Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| mvt-project/mvt Mobile Verification Toolkit (MVT) is a Python command-line toolkit for conducting forensic analysis of Android and iOS devices to detect tr… | 97 | 14938 | active |
| Datalux/Osintgram Osintgram is a Python-based OSINT tool for Instagram that provides an interactive shell to collect and analyze information about Instagram … | 86 | 14936 | active |
| Prowler Prowler is an open-source cloud security platform that performs security best-practice assessments, audits, continuous monitoring, hardenin… | 93 | 14863 | active |
| maurosoria/dirsearch dirsearch is an advanced web path scanner that brute-forces directories and files on web servers using wordlists. It is a Python CLI tool w… | 84 | 14811 | active |
| guofei9987/blind_watermark A Python library for embedding and extracting blind (invisible) watermarks in images using DWT-DCT-SVD transforms, with watermark recovery … | 52 | 14809 | stable |
| Logto Logto is an open-source identity and access management (IAM) infrastructure for SaaS and AI applications, built on OIDC, OAuth 2.1, and SAM… | 100 | 14728 | active |
| bytebase/bytebase Bytebase is an open-source database governance platform that acts as a control plane between users (humans and AI agents) and databases, co… | 99 | 14606 | active |
| OpenVPN/openvpn OpenVPN is an open-source VPN daemon that creates secure point-to-point or site-to-site TLS-encrypted tunnels over the network. It is a mat… | 97 | 14605 | stable |
| shadow1ng/fscan Fscan is a comprehensive intranet scanning tool written in Go that automates host discovery, port scanning, service identification, weak-pa… | 91 | 14590 | active |
| moonD4rk/HackBrowserData HackBrowserData is a self-contained Go CLI that extracts and decrypts browser data (passwords, cookies, history, bookmarks, credit cards, d… | 86 | 14545 | active |
| Casdoor Casdoor is an open-source, self-hosted Identity and Access Management (IAM) and single sign-on (SSO) platform with a web UI, written in Go.… | 94 | 14524 | active |
| projectdiscovery/subfinder Subfinder is a fast, passive subdomain discovery tool written in Go that enumerates valid subdomains for target domains using online passiv… | 91 | 14500 | active |
| kopia/kopia Kopia is a fast, open-source backup and restore tool that creates encrypted, compressed, and deduplicated snapshots of files and directorie… | 93 | 14386 | stable |
| ReFirmLabs/binwalk Binwalk is a fast firmware analysis tool rewritten in Rust that identifies and optionally extracts files and data embedded inside other fil… | 63 | 14370 | active |
| gophish/gophish Gophish is an open-source phishing framework for running phishing simulations and security awareness training. It provides a web UI and RES… | 23 | 14317 | stable |
| OJ/gobuster Gobuster is a fast, multi-threaded brute-forcing tool written in Go for enumerating web directories/files, DNS subdomains, virtual hosts, c… | 76 | 14150 | active |
| evilsocket/opensnitch OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch, intercepting and filtering outbound connections per a… | 73 | 14149 | active |
| OWASP Juice Shop OWASP Juice Shop is an intentionally insecure web application written in Node.js, Express, and Angular that covers vulnerabilities from the… | 95 | 14148 | active |
| cert-manager cert-manager is a Kubernetes controller that adds Certificate and Issuer resource types to clusters and automates obtaining, renewing, and … | 98 | 14111 | stable |
| wanghongenpin/proxypin ProxyPin is a free, open-source HTTP(S) traffic capture application built with Flutter, supporting Windows, Mac, Linux, Android, and iOS. I… | 91 | 14047 | active |
| libsodium libsodium is a modern, portable, easy-to-use C library for cryptographic operations, forked from NaCl with a compatible but extended API. I… | 81 | 13997 | stable |
| Bitwarden Password Manager Bitwarden Server is the backend service that provides APIs, authentication, and data storage for all Bitwarden client applications. It is w… | 95 | 13970 | active |
| OpenNHP/opennhp OpenNHP is a lightweight, cryptography-powered open-source toolkit written in Go that implements the Cloud Security Alliance's Network-infr… | 97 | 13936 | active |
| ory/kratos Ory Kratos is a headless, API-first identity and user management server written in Go that centralizes login, registration, account recover… | 72 | 13888 | stable |
| borgbackup/borg BorgBackup (Borg) is a deduplicating backup program with optional compression and authenticated encryption. It stores data as content-defin… | 87 | 13856 | active |
| Portmaster Portmaster is a free and open-source application firewall and privacy suite for Windows and Linux desktops. It intercepts all network traff… | 95 | 13824 | active |
| digininja/DVWA Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application intentionally riddled with common web vulnerabilities at multiple d… | 67 | 13809 | active |
| pwntools Pwntools is a Python CTF framework and exploit development library designed for rapid prototyping of binary exploits. It provides utilities… | 69 | 13768 | active |
| nmap/nmap Nmap is the industry-standard open-source network scanner for host discovery, port scanning, service/version detection, and OS fingerprinti… | 77 | 13743 | stable |
| DNSCrypt/dnscrypt-proxy dnscrypt-proxy is a flexible local DNS proxy that encrypts and authenticates DNS traffic using DNSCrypt v2, DNS-over-HTTPS, Anonymized DNS,… | 90 | 13730 | stable |
| openwall/john John the Ripper jumbo is an open-source offline password cracker supporting hundreds of hash and cipher types, from Unix and Windows passwo… | 71 | 13668 | active |
| mailcow mailcow: dockerized is a full-featured, self-hosted mail server suite delivered as a set of Docker containers, bundling Postfix, Dovecot, S… | 99 | 13632 | stable |
| SoftEther VPN SoftEther VPN is an open-source, cross-platform, multi-protocol VPN server and client software written in C. It supports SSL-VPN, OpenVPN, … | 66 | 13597 | active |
| sshuttle/sshuttle sshuttle is a transparent proxy server that works as a poor man's VPN, forwarding traffic over SSH without requiring admin access on the re… | 94 | 13595 | stable |
| mozilla-firefox/firefox Firefox is Mozilla's free and open-source web browser built on the Gecko engine, available for desktop and mobile platforms. It emphasizes … | 69 | 13515 | active |
| awslabs/git-secrets git-secrets is a command-line tool that scans git commits, commit messages, and merge histories for secrets and credentials, rejecting comm… | 48 | 13411 | stable |
| threat9/routersploit RouterSploit is an open-source exploitation framework dedicated to embedded devices like routers, modeled after Metasploit. It provides mod… | 55 | 13256 | active |
| beemdevelopment/Aegis Aegis Authenticator is a free, open-source Android app for managing two-factor authentication (2FA) tokens. It stores HOTP/TOTP tokens in a… | 90 | 13227 | stable |
| objective-see/LuLu LuLu is a free, open-source macOS firewall that monitors and blocks unknown outgoing network connections. It uses a system extension and ne… | 91 | 13221 | active |
| KeeWeb KeeWeb is a free, cross-platform password manager compatible with KeePass kdbx database files, available as a desktop app (Electron) or a b… | 74 | 13016 | active |
| anchore/grype Grype is an open-source vulnerability scanner for container images, filesystems, and SBOMs, written in Go by Anchore. It identifies known C… | 98 | 12985 | active |
| spatie/laravel-permission A Laravel package that lets you associate users (and other Eloquent models) with roles and permissions stored in the database. Permissions … | 91 | 12965 | stable |
| TencentCloud/CubeSandbox CubeSandbox is a high-performance sandbox service for AI agents built on RustVMM and KVM, creating hardware-isolated MicroVM sandboxes in u… | 81 | 12853 | active |
| Marauder ESP32 Marauder is a suite of WiFi and Bluetooth offensive and defensive security tools distributed as firmware for ESP32-based hardware. It… | 99 | 12834 | active |
| JingMatrix/Vector Vector is a Zygisk module providing a high-performance ART hooking framework for modern Android, maintaining API compatibility with the ori… | 84 | 12800 | active |
| google/oss-fuzz OSS-Fuzz is Google's free continuous fuzzing service for open source software, combining fuzzing engines like libFuzzer, AFL++, and Honggfu… | 77 | 12743 | active |
| elastic/beats Elastic Beats is a family of lightweight data shippers written in Go that collect logs, metrics, network packets, audit data, and uptime si… | 95 | 12653 | active |
| drakkan/sftpgo SFTPGo is a full-featured, highly configurable file transfer server supporting SFTP, SCP, FTP/S, HTTP/S, and WebDAV, with pluggable storage… | 94 | 12647 | active |
| secdev/scapy Scapy is a powerful Python-based interactive packet manipulation program and library that can forge, decode, send, capture, and match packe… | 88 | 12599 | stable |
| jopohl/urh Universal Radio Hacker (URH) is a complete open-source suite for investigating wireless protocols, with native support for many common Soft… | 10 | 12592 | active |
| Atomic Red Team Atomic Red Team is a library of small, portable detection tests mapped to the MITRE ATT&CK framework, letting security teams validate their… | 75 | 12582 | active |
| dstotijn/hetty Hetty is an open source HTTP toolkit for security research, serving as an alternative to Burp Suite Pro. It provides a MITM HTTP proxy with… | 61 | 12515 | active |
| 0x4m4/hexstrike-ai HexStrike AI is an MCP server that bridges LLM agents (Claude, GPT, Copilot) with 150+ cybersecurity tools for autonomous penetration testi… | 58 | 12431 | active |
| vanhauser-thc/thc-hydra THC-Hydra is a parallelized network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, SMB, RDP, databases, and more). It … | 74 | 12322 | active |
| future-architect/vuls Vuls is an agent-less vulnerability scanner written in Go that detects CVEs on Linux, FreeBSD, Windows, macOS, containers, WordPress, progr… | 98 | 12284 | active |
| open-policy-agent/opa Open Policy Agent (OPA) is a general-purpose, open-source policy engine that unifies policy enforcement across the stack using a high-level… | 96 | 12264 | stable |
| IDA Pro MCP An MCP server and IDA Pro plugin that connects IDA Pro's binary analysis capabilities to language models, enabling AI-assisted reverse engi… | 58 | 12214 | active |
| rtyley/bfg-repo-cleaner BFG Repo-Cleaner is a command-line tool for removing large files, passwords, credentials, and other unwanted data from Git repository histo… | 23 | 12190 | active |
| jason5ng32/MyIP MyIP (IPCheck.ing) is an open-source, self-hostable web application that acts as an all-in-one IP toolbox. It shows your IPv4/IPv6 and geol… | 94 | 12156 | active |
| kubeshark/kubeshark Kubeshark is an eBPF-powered network observability tool for Kubernetes that indexes cluster-wide L4/L7 traffic with full Kubernetes context… | 99 | 12101 | active |
| calesthio/Crucix Crucix is a self-hosted OSINT intelligence terminal that aggregates 27 open-source data feeds (satellite fire detection, flight tracking, r… | 49 | 12090 | active |
| BishopFox/sliver Sliver is an open-source cross-platform adversary emulation and red team framework written in Go. It generates dynamically compiled implant… | 98 | 11996 | active |
| VeraCrypt VeraCrypt is a free, open-source disk encryption application based on TrueCrypt 7.1a with security enhancements. It creates encrypted volum… | 89 | 11832 | stable |
| Netmaker Netmaker is an open-source platform that automates the creation and management of WireGuard-based virtual mesh networks, from homelab to en… | 93 | 11826 | active |
| Kubescape Kubescape is an open-source Kubernetes security platform (a CNCF incubating project) offering misconfiguration scanning, vulnerability asse… | 100 | 11815 | active |
| majd/ipatool A command-line tool written in Go that lets users search the iOS App Store and download app packages (ipa files) using their Apple ID. It s… | 100 | 11795 | active |
| chaitin/xray xray is a security assessment tool from Chaitin that scans web applications for common vulnerabilities like XSS and SQL injection, supporti… | 23 | 11752 | active |
| Detect It Easy Detect It Easy (DiE) is a cross-platform file type identification tool that uses signature-based and heuristic analysis to detect compilers… | 79 | 11734 | active |
| elder-plinius/G0DM0D3 G0DM0D3 is an open-source, multi-model AI chat interface designed for red-teaming, cognition research, and unrestricted LLM interaction. It… | 53 | 11643 | active |
| tymondesigns/jwt-auth A PHP library providing JSON Web Token (JWT) authentication for Laravel and Lumen applications. It handles token issuance, refresh, and val… | 60 | 11494 | stable |
| LaurieWired/GhidraMCP GhidraMCP is a Model Context Protocol server implemented as a Ghidra plugin that exposes Ghidra's reverse engineering tools to LLM clients.… | 87 | 11418 | active |
| Apereo CAS (Central Authentication Service) Apereo CAS is an enterprise open-source identity provider and single sign-on server implemented in Java on Spring Boot. It centralizes auth… | 99 | 11390 | stable |
| 1N3/Sn1per Sn1per is an open-source automated penetration testing and attack surface management platform that chains reconnaissance, scanning, exploit… | 60 | 11373 | active |
| BigBodyCobain/Shadowbroker ShadowBroker is a self-hosted OSINT platform that aggregates 60+ real-time public intelligence feeds—aircraft, ships, satellites, CCTV, GPS… | 79 | 11325 | active |
| angristan/wireguard-install A bash script that installs and configures a WireGuard VPN server on Linux with NAT and IPv4/IPv6 support. Re-running the script lets you a… | 65 | 11325 | active |
| podman-container-tools/skopeo Skopeo is a command line utility for performing operations on container images and image registries, such as copying, inspecting, deleting,… | 98 | 11313 | stable |
| Presidio Presidio is an open-source Python SDK for detecting, redacting, masking, and anonymizing sensitive data (PII) in text, images, and structur… | 91 | 11271 | active |
| hashsigs A Rust library implementing hash-based post-quantum digital signatures (WOTS+ and SHRINCS primitives) with an account policy wrapper. It co… | 64 | 11213 | active |
| QuipNetwork/hashsigs-solidity A Solidity implementation of the Winternitz One-Time Signature Plus (WOTS+) scheme, a hash-based post-quantum signature algorithm. It enabl… | 63 | 11211 | active |
| QuipNetwork/hashsigs-ts A TypeScript library implementing hash-based digital signatures, specifically the WOTS+ (Winternitz One-Time Signature Plus) scheme. It is … | 59 | 11191 | active |
| google/osv-scanner OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across ma… | 99 | 11184 | active |
| dexidp/dex Dex is a federated OpenID Connect (OIDC) and OAuth 2.0 identity provider that issues signed ID tokens (JWTs) for applications. It acts as a… | 94 | 11183 | stable |
| simplifaisoul/osiris OSIRIS is an open-source, real-time global intelligence (OSINT) dashboard that aggregates live flight tracking, maritime, CCTV, seismic, fi… | 70 | 11174 | active |
| daniulive/SmarterStreaming SmarterStreaming (大牛直播SDK/SmartMediaKit) is a proprietary cross-platform low-latency streaming SDK for Windows, Linux, Android, iOS, Harmon… | 63 | 11172 | active |
| openai/codex-security OpenAI's Codex Security is a CLI and TypeScript SDK that uses AI to find, validate, and fix security vulnerabilities in codebases. It suppo… | 81 | 11143 | active |
| quay/clair Clair is an open-source service for static analysis of vulnerabilities in container images (OCI and Docker). It indexes image contents via … | 71 | 11065 | active |
| BunkerWeb BunkerWeb is an open-source, cloud-native Web Application Firewall (WAF) built on NGINX that acts as a reverse proxy to protect web service… | 94 | 11054 | active |
| beefproject/beef BeEF (Browser Exploitation Framework) is a penetration testing tool focused on the web browser, hooking one or more browsers and using them… | 69 | 11046 | active |
| SonarQube SonarQube is a continuous code inspection platform that performs static analysis to track code quality, security vulnerabilities, and techn… | 96 | 11035 | stable |
| pwndbg/pwndbg Pwndbg is a Python-based plug-in for GDB and LLDB that enhances low-level debugging with features tailored to reverse engineering and explo… | 94 | 11015 | active |
| LaZagne LaZagne is an open-source Python application that recovers passwords stored locally by common software such as browsers, mail clients, WiFi… | 38 | 11006 | active |
| NopeCHA NopeCHA is an AI-powered CAPTCHA solving service distributed as a browser extension (Chrome/Firefox/Edge) plus Python and Node.js client li… | 87 | 10997 | active |
| yokoffing/Betterfox Betterfox is a curated user.js preference file that hardens Mozilla Firefox for privacy, security, and speed via about:config tweaks. It bu… | 90 | 10895 | active |
| Monero Monero is the reference implementation of the Monero (XMR) privacy-focused cryptocurrency, including the full node daemon (monerod), wallet… | 88 | 10865 | active |
| Chia Blockchain The official Python implementation of the Chia blockchain, including full node, farmer, harvester, timelord, and wallet components. It uses… | 93 | 10790 | active |
| sullo/nikto Nikto is a Perl-based command-line web server scanner that tests servers for dangerous files, outdated software, misconfigurations, and kno… | 86 | 10747 | active |
| Helmet Helmet is a Node.js middleware library that secures Express and Connect apps by setting HTTP response headers such as Content-Security-Poli… | 76 | 10736 | stable |
| BBOT BBOT is a recursive, multipurpose internet scanner built in Python for automating OSINT reconnaissance, bug bounty hunting, and attack surf… | 97 | 10709 | active |
| rofl0r/proxychains-ng ProxyChains-NG is a UNIX CLI tool that uses LD_PRELOAD to hook socket-related libc functions in dynamically linked programs and redirect th… | 64 | 10683 | active |
| Dr-TSNG/ZygiskNext Zygisk Next is a standalone implementation of the Zygisk injection framework for Android, providing Zygisk API support for KernelSU and ser… | 93 | 10595 | active |