Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| bugbasesecurity/pentest-copilot Pentest Copilot is an open-source, AI-driven penetration testing agent that connects to a Kali attack box, autonomously runs security tools… | 61 | 1531 | active |
| spyboy-productions/r4ven R4ven is a security awareness and penetration testing tool that hosts a web page which, when a user grants browser permissions, captures GP… | 56 | 1531 | active |
| hudikhq/hoodik Hoodik is a self-hosted, end-to-end encrypted cloud storage server written in Rust with a Vue 3 frontend, where all encryption happens in t… | 99 | 1528 | active |
| akto-api-security/akto Akto is an open-source API and AI security platform that discovers and inventories APIs, AI agents, MCP servers, and LLM usage, then contin… | 94 | 1527 | active |
| webpwnized/mutillidae OWASP Mutillidae II is a deliberately vulnerable PHP web application used as a target for web-security training and practice. It includes o… | 75 | 1527 | active |
| cartalyst/sentinel Sentinel is a PHP 8.3+ framework-agnostic authentication and authorization library by Cartalyst. It provides user authentication, roles, pe… | 57 | 1527 | active |
| nikitastupin/clairvoyance Clairvoyance is a Python CLI tool that recovers a GraphQL API's schema even when introspection is disabled, by probing field and type names… | 51 | 1527 | active |
| FOSSA CLI FOSSA CLI is a zero-configuration, language-agnostic dependency analysis tool that detects dependencies in any codebase across 20+ build sy… | 96 | 1526 | active |
| polhenarejos/pico-fido Open-source firmware that turns a Raspberry Pi Pico (RP2040/RP2350) or ESP32-S3 microcontroller into a FIDO2 passkey authenticator, support… | 91 | 1526 | active |
| kkapsner/CanvasBlocker A Firefox browser extension that protects users from browser fingerprinting by blocking or faking readouts of JavaScript APIs such as canva… | 73 | 1525 | active |
| Danny-Dasilva/CycleTLS CycleTLS is a Go library with a JavaScript/TypeScript wrapper that lets clients spoof TLS/JA3 (and JA4) fingerprints when making HTTP reque… | 70 | 1525 | active |
| twofas/2fas-android The official open-source Android app for 2FAS, a two-factor authentication service that generates one-time passwords (TOTP and HOTP) for se… | 89 | 1524 | active |
| zquestz/omniauth-google-oauth2 An OmniAuth strategy gem that enables Google OAuth2 authentication in Ruby applications. It integrates as Rack middleware (e.g., in Rails o… | 82 | 1524 | active |
| Tencent/TFace TFace is a research platform from Tencent Youtu Lab for trusty face analysis, covering face recognition, face security (anti-spoofing), fac… | 54 | 1524 | active |
| globaleaks/globaleaks-whistleblowing-software GlobaLeaks is a free, open-source whistleblowing platform that lets any organization set up and maintain a secure, anonymous reporting syst… | 91 | 1521 | stable |
| salvogiangri/KnoxPatch An LSPosed/Xposed module written in Kotlin that restores Samsung apps and features (Samsung Health, Samsung Cloud, Samsung Flow, etc.) on r… | 81 | 1521 | active |
| overspace-labs/CaA CaA is a BurpSuite extension (Montoya API) that analyzes HTTP traffic to extract parameters, paths, files, and parameter values with freque… | 76 | 1521 | active |
| mike-engel/jwt-cli jwt-cli is a fast command-line tool written in Rust for decoding and encoding JSON Web Tokens (JWTs). It supports custom headers, arbitrary… | 68 | 1520 | active |
| RyanDFIR/hindsight Hindsight is a free Python-based browser forensics tool that parses web artifacts (history, downloads, cache, cookies, bookmarks, autofill,… | 84 | 1519 | active |
| nemesida-waf/waf-bypass WAF Bypass Tool is an open-source Python CLI tool that tests web application firewalls for false positives and false negatives using predef… | 77 | 1519 | active |
| Goby Goby is a network security assessment tool that maps an organization's attack surface and scans for known vulnerabilities and weak password… | 23 | 1519 | active |
| assetnote/nowafpls nowafpls is a Jython-based Burp Suite plugin that bypasses web application firewalls (WAFs) by inserting junk data into HTTP request bodies… | 35 | 1518 | active |
| six2dez/burp-ai-agent Custom AI Agent (formerly Burp AI Agent) is a Burp Suite extension written in Kotlin that integrates LLMs into web security workflows via l… | 77 | 1517 | stable |
| deathmemory/FridaContainer FridaContainer is a modular collection of popular and custom Frida scripts written in TypeScript to speed up reverse engineering work on An… | 52 | 1517 | active |
| ztgrace/changeme changeme is a Python CLI tool that scans networks for devices and services using default or backdoor credentials. Credential definitions ar… | 33 | 1517 | active |
| zapdos-labs/unblink Unblink is an AI-powered camera monitoring application that uses a vision language model (Qwen3-VL) to analyze camera frames, summarize act… | 45 | 1515 | active |
| Bareflank Hypervisor Bareflank is an open-source hypervisor SDK written in C++ (with Rust support) for rapidly prototyping custom hypervisors on 64-bit Intel an… | 23 | 1515 | active |
| GONZOsint/geowifi A Python command-line tool that queries multiple public WiFi geolocation databases (Wigle, Apple, Google, Mylnikov, WiFiDB, Combain, Freifu… | 74 | 1514 | active |
| jaraco/keyring A Python library providing a simple API to access the operating system's native keyring service for safe password storage and retrieval. It… | 71 | 1514 | stable |
| rfxn/linux-malware-detect Linux Malware Detect (LMD) is a bash-based malware scanner for Linux servers featuring a multi-stage detection pipeline (MD5/SHA-256 hashin… | 80 | 1512 | active |
| 0xsp-SRD/mortar Mortar Loader is a red team evasion tool that encrypts PE binaries and shellcode and executes them in memory using various injection techni… | 23 | 1511 | active |
| DarthTon/Blackbone Blackbone is a C++ library for Windows memory hacking, providing APIs for process memory manipulation, DLL injection, manual PE image mappi… | 32 | 5499 | maintenance |
| pallets-eco/flask-wtf Flask-WTF is a Python library that integrates WTForms with the Flask web framework, providing form rendering, validation, CSRF protection, … | 74 | 1510 | stable |
| Microsoft Authentication Library (MSAL) Microsoft Authentication Library (MSAL) for .NET, part of the Microsoft identity platform. It enables .NET applications to acquire security… | 100 | 1505 | stable |
| cryptii/cryptii Cryptii is a web app and framework for modular conversion, encoding, and encryption, performed entirely in the browser with no server inter… | 23 | 1505 | active |
| project-oak/oak Oak is a Rust-based platform for building distributed systems whose components can produce externally verifiable claims about their behavio… | 75 | 1504 | active |
| Greenwolf/ntlm_theft ntlm_theft is a Python3 CLI tool that generates 21 different types of NTLMv2 hash theft files (e.g., .url, .scf, .docx, .pdf, .jnlp) that t… | 74 | 1503 | active |
| Meckazin/ChromeKatz ChromeKatz is a set of offensive security tools (CookieKatz, ElevationKatz) written in C that dump cookies and decryption keys directly fro… | 62 | 1503 | active |
| T4y1oR/RingQ RingQ is a post-exploitation antivirus evasion tool that obfuscates and loads arbitrary Windows executables or shellcode (e.g., Cobalt Stri… | 25 | 1503 | active |
| accounts-js/accounts A suite of TypeScript packages providing fullstack authentication and accounts management for JavaScript applications, supporting GraphQL a… | 23 | 1502 | active |
| duckduckgo/duckduckgo-privacy-extension DuckDuckGo Privacy Essentials is a browser extension for Firefox, Chrome, Edge, and Opera that blocks third-party trackers and ads, manages… | 98 | 1501 | active |
| pyca/bcrypt pyca/bcrypt is a Python library providing bcrypt password hashing and a bcrypt_pbkdf key derivation function. It offers salted hashing with… | 75 | 1501 | active |
| libressl/portable LibreSSL Portable is the portable build of LibreSSL, a TLS and cryptography stack forked from OpenSSL 1.0.1g by the OpenBSD project. It pro… | 99 | 1500 | stable |
| restic backup solution A high-performance HTTP server written in Go that implements restic's REST backend API, allowing the restic backup client to store backups … | 66 | 1500 | active |
| ChendoChap/pOOBs4 A kernel exploit for PlayStation 4 firmware 9.00 that leverages a filesystem (exfat) bug triggered via a specially formatted USB drive, com… | 32 | 1500 | stable |
| usbarmory/usbarmory USB armory is an open source hardware design for a compact secure computer built into a USB stick form factor, based on ARM SoCs. This repo… | 73 | 1499 | active |
| ioi/isolate Isolate is a Linux sandbox for securely executing untrusted programs, originally built for programming contest judges. It uses kernel featu… | 73 | 1499 | stable |
| pass-with-high-score/universal-installer Universal Installer is an open-source Android package manager app built with Kotlin and Jetpack Compose that installs APK, APKS, XAPK, and … | 83 | 1498 | active |
| pass-extension/pass-otp pass-otp is an extension for the pass password manager that stores and manages one-time-password (OTP) tokens as otpauth:// URIs. It genera… | 35 | 1498 | active |
| Batfish Batfish is an open-source network configuration analysis tool that builds complete models of network behavior from device configurations to… | 85 | 1495 | active |
| pygod-team/pygod PyGOD is a Python library for graph outlier detection (anomaly detection) built on PyTorch and PyTorch Geometric. It provides 10+ graph-bas… | 23 | 1495 | active |
| ergrelet/unlicense A Python 3 command-line tool that dynamically unpacks executables protected with Themida/WinLicense 2.x and 3.x. It automatically recovers … | 23 | 1495 | active |
| Gezine/Y2JB Y2JB is a PS5 exploit that achieves userland code execution through the console's YouTube app. It supports firmware 4.03+ via a payload del… | 72 | 1494 | active |
| coder/wush wush is a command-line tool for transferring files and opening remote shells between computers over peer-to-peer WireGuard connections. It … | 37 | 1494 | active |
| JJTech0130/TrollRestore TrollRestore is a Python-based installer that installs TrollStore on iOS/iPadOS 15.2 through 16.7 RC and 17.0 by exploiting CVE-2024-44252 … | 14 | 1494 | active |
| cossacklabs/acra Acra is a database security suite that provides field-level encryption, searchable encryption, tokenization, data masking, SQL firewalling,… | 54 | 1493 | active |
| google/go-safeweb go-safeweb is a collection of Go libraries for building secure-by-default HTTP servers. It applies security mechanisms like XSS and CSRF pr… | 10 | 1493 | active |
| Spomky-Labs/otphp A PHP library for generating one-time passwords according to RFC 4226 (HOTP) and RFC 6238 (TOTP). It is compatible with Google Authenticato… | 89 | 1492 | stable |
| hellman/xortool xortool is a Python command-line tool for cryptanalysis of multi-byte XOR ciphers. It guesses the key length based on character frequency s… | 39 | 1491 | active |
| halo/LinkLiar LinkLiar is a free, open-source macOS status menu application written in Swift for spoofing the MAC addresses of Wi-Fi and Ethernet interfa… | 35 | 1491 | active |
| TheresAFewConors/Sooty Sooty is a Python CLI tool that automates routine tasks for SOC (Security Operations Center) analysts, such as URL sanitization, DNS and Wh… | 32 | 1491 | active |
| Kubesec Kubesec is a static analysis tool that performs security risk analysis on Kubernetes resource manifests, assigning a security score and det… | 87 | 1490 | active |
| VirusTotal/vt-cli The official VirusTotal command-line interface, written in Go, that lets users interact with VirusTotal's API from the terminal. It support… | 76 | 1489 | active |
| securitybunker/databunker Databunker is a self-hosted, Go-based secure vault for tokenizing and storing personal records such as PII, PHI, KYC, and PCI data. It expo… | 71 | 1487 | active |
| esprfid/esp-rfid ESP RFID is an open-source access control system that runs on the ESP8266 microcontroller and supports MFRC522, PN532, RDM6300, and Wiegand… | 66 | 1486 | active |
| hectorm/otpauth A JavaScript One-Time Password library implementing HOTP (RFC 4226) and TOTP (RFC 6238) for generating and validating 2FA tokens. It runs i… | 89 | 1485 | stable |
| inguardians/peirates Peirates is a Go-based, interactive Kubernetes penetration testing tool that automates privilege escalation, lateral movement, and cluster … | 99 | 1483 | active |
| webfactory/ssh-agent A GitHub Action that starts ssh-agent on the workflow runner, exports SSH_AUTH_SOCK, and loads one or more private SSH keys from repository… | 74 | 1483 | active |
| kalessil/phpinspectionsea Php Inspections (EA Extended) is an open-source static code analysis tool distributed as a PhpStorm/IntelliJ IDEA plugin. It detects archit… | 73 | 1483 | active |
| Schira4396/VcenterKiller A Go-based all-in-one exploitation and verification tool targeting VMware vCenter, covering major CVEs such as CVE-2021-21972, CVE-2021-219… | 23 | 1482 | active |
| napi-rs A collection of Node.js native addons written in Rust using napi-rs, providing packages like @node-rs/bcrypt, @node-rs/argon2, @node-rs/crc… | 99 | 1481 | active |
| Shopify/ejson EJSON is a Go CLI utility for managing encrypted secrets in JSON files using asymmetric elliptic-curve (NaCl Box) encryption. It lets teams… | 80 | 1481 | stable |
| dotpcap/sharppcap SharpPcap is a fully managed, cross-platform .NET library for capturing packets from live network devices and reading/writing pcap capture … | 67 | 1481 | active |
| Fuzion24/JustTrustMe An Xposed module for rooted Android devices that disables SSL certificate pinning in apps, enabling traffic interception during security au… | 23 | 5368 | maintenance |
| LionSec/katoolin A Python CLI tool that lets users add or remove Kali Linux repositories on other Debian-based systems (like Ubuntu) and install Kali Linux … | 32 | 5367 | maintenance |
| urbanadventurer/username-anarchy Username Anarchy is a Ruby command-line tool that generates lists of likely usernames from people's first and last names for use in penetra… | 23 | 1480 | stable |
| v4lkyr0/Buildware-Tools Buildware-Tools is a Python-based terminal multitool combining OSINT reconnaissance, network diagnostics, Discord automation, cryptography … | 73 | 1479 | active |
| meganz/sdk The official MEGA C++ SDK providing client access to MEGA's end-to-end encrypted cloud storage, including a low-level API, an intermediate … | 95 | 1478 | active |
| momosecurity/FindSomething FindSomething is a passive browser extension for Chrome and Firefox that extracts potentially sensitive information (like emails, API keys,… | 32 | 1476 | active |
| khast3x/h8mail h8mail is a Python CLI tool for email OSINT and password breach hunting. It queries breach services like HaveIBeenPwned and Hunter.io, or s… | 23 | 5348 | maintenance |
| jvoisin/php-malware-finder PHP Malware Finder is a command-line tool that scans filesystems for potentially malicious PHP files using YARA rules. It detects obfuscate… | 10 | 1474 | active |
| lengjibo/RedTeamTools A collection of red team tools written and modified by the author, primarily in C++ and Python. It includes utilities for AV bypass, privil… | 50 | 1473 | active |
| digitalbazaar/forge Forge is a pure-JavaScript implementation of the TLS protocol plus a broad set of cryptographic utilities including AES, RSA, X.509 certifi… | 75 | 5337 | maintenance |
| roro2239/Stellar Stellar is a deeply customized fork of Shizuku, an Android framework that lets apps use system-level APIs via ADB wireless debugging or Roo… | 79 | 1471 | active |
| BlendLog/MinerSearch A free Windows utility that scans for and removes hidden cryptocurrency miners by checking processes, files, registry, WMI, services, and s… | 98 | 1470 | active |
| NHAS/reverse_ssh A Go-based SSH server and client that enables SSH-based reverse shells, letting operators manage and connect to remote targets with native … | 93 | 1470 | active |
| ssh-mitm/ssh-mitm SSH-MITM is an open-source man-in-the-middle SSH server for authorized security audits and malware analysis. It proxies SSH client-server c… | 84 | 1470 | active |
| epsylon/xsser XSSer is an automatic penetration testing framework for detecting, exploiting, and reporting cross-site scripting (XSS) vulnerabilities in … | 80 | 1470 | active |
| OUI-SPY Flock-You is ESP32-S3 firmware that turns a Seeed XIAO ESP32-S3 into a passive 2.4 GHz promiscuous-mode WiFi sniffer for detecting Flock su… | 61 | 1470 | active |
| t3l3machus/psudohash psudohash is a Python CLI tool that generates millions of keyword-based password mutations for brute-force attacks and hash cracking. It mi… | 30 | 1470 | active |
| shuanx/BurpAPIFinder BurpAPIFinder is a Burp Suite extension written in Java that passively analyzes HTTP traffic (HTML and JS files) to discover hidden API end… | 16 | 1469 | active |
| FACT (Firmware Analysis and Comparison Tool) FACT (Firmware Analysis and Comparison Tool) is a self-hosted Python application that automates firmware security analysis for devices like… | 94 | 1468 | active |
| tclahr/uac UAC (Unix-like Artifacts Collector) is a portable, dependency-free shell-based incident response tool that automates forensic artifact coll… | 86 | 1468 | active |
| infrahq/infra Infra is an open-source authentication and access management service for servers, Kubernetes clusters, and databases. It provides identity-… | 67 | 1468 | active |
| tillson/git-hound GitHound is a Go-based CLI tool that hunts for exposed API keys, secrets, and credentials across all of GitHub using GitHub dorks, pattern … | 64 | 1468 | active |
| AhMyth/AhMyth-Android-RAT AhMyth is an open-source Android Remote Administration Tool (RAT) consisting of an Electron-based desktop control panel and an Android back… | 10 | 5312 | maintenance |
| OWASP/wrongsecrets OWASP WrongSecrets is a deliberately vulnerable Java application containing 50+ challenges that demonstrate how secrets are commonly miscon… | 97 | 1466 | active |
| fabriziosalmi/certmate CertMate is a self-hosted certificate lifecycle management platform that issues and renews TLS certificates via ACME/Let's Encrypt across 2… | 82 | 1466 | active |
| xtclovver/RKNHardering An Android application that detects VPN and proxy configurations on a device, implementing the methodology used by Roskomnadzor (RKN) to id… | 72 | 1466 | active |
| strongbox-password-safe/Strongbox Strongbox is a native password manager client for iOS and macOS that opens KeePass (KDB/KDBX) and Password Safe (v3) vault files. It encryp… | 70 | 1466 | active |