Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| WireGuard/wireguard-android The official Android GUI application for WireGuard, a fast and modern VPN. It opportunistically uses the in-kernel WireGuard implementation… | 69 | 1628 | stable |
| Heimdall Heimdall is a Rust-based EVM smart contract toolkit for bytecode analysis, decompilation, disassembly, control flow graph generation, stora… | 87 | 1627 | active |
| Zizaco/entrust Entrust is a Laravel package that adds role-based permissions (RBAC) to Laravel applications, providing Role and Permission models, migrati… | 23 | 5999 | maintenance |
| hashcat/hashcat-utils A collection of small standalone C utilities that assist with advanced password cracking tasks, complementing the hashcat tool. Each utilit… | 42 | 1625 | active |
| nikaiw/VMkatz VMkatz is a Rust CLI tool that extracts Windows credentials (NTLM hashes, DPAPI keys, Kerberos tickets, LSA secrets, BitLocker keys) direct… | 81 | 1624 | active |
| alexazhou/VeryNginx VeryNginx is an enhanced Nginx distribution built on lua-nginx-module (OpenResty) that adds a web application firewall, request routing, ra… | 23 | 5979 | maintenance |
| wiredoor/wiredoor Wiredoor is a self-hosted ingress-as-a-service platform that exposes services running in private or local networks to the internet via reve… | 85 | 1622 | active |
| coffinxp/loxs Loxs is a Python-based multi-vulnerability scanner for web applications that detects SQL injection, XSS, LFI, open redirect, and CRLF injec… | 46 | 1622 | active |
| Proton Mail Proton Mail's official iOS client for end-to-end encrypted email, written in Swift/SwiftUI with core business logic in a Rust-based SDK. Th… | 63 | 1620 | active |
| SecurityRiskAdvisors/VECTR VECTR is a self-hosted web application for tracking red and blue team testing activities to measure detection and prevention capabilities a… | 92 | 1618 | active |
| uber/ADR ADR (Agentic AI Detection and Response) is an open-source enterprise security framework for AI agents, providing endpoint discovery of AI t… | 66 | 1618 | active |
| Permify/permify Permify is an open-source authorization-as-a-service inspired by Google Zanzibar, providing a permission database and policy decision point… | 96 | 5956 | maintenance |
| michenriksen/aquatone Aquatone is a Go CLI tool for visual inspection of websites across many hosts, taking screenshots via headless Chrome/Chromium and generati… | 10 | 5956 | maintenance |
| attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images… | 99 | 1615 | active |
| DuendeSoftware/products Duende Products is a suite of identity and access management SDKs for ASP.NET Core, centered on Duende IdentityServer, a standards-complian… | 95 | 1614 | stable |
| projectdiscovery/notify Notify is a Go-based CLI tool that streams the output of other tools (or reads from a file or pipe) and publishes it to messaging platforms… | 66 | 1614 | active |
| Orange-Cyberdefense/ocd-mindmaps A collection of interactive mindmaps from Orange Cyberdefense covering offensive security and penetration testing methodologies, published … | 33 | 1614 | active |
| fofapro/fapro FaPro is a free, cross-platform, single-file mass network protocol server simulator written in Python. It can start or stop many fake netwo… | 23 | 1614 | active |
| GZTimeWalker/GZCTF GZ::CTF is an open-source Capture The Flag (CTF) competition platform built on ASP.NET Core with a React frontend. It supports static and d… | 99 | 1613 | active |
| Keygen Licensing API Keygen is a fair source software licensing and distribution API that lets developers add license key validation, entitlements, device activ… | 85 | 1611 | active |
| m8sec/CrossLinked CrossLinked is a Python CLI tool that enumerates LinkedIn employee names for an organization by scraping search engine results, without nee… | 23 | 1611 | active |
| ReaJason/MemShellParty MemShellParty is a self-hosted, visual tool for rapidly generating Java memory shells (fileless webshells) for mainstream web middleware an… | 88 | 1610 | active |
| repplus/rep-chrome rep+ is a Chrome DevTools extension inspired by Burp Suite's Repeater that captures and replays HTTP requests with modified methods, header… | 48 | 1610 | active |
| liamg/gitjacker Gitjacker is a Go CLI tool that downloads and reconstructs git repositories from websites where the .git directory has been mistakenly expo… | 44 | 1610 | active |
| ankane/lockbox Lockbox is a Ruby gem providing modern encryption for database fields, files, and strings in Ruby and Rails applications. It integrates wit… | 75 | 1609 | stable |
| FireHOL FireHOL is a Linux firewall management tool built on iptables/ipsets, paired with a repository of IP blocklists dynamically updated via the… | 52 | 1604 | active |
| Heads Heads is an open-source firmware and OS configuration that runs a minimal Linux as a coreboot or LinuxBoot ROM payload, moving the root of … | 68 | 1602 | active |
| atinux/nuxt-auth-utils A Nuxt module that adds authentication to Nuxt applications using secured and sealed cookie sessions. It supports 40+ OAuth providers, pass… | 86 | 1601 | active |
| KindleModding/WinterBreak WinterBreak is a jailbreak tool for Amazon Kindle e-readers, built on top of the Mesquito framework. It allows users to unlock their Kindle… | 81 | 1601 | active |
| Clats97/ClatScope ClatScope Info Tool is a Python-based OSINT utility offering 70+ reconnaissance features including geolocation, DNS, WHOIS, phone, email, a… | 43 | 1598 | active |
| PentestPad/subzy Subzy is a Go-based command-line tool that checks subdomains for takeover vulnerabilities by matching HTTP response fingerprints from the c… | 32 | 1597 | active |
| libssh2/libssh2 libssh2 is a client-side C library implementing the SSH2 protocol, licensed under the revised BSD license. It provides session establishmen… | 68 | 1596 | stable |
| dyne/tomb Tomb is a minimalist command-line tool for GNU/Linux that creates and manages encrypted storage folders ('tombs') using dm-crypt and LUKS v… | 54 | 1596 | stable |
| tendermint/tendermint Tendermint Core is a Byzantine Fault Tolerant (BFT) consensus engine and blockchain application platform written in Go. It securely replica… | 66 | 5864 | maintenance |
| xnl-h4ck3r/xnLinkFinder xnLinkFinder is a Python CLI tool that discovers endpoints, potential parameters, target-specific wordlists, and secrets for a given target… | 71 | 1594 | active |
| s0md3v/uro uro is a Python CLI tool that declutters URL lists for crawling and security testing without making any HTTP requests. It removes duplicate… | 26 | 1594 | stable |
| StamusNetworks/Clear-NDR-ISO Clear NDR Community (formerly SELKS) is a Debian-based Linux distribution for network detection and response built around Suricata, OpenSea… | 38 | 1592 | active |
| capitalone/DataProfiler DataProfiler is a Python library that loads CSV, AVRO, Parquet, JSON, text, or URL data into a pandas-compatible DataFrame and profiles it … | 91 | 1591 | active |
| m3n0sd0n4ld/GooFuzz GooFuzz is a Bash-based CLI tool that performs fuzzing-style reconnaissance using advanced Google searches (Google Dorking) via the Google … | 50 | 1591 | active |
| LeeeSe/MessAuto MessAuto is a free macOS menu bar application, built in Rust, that automatically extracts SMS and email verification codes from the built-i… | 64 | 1590 | active |
| gurnec/btcrecover btcrecover is an open-source Python command-line tool for recovering Bitcoin (and altcoin) wallet passwords and seed phrases when most of t… | 32 | 1589 | active |
| AlisamTechnology/ATSCAN ATSCAN is a Perl-based command-line scanner for mass dork searching and vulnerability exploitation. It combines search engine dorking with … | 23 | 1589 | active |
| OWASP/crAPI crAPI (completely ridiculous API) is an intentionally vulnerable web application built by OWASP to demonstrate the OWASP API Security Top 1… | 65 | 1588 | active |
| samwafgo/SamWaf SamWaf is a lightweight, open-source web application firewall (WAF) written in Go, designed for small companies, studios, and personal webs… | 89 | 1587 | active |
| cyberark/FuzzyAI FuzzyAI is an automated LLM fuzzing tool from CyberArk that tests LLM APIs for jailbreak vulnerabilities. It ships as a Python CLI with a w… | 48 | 1587 | active |
| nzymeorg/nzyme Nzyme is an open-source intrusion detection system that monitors WiFi, Bluetooth, and Ethernet networks for threats such as rogue access po… | 79 | 1586 | active |
| horsicq/XELFViewer XELFViewer is a GUI application for viewing and editing ELF (Executable and Linkable Format) binary files on Windows, Linux and macOS. It i… | 67 | 1586 | active |
| austral/austral Austral is a new systems programming language featuring linear types for provably safe resource and memory management, and linear capabilit… | 34 | 1586 | active |
| nccgroup/PMapper Principal Mapper (PMapper) is a Python CLI tool and library that models AWS IAM users and roles as a directed graph to identify privilege e… | 23 | 1585 | active |
| moom825/xeno-rat Xeno-RAT is an open-source remote access tool (RAT) written in C# for remotely controlling Windows 10/11 machines. It includes features suc… | 18 | 1585 | active |
| QuiteAFancyEmerald/InvisiProxy InvisiProxy LTS (formerly Holy Unblocker) is a self-hostable Node.js web proxy service that lets users access blocked websites and Tor/Onio… | 97 | 1584 | active |
| ZimengXiong/tinyTouch tinyTouch is an open-source DIY hardware and software project that lets you authenticate, sudo, and log in to your computer with a fingerpr… | 79 | 1584 | active |
| dfir-iris/iris-web IRIS is a self-hosted, collaborative web platform for incident responders to share technical details and manage investigations. It ships as… | 95 | 1582 | active |
| vimalloc/flask-jwt-extended Flask-JWT-Extended is an open source Flask extension that adds JSON Web Token (JWT) support for protecting routes, with many optional batte… | 87 | 1580 | stable |
| zama-ai/concrete Concrete is an open-source fully homomorphic encryption (FHE) compiler built on TFHE and LLVM that converts Python programs into their FHE … | 52 | 1580 | active |
| homeassistant-apps/app-cloudflared A Home Assistant add-on that runs Cloudflared to create a secure Cloudflare Tunnel to your Home Assistant instance. It enables remote acces… | 98 | 1578 | active |
| ChipWhisperer ChipWhisperer is an open-source toolchain for hardware security research, providing capture hardware designs, FPGA/USB firmware, and a Pyth… | 95 | 1578 | active |
| spatie/laravel-honeypot A Laravel package that prevents spam form submissions using honeypot fields and submission-time checks. It provides a Blade component and m… | 91 | 1578 | stable |
| Hard_Configurator ConfigureDefender is a small portable Windows GUI utility for viewing and configuring Windows Defender antivirus settings on Windows 10/11 … | 70 | 1578 | active |
| stealthcopter/deepce DEEPCE is a single-file pure-shell script for enumerating Docker environments and attempting privilege escalation and container escapes. It… | 55 | 1578 | active |
| hakluke/hakrevdns hakrevdns is a small, fast Go CLI tool that performs reverse DNS (PTR) lookups on large batches of IP addresses. It maps IPs to hostnames, … | 71 | 1577 | stable |
| patched-codes/patchwork Patchwork is an open-source agentic AI framework and CLI that automates development chores like PR reviews, bug fixing, security patching, … | 68 | 1577 | active |
| pk-fr/yakpro-po YAK Pro - Php Obfuscator is a free, open-source CLI tool that obfuscates pure PHP source code using the PHP-Parser library. It removes comm… | 59 | 1577 | active |
| lqqyt2423/go-mitmproxy A Golang implementation of mitmproxy that intercepts, parses, monitors, and tampers with HTTP/HTTPS traffic via a man-in-the-middle proxy. … | 95 | 1576 | active |
| dwisiswant0/crlfuzz CRLFuzz is a fast command-line tool written in Go that scans websites for CRLF (carriage return/line feed) injection vulnerabilities. It su… | 64 | 1573 | active |
| BLE-Research-Group/MetaRadar MetaRadar (BLE Radar) is an Android application for monitoring Bluetooth Low Energy environments. It scans for nearby BLE devices, analyzes… | 65 | 1570 | active |
| AD-Security/AD_Miner AD Miner is an Active Directory (on-premise and Entra ID) auditing tool that runs Cypher queries against a BloodHound Neo4j graph database … | 64 | 1569 | active |
| wikiZ/RedGuard RedGuard is a C2 front flow control tool written in Go that acts as a filtering reverse proxy in front of command-and-control servers. It h… | 23 | 1569 | active |
| OWASP/QRLJacking QRLJacking is an OWASP project documenting and exploiting the Quick Response Code Login Jacking attack vector, which hijacks user sessions … | 44 | 1567 | active |
| kubernetes-sigs/secrets-store-csi-driver A Kubernetes CSI driver that mounts secrets, keys, and certificates from external secrets stores (Vault, Azure Key Vault, AWS Secrets Manag… | 94 | 1565 | stable |
| Tsojan/TsojanScan TsojanScan is an integrated BurpSuite plugin for vulnerability detection that bundles multiple common vulnerability POCs into a single exte… | 84 | 1565 | active |
| cachix/secretspec SecretSpec is a declarative tool and library for defining the secrets an application needs in a secretspec.toml manifest and resolving them… | 84 | 1564 | active |
| drduh/pwd.sh pwd.sh is a single Bash script that manages text secrets such as passwords using GnuPG symmetric encryption. Secrets are stored in randomly… | 86 | 1563 | active |
| MikeWang000000/FakeHTTP FakeHTTP is a Linux command-line tool that obfuscates TCP connections by disguising them as HTTP traffic using Netfilter Queue (NFQUEUE). I… | 31 | 1563 | active |
| Gowtham-Darkseid/AutoPentestX AutoPentestX is a Python-based automated penetration testing toolkit that scans targets for vulnerabilities and generates security reports.… | 43 | 1562 | active |
| system-linux/FazJammer FazJammer is an ESP8266-based firmware project that turns a NodeMCU plus an NRF24L01+ radio module into a device that jams Wi-Fi, BLE, and … | 39 | 1562 | active |
| Action Policy Action Policy is an authorization framework for Ruby and Rails applications, built around resource-specific policy classes with composable … | 64 | 1561 | stable |
| XSS Hunter XSS Hunter Express is a self-hosted service for tracking and detecting blind cross-site scripting (XSS) vulnerabilities via injected payloa… | 32 | 1561 | active |
| Verge Verge Core is the official full-node source code for the Verge (XVG) cryptocurrency, providing a wallet client, mining support, and blockch… | 96 | 1560 | active |
| mysk-research/loupe Loupe is an open-source iOS and iPadOS app that demonstrates device fingerprinting by showing raw values from public iOS APIs that any thir… | 56 | 1560 | active |
| v-byte-cpu/sx sx is a fast, UNIX-philosophy command-line network scanner written in Go that supports ARP/NDP host discovery, ICMP, TCP SYN/FIN/NULL/Xmas,… | 77 | 1559 | active |
| meskarune/i3lock-fancy A bash script wrapper around i3lock that takes a screenshot of the desktop, blurs or pixelates it, and overlays a lock icon and text to cre… | 23 | 1559 | stable |
| guacsec/guac GUAC (Graph for Understanding Artifact Composition) is an OpenSSF incubating project that ingests software security metadata such as SBOMs,… | 88 | 1557 | active |
| sidebase/nuxt-auth @sidebase/nuxt-auth is a Nuxt 3+ module that adds authentication to universal Nuxt applications via OAuth providers, credentials, or email … | 93 | 1555 | active |
| AeonLucid/AndroidNativeEmu A Python library that partially emulates Android native (.so) libraries on a host machine using the Unicorn CPU emulator. It emulates the J… | 23 | 1555 | active |
| ProtonMail/proton-bridge Proton Mail Bridge is a desktop application that runs local IMAP and SMTP servers, allowing standard email clients to send and receive encr… | 95 | 1554 | active |
| ServenScorpion/VirtualApp A fork of VirtualApp, an Android virtualization framework that runs apps inside a virtual container supporting app cloning (multi-instance)… | 75 | 1549 | active |
| cupcakearmy/cryptgeon Cryptgeon is a secure, open-source note and file sharing service inspired by PrivNote, built with Rust and Svelte. Notes are encrypted clie… | 93 | 1547 | active |
| lissy93/domain-locker Domain Locker is an open-source web application for tracking and managing a portfolio of domain names across registrars. It monitors expira… | 89 | 1545 | active |
| rooootdev/lara LARA is an iOS customization toolbox application that leverages the DarkSword kernel exploit to modify system behavior on supported devices… | 73 | 1544 | active |
| LitterBox LitterBox is a self-hosted payload-analysis sandbox for red teams that runs static, dynamic, and EDR-based analysis on samples and produces… | 57 | 1544 | active |
| igogo-x86/HexRaysPyTools An IDA Pro plugin that enhances the Hex-Rays decompiler workflow. It assists in reconstructing structures and classes, detecting virtual ta… | 32 | 1541 | active |
| Tongsuo-Project/Tongsuo Tongsuo (铜锁) is an open-source cryptographic library providing modern cryptographic primitives and secure communication protocols, includin… | 86 | 1540 | active |
| mushorg/conpot Conpot is a low-interaction ICS/SCADA honeypot written in Python that emulates industrial control system protocols and devices. It collects… | 87 | 1537 | active |
| ssoready/ssoready SSOReady is an open-source service and set of SDKs for adding enterprise SAML single sign-on and SCIM directory sync to any product. It exp… | 39 | 1536 | active |
| janmojzis/tinyssh TinySSH (tinysshd) is a minimalistic SSHv2 server written in C with under 100,000 words of code, implementing only a secure subset of the p… | 94 | 1535 | active |
| occlum/occlum Occlum is a memory-safe, multi-process library OS (LibOS) written in Rust for Intel SGX enclaves. It lets legacy applications run inside se… | 48 | 1534 | active |
| xnl-h4ck3r/GAP-Burp-Extension GAP is a Burp Suite extension written in Python (Jython) that extracts potential endpoints, parameters, and links from Burp's site map, pro… | 60 | 1533 | active |
| tirrenotechnologies/tirreno tirreno is an open-source, self-hosted security framework written in PHP/PostgreSQL that provides event tracking, threat detection, and ris… | 80 | 1532 | active |
| blacklanternsecurity/writehat WriteHat is a self-hosted web application for generating penetration test reports, converting Markdown to HTML to PDF without Microsoft Wor… | 62 | 1532 | active |