Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| xykt/IPQuality A shell-based IP quality check script that reports IP type, risk scores from multiple databases, streaming/AI service unlock status, email … | 69 | 10586 | active |
| krzyzanowskim/CryptoSwift CryptoSwift is a pure Swift library providing standard cryptographic algorithms including AES, ChaCha20, SHA family hashes, HMAC, and CRC. … | 75 | 10579 | active |
| projectdiscovery/httpx httpx is a fast, multi-purpose HTTP toolkit written in Go that runs multiple probes (status codes, titles, TLS certificates, tech detection… | 94 | 10500 | active |
| pennersr/django-allauth django-allauth is an integrated set of Django applications covering authentication, registration, account management, and third-party (soci… | 75 | 10373 | stable |
| Astrid Astrid is a portable, capability-secure operating system for composable software, where every component runs as a sealed WebAssembly capsul… | 82 | 10279 | active |
| CodeQL CodeQL is a semantic code analysis engine that treats code as a queryable database, letting you write queries to find security vulnerabilit… | 77 | 10201 | active |
| OpenCTI OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, including observables, TTPs, and threat actor informat… | 96 | 10173 | active |
| samratashok/nishang Nishang is a framework and collection of PowerShell scripts and payloads for offensive security, penetration testing, and red teaming. It c… | 23 | 10125 | active |
| shmilylty/OneForAll OneForAll is a powerful Python-based subdomain collection and enumeration tool for reconnaissance. It gathers subdomains via brute forcing,… | 56 | 10094 | active |
| thewhiteh4t/seeker Seeker is a security testing tool that hosts a fake website asking users for browser location permission, capturing GPS coordinates (longit… | 68 | 10055 | active |
| wireshark/wireshark Wireshark is the world's leading open-source network protocol analyzer (packet sniffer) with a Qt GUI, deep inspection of hundreds of proto… | 77 | 10046 | stable |
| TechnitiumSoftware/DnsServer Technitium DNS Server is an open-source, cross-platform authoritative and recursive DNS server built on .NET, designed for self-hosting wit… | 97 | 10032 | stable |
| AGWA/git-crypt git-crypt is a command-line tool that provides transparent encryption and decryption of selected files in a git repository. It lets teams s… | 39 | 9943 | active |
| go-acme/lego Lego is an ACME client and Go library for obtaining, renewing, and revoking TLS certificates from Let's Encrypt and other ACME CAs. It supp… | 98 | 9938 | active |
| Xtreme Firmware Xtreme Firmware is a feature-rich custom firmware for the Flipper Zero multitool device, written in C. It bundles many community apps, adde… | 10 | 9900 | active |
| paramiko/paramiko Paramiko is a pure-Python implementation of the SSHv2 protocol providing both client and server functionality, built on the cryptography li… | 74 | 9861 | stable |
| wpscanteam/wpscan WPScan is a black-box WordPress security scanner written in Ruby, used by security professionals and site maintainers to audit WordPress in… | 90 | 9792 | active |
| ModSecurity ModSecurity (libmodsecurity v3) is an open source, cross-platform web application firewall (WAF) engine written in C++ that inspects HTTP(S… | 88 | 9784 | stable |
| docker/docker-bench-security Docker Bench for Security is a shell script that automates checks of Docker hosts and containers against the CIS Docker Benchmark best prac… | 57 | 9703 | active |
| anchore/syft Syft is a CLI tool and Go library that generates Software Bill of Materials (SBOM) documents from container images, filesystems, and archiv… | 99 | 9663 | active |
| spring-projects/spring-security Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications, and the de-facto s… | 97 | 9650 | stable |
| pocket-id/pocket-id Pocket ID is a self-hosted, OpenID Connect Certified identity provider that lets users sign in to applications using passkeys instead of pa… | 86 | 9626 | active |
| telekom-security/tpotce T-Pot is an all-in-one, optionally distributed honeypot platform that bundles 20+ honeypots with the Elastic Stack for visualization, live … | 66 | 9547 | active |
| malwaredllc/byob BYOB is an open-source post-exploitation framework written in Python, featuring a command-and-control server with a web GUI, a cross-platfo… | 77 | 9512 | active |
| CFSSL CFSSL is Cloudflare's PKI/TLS toolkit for signing, verifying, and bundling TLS certificates, available as both a command line tool and an H… | 98 | 9483 | stable |
| Falco Falco is a CNCF-graduated cloud native runtime security tool for Linux that monitors kernel events (syscalls) via eBPF or kernel modules an… | 94 | 9478 | stable |
| AdAway AdAway is a free and open source ad blocker for Android that blocks ads system-wide using the hosts file or a local VPN. It supports both r… | 65 | 9474 | active |
| Il2CppDumper Il2CppDumper is a C# command-line tool that extracts type, method, and string information from Unity IL2CPP binaries and their global-metad… | 23 | 9432 | active |
| sensepost/objection objection is a runtime mobile exploration toolkit powered by Frida for assessing the security posture of iOS and Android applications witho… | 86 | 9412 | active |
| FreeBSD The official publish-only Git mirror of the FreeBSD source tree, containing the complete kernel, userland, libraries, boot loader, and buil… | 77 | 9398 | stable |
| unicorn-engine/unicorn Unicorn is a lightweight, multi-architecture CPU emulator framework based on QEMU, supporting ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, SPAR… | 67 | 9388 | stable |
| certimate-go/certimate Certimate is a free, open-source, self-hosted ACME tool for managing SSL/TLS certificates with a visual web UI. It automates the full certi… | 87 | 9378 | active |
| git-ecosystem/git-credential-manager Git Credential Manager is a secure, cross-platform Git credential helper built on .NET that stores credentials in the OS-native secure stor… | 95 | 9368 | active |
| Hiddify Hiddify is a cross‑platform proxy/VPN client built with Flutter that supports a wide range of protocols such as VLESS, VMess, Reality, TUIC… | 98 | 9362 | active |
| NVIDIA/garak garak is a command-line LLM vulnerability scanner that probes large language models for failures like hallucination, data leakage, prompt i… | 89 | 9332 | active |
| bitnami/sealed-secrets A Kubernetes controller plus the kubeseal CLI that lets you encrypt Kubernetes Secrets into one-way encrypted SealedSecrets that are safe t… | 97 | 9300 | active |
| golang-jwt/jwt A Go library for creating, signing, parsing, and verifying JSON Web Tokens (JWTs) per RFC 7519. It is the community-maintained successor to… | 75 | 9241 | stable |
| angr angr is a Python 3 binary analysis framework that loads executables across many architectures and formats, providing disassembly, IR liftin… | 77 | 9226 | active |
| Pwnagotchi Pwnagotchi is an A2C deep reinforcement learning agent built on bettercap that learns from its surrounding WiFi environment to maximize cap… | 63 | 9223 | active |
| testssl/testssl.sh testssl.sh is a free, bash-based command line tool that checks any server's service on any port for TLS/SSL cipher, protocol, and cryptogra… | 85 | 9218 | active |
| Momentum Firmware Momentum Firmware is a feature-rich, stable, and highly customizable custom firmware for the Flipper Zero multitool device, written in C. I… | 70 | 9166 | active |
| henrypp/simplewall Simplewall is a lightweight, open-source Windows application for configuring network activity via the Windows Filtering Platform (WFP). It … | 73 | 9150 | active |
| Firezone Firezone is an open-source, enterprise-ready zero-trust access platform built on WireGuard that replaces traditional VPNs with granular, po… | 96 | 9121 | active |
| frohoff/ysoserial ysoserial is a proof-of-concept command-line tool that generates serialized Java payloads exploiting unsafe object deserialization using ga… | 44 | 9088 | active |
| Capstone Engine Capstone is a lightweight, multi-architecture, multi-platform disassembly framework written in pure C, designed to be the ultimate disassem… | 98 | 9066 | stable |
| Checkov Checkov is a static code analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and more) that … | 94 | 9060 | stable |
| immudb immudb is an open-source immutable database written in Go that stores data in SQL, key-value, or document models while guaranteeing tamper-… | 92 | 9042 | stable |
| teamhanko/hanko Hanko is an open-source authentication and user management platform built in Go, offering passwords, passkeys (WebAuthn/FIDO2), MFA, OAuth … | 95 | 9041 | active |
| containers/bubblewrap Bubblewrap is a low-level unprivileged sandboxing tool for Linux that uses user namespaces to let any user run processes in isolated contai… | 93 | 8998 | active |
| p1ngul1n0/blackbird Blackbird is a Python CLI OSINT tool that searches for user accounts by username or email across 600+ social networks and platforms, levera… | 43 | 8982 | active |
| Kata Containers Kata Containers is an open source container runtime that builds lightweight virtual machines which plug seamlessly into the container ecosy… | 98 | 8963 | stable |
| securego/gosec gosec is a security scanner for Go source code that inspects the AST and SSA representations to detect common security problems. It include… | 92 | 8961 | active |
| smallstep/certificates step-ca is an online private certificate authority (X.509 and SSH) and ACME server for secure, automated certificate management in DevOps e… | 84 | 8939 | active |
| reconurge/flowsint Flowsint is an open-source, self-hosted OSINT platform for visual, graph-based investigations, providing entity relationship visualization … | 84 | 8937 | active |
| maxgoedjen/secretive Secretive is a native macOS app that stores and manages SSH keys inside the Mac's Secure Enclave, making them non-exportable. It adds Touch… | 92 | 8888 | active |
| yogeshojha/rengine reNgine is a self-hosted automated web reconnaissance and vulnerability scanning framework with configurable recon engines, data correlatio… | 66 | 8869 | active |
| ViRb3/wgcf wgcf is an unofficial cross-platform command-line tool for Cloudflare Warp written in Go. It registers Warp accounts, binds Warp+ license k… | 92 | 8751 | active |
| superradcompany/microsandbox Microsandbox is a local-first microVM runtime and library for running untrusted workloads (AI agents, user code, plugins, CI jobs) inside f… | 86 | 8745 | active |
| stamparm/maltrail Maltrail is a malicious network traffic detection system that matches observed domains, URLs, IP addresses, and User-Agent values against o… | 97 | 8620 | active |
| Tsunami Security Scanner Tsunami is a general-purpose network security scanner from Google that detects high-severity vulnerabilities with high confidence. It relie… | 75 | 8620 | active |
| PrivateBin PrivateBin is a minimalist, self-hosted pastebin where the server stores only encrypted data and never learns the paste contents. Encryptio… | 94 | 8612 | active |
| spesmilo/electrum Electrum is a lightweight Bitcoin wallet client written in Python that uses SPV verification instead of downloading the full blockchain. It… | 76 | 8609 | stable |
| EmenstaNougat/ESP32-BlueJammer ESP32-BlueJammer is firmware for an ESP32 paired with nRF24 modules that disrupts 2.4GHz communications (Bluetooth, BLE, WiFi, RC) by flood… | 45 | 8594 | active |
| firerpa/lamda FIRERPA (lamda) is an all-in-one Android device control platform whose server runs directly on the device (root or non-root) and exposes 16… | 98 | 8593 | active |
| wangyu-/udp2raw A C++ command-line tunnel that converts UDP traffic into encrypted FakeTCP, UDP, or ICMP traffic using raw sockets, helping bypass UDP fire… | 40 | 8571 | active |
| skeeto/endlessh Endlessh is an SSH tarpit daemon written in C that slowly sends an endless, random SSH pre-authentication banner to keep malicious clients … | 23 | 8565 | stable |
| ionuttbara/windows-defender-remover A script-based tool that removes or disables Windows Defender and related security components (Windows Security app, SmartScreen, VBS, tamp… | 85 | 8559 | active |
| varvet/pundit Pundit is a Ruby gem that provides minimal authorization for Rails applications using plain Ruby policy classes and object-oriented design.… | 74 | 8521 | stable |
| Havoc Havoc is a modern, malleable post-exploitation command and control (C2) framework with a Go teamserver, a Qt-based cross-platform client, a… | 10 | 8505 | active |
| OpenBao OpenBao is an open-source, identity-based secrets management system for storing, distributing, and rotating sensitive data such as secrets,… | 94 | 8451 | active |
| GEF GEF (GDB Enhanced Features) is a single-file Python plugin for GDB that adds a modern, feature-rich debugging experience for exploit develo… | 71 | 8401 | active |
| tinyauthapp/tinyauth Tinyauth is a lightweight, OpenID Certified™ authentication and authorization server written in Go, shipped as a single static binary. It w… | 86 | 8366 | active |
| Sysdig Sysdig is a Linux system exploration and troubleshooting tool that captures system calls and OS events at the kernel level, with native sup… | 72 | 8301 | active |
| PyCQA/bandit Bandit is a security-oriented static analysis tool that finds common security issues in Python code. It parses each file into an AST, runs … | 82 | 8285 | active |
| kyverno/kyverno Kyverno is a Kubernetes-native policy engine for policy as code, letting platform teams author validate, mutate, generate, and cleanup poli… | 100 | 8268 | stable |
| kishikawakatsumi/KeychainAccess KeychainAccess is a simple Swift wrapper around Apple's Keychain APIs for iOS, macOS, watchOS, tvOS, and Mac Catalyst. It provides an ergon… | 23 | 8256 | stable |
| aquasecurity/kube-bench kube-bench is a Go-based tool that checks whether Kubernetes clusters are deployed securely by running the checks documented in the CIS Kub… | 95 | 8216 | active |
| Lightning Network Daemon A complete implementation of a Lightning Network node written in Go, capable of opening and closing payment channels, routing onion-encrypt… | 95 | 8203 | stable |
| ntop/ntopng ntopng is a web-based network traffic monitoring and cybersecurity application that provides real-time visibility into hosts, applications,… | 86 | 8202 | stable |
| six2dez/reconftw reconFTW is an open-source (MIT) automated reconnaissance framework written in Shell that orchestrates 80+ security tools to perform full r… | 82 | 8155 | active |
| Cynthion HackRF is an open source, low-cost software-defined radio (SDR) hardware platform from Great Scott Gadgets, with this repository containing… | 86 | 8154 | stable |
| Graylog Graylog is a free and open log management platform for collecting, storing, searching, and analyzing log data from across IT environments, … | 77 | 8154 | stable |
| Zeek Zeek (formerly Bro) is an open-source network security monitor and analysis framework that passively inspects network traffic and produces … | 97 | 8123 | stable |
| epi052/feroxbuster feroxbuster is a fast, recursive content discovery tool written in Rust that performs forced browsing against web servers. It brute-forces … | 77 | 8112 | active |
| omniauth/omniauth OmniAuth is a Ruby library that standardizes multi-provider authentication for web applications via Rack middleware. Developers add authent… | 80 | 8104 | stable |
| vercel-labs/deepsec Deepsec is an open-source, agent-powered vulnerability scanner that runs AI coding agents over your entire existing codebase to find hard-t… | 58 | 8075 | active |
| robinmoisson/staticrypt StatiCrypt is a CLI tool and browser-based utility that encrypts static HTML files with AES-256 using a password, producing a self-containe… | 60 | 8048 | active |
| warp-tech/warpgate Warpgate is an open-source, clientless bastion host and privileged access management (PAM) tool written in Rust that transparently proxies … | 98 | 8038 | active |
| v1s1t0r1sh3r3/airgeddon A multi-use bash script for auditing wireless networks on Linux, wrapping tools like aircrack-ng to automate attacks such as evil twin, WPS… | 93 | 8035 | active |
| APatch APatch is a kernel-based root solution for Android devices that patches the Android kernel and system, relying on KernelPatch. It supports … | 83 | 8021 | active |
| cilium/ebpf ebpf-go is a pure-Go library for loading, modifying, and attaching eBPF programs to hooks in the Linux kernel, with no dependency on libbpf… | 89 | 7998 | stable |
| yarrick/iodine iodine is a C client/server tool that tunnels IPv4 traffic through DNS queries, letting you get network access on firewalled connections wh… | 76 | 7994 | active |
| turbot/steampipe Steampipe is a zero-ETL CLI tool that exposes APIs and cloud services as relational database tables so they can be queried live with standa… | 97 | 7968 | active |
| tutao/tutanota Tuta Mail (formerly Tutanota) is an open-source, end-to-end encrypted email service with integrated encrypted calendar and contacts, availa… | 93 | 7967 | active |
| PCILeech PCILeech is DMA attack software that uses PCIe hardware devices (or software memory acquisition methods) to read and write target system me… | 62 | 7945 | active |
| tiagozip/cap Cap is a lightweight, open-source, self-hosted CAPTCHA alternative to reCAPTCHA, hCaptcha, and Cloudflare Turnstile. It uses invisible proo… | 82 | 7906 | active |
| peazip/PeaZip PeaZip is a free, open-source, cross-platform file archiver and archive manager supporting 200+ formats including 7z, RAR, ZIP, TAR, and Zs… | 89 | 7882 | stable |
| mandiant/commando-vm Commando VM is a fully customizable Windows-based security distribution for penetration testing and red teaming, packaged as a PowerShell i… | 50 | 7824 | active |
| Scout Suite Scout Suite is an open source multi-cloud security auditing tool that assesses the security posture of cloud environments. It gathers confi… | 39 | 7824 | stable |
| hfiref0x/UACME UACMe is a C-based command-line tool that demonstrates dozens of Windows User Account Control (UAC) bypass techniques abusing built-in Auto… | 81 | 7821 | active |