulhub is an open‑source collection of pre‑built vulnerable Docker environments that can be launched with a single Docker Compose command. … | 75 | 21309 | active |
| allinurl/goaccess GoAccess is an open‑source, real‑time web log analyzer that can display statistics in a terminal UI or a live HTML dashboard. It parses com… | 77 | 21061 | active |
| Teleport Teleport is a self‑hosted identity‑aware access proxy that provides secure, short‑lived certificate authentication for SSH, Kubernetes, dat… | 88 | 20995 | active |
| Teleport Teleport is an identity-aware access proxy and certificate authority that provides unified, credential-free access to SSH servers, Kubernet… | 88 | 20995 | stable |
| hwanz/SSR-V2ray-Trojan A community‑maintained repository that curates and continuously updates recommendations for VPN/proxy services (often called "airports") su… | 72 | 20788 | active |
| peass-ng/PEASS-ng PEASS-ng is a collection of privilege escalation scripts for Linux, Windows and macOS that enumerate system information and potential escal… | 96 | 20681 | active |
| Nyr/openvpn-install A Bash script that automates the installation and configuration of an OpenVPN server on popular Linux distributions. It provides an interac… | 75 | 20642 | active |
| GoogleHosts GoogleHosts is an open-source project that automatically generates hosts files for ad‑blocking and domain filtering. It provides a CLI to d… | 32 | 20558 | active |
| motdotla/dotenv Dotenv is a zero‑dependency JavaScript library that loads variables from a .env file into process.env. It also provides a CLI to run comman… | 75 | 20538 | active |
| bee-san/RustScan RustScan is a modern, fast port scanner written in Rust. It can scan all 65k ports in seconds and pipe results to Nmap or custom scripts. | 67 | 20516 | active |
| Obtainium Obtainium is an Android application that checks for updates directly from source repositories and downloads the latest APKs. It supports ma… | 95 | 20509 | active |
| Apache Casbin Apache Casbin is an open‑source authorization library that enforces access control policies across multiple programming languages. It suppo… | 96 | 20433 | active |
| Apache Casbin Apache Casbin is an open-source authorization library that enforces access control using models such as ACL, RBAC, ABAC, ReBAC, and MAC, de… | 96 | 20433 | stable |
| yanue/V2rayU V2rayU is a native macOS client built with Swift that leverages the V2Ray core for proxying network traffic. It supports multiple protocols… | 86 | 20156 | active |
| bettercap Bettercap is a powerful, extensible framework and command‑line tool written in Go for network reconnaissance and man‑in‑the‑middle attacks.… | 82 | 20111 | active |
| bettercap bettercap is a Go-based, all-in-one framework for network reconnaissance and man-in-the-middle attacks across WiFi, Bluetooth Low Energy, w… | 82 | 20111 | active |
| Universal Android Debloater Universal Android Debloater is a cross‑platform graphical application written in Rust that uses ADB to uninstall or disable unwanted system… | 23 | 20010 | active |
| Sandboxie Sandboxie Plus & Classic is an open‑source sandbox‑based isolation tool for Windows that lets applications run in a virtual environment wit… | 100 | 19712 | active |
| Sandboxie Sandboxie Plus and Classic are open-source sandbox-based isolation applications for Windows that run programs in isolated environments with… | 100 | 19712 | active |
| gVisor gVisor is an open‑source application kernel that provides a Linux‑compatible sandbox for containers, running entirely in userspace. It incl… | 100 | 19696 | active |
| mxrch/GHunt GHunt is an offensive Google framework focused on OSINT, usable both as a CLI tool and as a Python library. It can gather information about… | 53 | 19586 | active |
| SimpleX SimpleX Chat is an open‑source messenger that operates without any user identifiers, providing 100 % private, end‑to‑end encrypted communic… | 96 | 19495 | active |
| SimpleX SimpleX Chat is a private messaging platform and set of mobile/desktop apps that operate without any user identifiers, delivering end-to-en… | 96 | 19495 | active |
| docker-mailserver A production-ready, containerized fullstack mail server bundling Postfix (SMTP), Dovecot (IMAP/POP3), Rspamd, SpamAssassin, ClamAV, Fail2ba… | 97 | 19434 | active |
| tiann/KernelSU KernelSU is a kernel-based root solution for Android that runs inside the Linux kernel to grant root access. It provides stealthy, permissi… | 95 | 19399 | active |
| amark/gun GUN is an open‑source, peer‑to‑peer graph database written in JavaScript. It provides real‑time, offline‑first data synchronization with bu… | 66 | 19140 | active |
| HunxByts/GhostTrack GhostTrack is a Python-based OSINT CLI tool for gathering information about IP addresses, phone numbers, and usernames across social media.… | 30 | 19087 | active |
| dromara/Sa-Token Sa-Token is a lightweight Java authentication and authorization library that provides login, permission, SSO, OAuth2 and token management o… | 91 | 19071 | active |
| fail2ban/fail2ban Fail2Ban is a daemon that monitors log files for repeated authentication failures and automatically updates firewall rules to block offendi… | 85 | 18788 | active |
| ZeroNet ZeroNet is an open‑source platform that lets users create and browse decentralized websites using Bitcoin cryptography and the BitTorrent n… | 23 | 18776 | active |
| google/magika Magika is an AI‑powered tool that detects a file's content type using a tiny deep‑learning model. It is available as a fast command‑line ut… | 87 | 18718 | active |
| Wasmtime Wasmtime is a standalone WebAssembly runtime built on the Cranelift code generator, usable both as a CLI and as an embeddable library. It s… | 95 | 18712 | stable |
| slackhq/nebula Nebula is a scalable overlay networking tool (mesh VPN) built on the Noise Protocol Framework, using certificates and security groups for m… | 93 | 18399 | stable |
| ginuerzh/gost GOST (GO Simple Tunnel) is a Go-based tunneling and proxy tool supporting HTTP/HTTPS/HTTP2/SOCKS4/SOCKS5/Shadowsocks protocols plus QUIC, K… | 64 | 18244 | active |
| auth0/node-jsonwebtoken A Node.js library implementing JSON Web Tokens (JWT) per RFC 7519, supporting signing and verification with HMAC, RSA, and ECDSA algorithms… | 69 | 18183 | stable |
| NVIDIA/SkillSpector SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnera… | 79 | 18115 | active |
| laramies/theHarvester theHarvester is a Python CLI tool that gathers open-source intelligence (emails, subdomains, hostnames, IPs, names, URLs, ASNs) about a dom… | 89 | 18003 | active |
| Verdaccio Verdaccio is a lightweight, zero-config private npm proxy registry built in Node.js. It hosts private packages, proxies and caches upstream… | 97 | 17906 | active |
| projectdiscovery/katana Katana is a fast, configurable web crawling and spidering framework written in Go, supporting both standard HTTP-based and headless browser… | 90 | 17565 | active |
| ory/hydra Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider server written in Go, handling token issuance, client management, an… | 72 | 17563 | stable |
| JustAuth JustAuth is a small, comprehensive Java library for third-party OAuth2 authorization login. It integrates dozens of domestic and internatio… | 54 | 17523 | stable |
| cure53/DOMPurify DOMPurify is a fast, DOM-only XSS sanitizer for HTML, MathML and SVG that removes malicious markup while allowing safe content. It works in… | 98 | 17450 | stable |
| zhishile/codex-auth-helper A Chrome (Manifest V3) browser extension that extracts a logged-in ChatGPT session locally and generates a Codex-compatible auth. credentia… | 54 | 17403 | active |
| Wazuh Wazuh is a free, open source security platform that unifies XDR and SIEM capabilities for threat prevention, detection, and response across… | 98 | 17197 | stable |
| ZeroTier ZeroTier is a software-defined networking tool that creates secure virtual Ethernet networks spanning devices, VMs, containers, and clouds … | 78 | 17152 | stable |
| goproxy GoProxy is a high-performance, cross-platform proxy server written in Go supporting HTTP(S), SOCKS5, SS, WebSocket, TCP, UDP, and DNS proxy… | 88 | 17142 | active |
| ZPhisher Zphisher is a beginner-friendly, automated phishing toolkit written in Bash with 30+ ready-made login page templates. It supports multiple … | 23 | 17031 | active |
| Semgrep Semgrep is a fast, open-source static analysis tool that searches code, finds bugs, and enforces secure coding standards using rules that l… | 95 | 16978 | active |
| stascorp/rdpwrap RDP Wrapper Library is a Windows system library that enables Remote Desktop Host support and concurrent RDP sessions on editions that ship … | 23 | 16884 | stable |
| ffuf ffuf is a fast web fuzzer written in Go used for discovering directories, virtual hosts, and parameters by brute-forcing HTTP requests. It … | 96 | 16880 | stable |
| MatrixTM/MHDDoS MHDDoS is a Python 3 command-line DDoS attack script offering 57 flood methods across Layer 7 (HTTP) and Layer 4 (TCP/UDP), including bypas… | 86 | 16730 | active |
| flipperdevices/flipperzero-firmware The official open-source firmware for the Flipper Zero, a portable multi-tool device for interacting with access control systems. It implem… | 79 | 16718 | active |
| jpillora/chisel Chisel is a fast TCP/UDP tunnel transported over HTTP and secured via SSH, shipped as a single Go executable containing both client and ser… | 93 | 16662 | active |
| redox-os/redox Redox is a full-featured Unix-like operating system written in Rust with a microkernel architecture, inspired by seL4, MINIX, Plan 9, Linux… | 66 | 16594 | active |
| Lynis Lynis is an open-source security auditing and hardening tool for UNIX-based systems including Linux, macOS, and BSD. It performs in-depth l… | 83 | 16450 | stable |
| JavaScript Obfuscator A powerful open-source JavaScript and Node.js obfuscator that transforms readable source code into hard-to-reverse-engineer output using id… | 98 | 16309 | active |
| Cryptomator Cryptomator is an open-source desktop and mobile application that provides transparent client-side encryption for files stored in any cloud… | 94 | 16282 | stable |
| System Informer System Informer (formerly Process Hacker) is a free, open-source, multi-purpose Windows tool for monitoring system resources, debugging sof… | 86 | 16265 | active |
| fortra/impacket Impacket is a collection of Python classes for low-level programmatic access to network protocols, including full implementations of SMB1-3… | 79 | 16168 | active |
| angristan/openvpn-install A Bash script that installs and manages a self-hosted OpenVPN VPN server on many Linux distributions. It handles client certificate generat… | 76 | 16155 | active |
| cloudflare/cloudflared cloudflared is the command-line client and daemon for Cloudflare Tunnel, which creates outbound-only connections from your origin servers t… | 98 | 16080 | stable |
| GreyDGL/PentestGPT PentestGPT is an AI-powered penetration testing agent framework that drives LLMs (Claude Code, Codex, or many providers in legacy mode) to … | 65 | 15948 | active |
| FlareSolverr FlareSolverr is a proxy server that bypasses Cloudflare and DDoS-GUARD protection by solving browser challenges with Selenium and undetecte… | 97 | 15906 | active |
| Zed Attack Proxy (ZAP) Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source web application security scanner used for finding vulnerabilities in web apps du… | 74 | 15865 | stable |
| Evilginx Evilginx is a standalone man-in-the-middle attack framework written in Go that proxies traffic between a victim's browser and a legitimate … | 58 | 15743 | active |
| Konloch/bytecode-viewer Bytecode Viewer is a free, open-source Java and Android APK reverse engineering suite that bundles six Java decompilers, bytecode disassemb… | 67 | 15678 | active |
| passteque/gluetun Gluetun is a lightweight VPN client packaged as a thin Alpine Docker container, written in Go, supporting many VPN providers via OpenVPN or… | 94 | 15598 | active |
| eCapture eCapture is an eBPF-based CLI tool that captures SSL/TLS plaintext traffic without needing CA certificates, supporting OpenSSL, LibreSSL, B… | 99 | 15501 | active |
| amnezia-vpn/amnezia-client Amnezia VPN is an open-source, cross-platform VPN client (desktop and mobile) that can automatically deploy a self-hosted VPN server on you… | 93 | 15351 | active |
| trustedsec/social-engineer-toolkit The Social-Engineer Toolkit (SET) is an open-source Python-based penetration testing framework for authorized social-engineering assessment… | 67 | 15346 | active |
| SuperTokens SuperTokens Core is the open-source HTTP service at the heart of the SuperTokens authentication platform, handling core auth logic and data… | 92 | 15324 | active |
| dogecoin/dogecoin Dogecoin Core is the reference full-node client and wallet for the Dogecoin cryptocurrency, adapted from Bitcoin Core. It lets anyone run a… | 65 | 15232 | active |
| Amass OWASP Amass is a Go-based framework for in-depth attack surface mapping and external asset discovery using OSINT gathering and active recon… | 75 | 15211 | active |
| ZITADEL ZITADEL is an open-source identity and access management (IAM) platform providing authentication and authorization out of the box, includin… | 94 | 15193 | active |
| txthinking/brook Brook is a cross-platform programmable network tool written in Go that provides encrypted proxy/VPN functionality with system-level network… | 85 | 15192 | active |
| OAuth2 Proxy OAuth2 Proxy is a reverse proxy and middleware that adds OAuth2/OIDC authentication in front of web applications, supporting providers like… | 95 | 15158 | stable |
| CrowdSec CrowdSec is an open-source, crowdsourced security engine that analyzes logs and HTTP requests to detect malicious behavior and block offend… | 93 | 15138 | stable |
| duplicati/duplicati Duplicati is a free, open-source backup client that stores encrypted, incremental, compressed backups on cloud storage services and remote … | 95 | 15085 | active |
| Holehe Holehe is an OSINT tool that checks whether an email address is registered on 120+ sites (Twitter, Instagram, Snapchat, etc.) by abusing th… | 32 | 14958 | active |