Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| boltgolt/howdy Howdy provides Windows Hello-style facial authentication for Linux using IR emitters and a camera with facial recognition. It integrates wi… | 34 | 7813 | active |
| panva/jose A zero-dependency JavaScript/TypeScript library implementing JSON Object Signing and Encryption standards (JWA, JWS, JWE, JWT, JWK, JWKS). … | 96 | 7808 | stable |
| kelektiv/node.bcrypt.js A Node.js library providing bcrypt password hashing implemented as a native C++ addon. It handles salting and hashing passwords for secure … | 54 | 7804 | stable |
| yaklang/yakit Yakit is an all-in-one interactive application security testing platform built as a GUI client for the Yaklang security DSL engine over gRP… | 93 | 7786 | active |
| pyca/cryptography pyca/cryptography is a Python package providing cryptographic recipes and primitives, aiming to be Python's 'cryptographic standard library… | 75 | 7785 | stable |
| r0ysue/r0capture A Frida-based universal Android application-layer packet capture script that hooks SSL/TLS regardless of certificate pinning, obfuscation, … | 61 | 7766 | active |
| OWASP Dependency-Check OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project… | 96 | 7723 | active |
| aircrack-ng/aircrack-ng Aircrack-ng is a complete suite of command-line tools for assessing WiFi network security, covering packet capture, injection, monitor mode… | 65 | 7705 | active |
| mullvad/mullvadvpn-app The official Mullvad VPN client app for desktop and mobile, including a Rust system service/daemon, an Electron-based GUI, a CLI, and dedic… | 99 | 7692 | active |
| netblue30/firejail Firejail is a SUID security sandbox program for Linux that uses kernel namespaces, seccomp-bpf filters, and Linux capabilities to run appli… | 79 | 7688 | active |
| GOST GOST (GO Simple Tunnel) is a Go-based multi-protocol tunnel and proxy tool supporting HTTP, HTTPS, SOCKS5, Shadowsocks, WebSocket, QUIC, KC… | 92 | 7640 | active |
| rustls/rustls Rustls is a modern TLS library written in Rust implementing TLS 1.2 and TLS 1.3 for both clients and servers. It provides secure defaults w… | 96 | 7638 | stable |
| aceberg/WatchYourLAN WatchYourLAN is a lightweight network IP scanner written in Go with a web GUI, designed to discover and track hosts on a local network via … | 49 | 7629 | active |
| arkime/arkime Arkime is an open-source, large-scale network analysis, full packet capture, and session indexing system that stores traffic in standard PC… | 99 | 7536 | active |
| Kunzisoft/KeePassDX KeePassDX is a lightweight, open-source password manager and encrypted vault for Android, compatible with the KeePass format (.kdb/.kdbx). … | 100 | 7506 | active |
| lcobucci/jwt A PHP library for creating, parsing, and validating JSON Web Tokens (JWT) and JSON Web Signatures (JWS) per RFC 7519. It is installed via C… | 95 | 7480 | stable |
| repowise-dev/repowise Repowise is a Python-based codebase intelligence tool that indexes code structure, call graphs, git history, tests, and architectural decis… | 78 | 7464 | active |
| apurvsinghgautam/robin Robin is an AI-powered dark web OSINT investigation tool that uses LLMs to refine queries, filter results from dark web search engines, and… | 86 | 7440 | active |
| timvisee/ffsend ffsend is a fully featured command-line client for the Firefox Send file-sharing service, letting users upload and download files and direc… | 43 | 7420 | active |
| Recaf Recaf is a modern Java bytecode editor with a JavaFX GUI that abstracts away low-level class file complexities like constant pools and stac… | 66 | 7418 | active |
| anomalyco/openauth OpenAuth is a universal, standards-based OAuth 2.0 auth provider that can be deployed as a standalone service or embedded into existing app… | 35 | 7408 | active |
| Calico Calico is an open-source cloud-native networking and network security platform for Kubernetes, providing pod networking (CNI), network poli… | 99 | 7398 | stable |
| jonasstrehle/supercookie A demonstration web application that assigns persistent unique identifiers to website visitors via favicon-based browser fingerprinting. It… | 10 | 7383 | active |
| 648540858/wvp-GB28181-pro An open-source network video platform implementing China's GB28181-2016 and JT808/JT1078 standards, providing SIP signaling, device managem… | 74 | 7370 | active |
| Cisco-Talos/clamav ClamAV is an open-source antivirus engine and toolkit for detecting trojans, viruses, malware, and other malicious threats. It includes a m… | 92 | 7350 | active |
| Ed1s0nZ/CyberStrikeAI CyberStrikeAI is a Go-based AI-native cybersecurity platform that combines LLM-powered agents, MCP-native tools, RAG knowledge bases, and v… | 80 | 7343 | active |
| MeshCentral MeshCentral is a self-hosted, web-based remote monitoring and management (RMM) platform built on Node.js. It lets administrators install ag… | 97 | 7332 | active |
| Nasiko-Labs/nasiko Nasiko is a developer control plane for AI agents, built in Rust, that lets teams deploy, route, secure, and observe A2A-speaking agents wi… | 57 | 7324 | active |
| apache/caldera Apache Caldera is a cybersecurity platform for automated adversary emulation built on the MITRE ATT&CK framework. It provides an asynchrono… | 75 | 7317 | active |
| SQLCipher SQLCipher is an open-source fork of SQLite that adds full-database 256-bit AES encryption, tamper detection, and strong key derivation. It … | 91 | 7286 | stable |
| markqvist/Reticulum Reticulum is a cryptography-based networking stack written in Python that builds encrypted, resilient local and wide-area networks over LoR… | 95 | 7281 | active |
| netalertx/NetAlertX NetAlertX is a self-hosted network visibility and asset intelligence platform that performs continuous device discovery and monitoring acro… | 98 | 7279 | active |
| presidentbeef/brakeman Brakeman is a free, open-source static analysis security scanner built specifically for Ruby on Rails applications. It analyzes Rails sourc… | 90 | 7273 | stable |
| gopass gopass is a command-line password manager for teams, serving as a drop-in replacement for the standard UNIX pass tool. It encrypts secrets … | 99 | 7257 | stable |
| cloudflare/boringtun BoringTun is a Rust implementation of the WireGuard VPN protocol, provided both as a reusable library and as a userspace CLI executable (bo… | 60 | 7215 | active |
| BleachBit BleachBit is an open-source system cleaner for Windows and Linux that frees disk space and protects privacy by deleting caches, cookies, lo… | 94 | 7189 | stable |
| NVIDIA-NeMo/Guardrails NVIDIA NeMo Guardrails is an open-source Python toolkit for adding programmable guardrails to LLM-based conversational applications. It sit… | 90 | 7181 | active |
| lintsinghua/DeepAudit DeepAudit is an open-source multi-agent AI system for automated code vulnerability discovery and security auditing, with a React frontend a… | 72 | 7178 | active |
| OnionShare OnionShare is an open-source desktop and mobile application that lets users securely and anonymously share files, host websites, and chat o… | 84 | 7156 | active |
| hwdsl2/docker-ipsec-vpn-server A Docker image that runs a self-hosted IPsec VPN server supporting IPsec/L2TP, Cisco IPsec, and IKEv2, built on Libreswan and xl2tpd. It au… | 76 | 7150 | active |
| RsaCtfTool/RsaCtfTool A Python CLI tool that attacks weak RSA public keys to recover private keys and decrypt ciphertext, combining many factorization and lattic… | 75 | 7143 | active |
| curl-impersonate A special build of curl (and libcurl) whose TLS and HTTP/2 handshakes are identical to real browsers like Chrome, Edge, Safari, and Firefox… | 23 | 7142 | active |
| ayoubfaouzi/al-khaser Al-Khaser is a proof-of-concept Windows application that demonstrates a wide range of malware anti-analysis techniques, including anti-debu… | 67 | 7141 | active |
| SpiceDB SpiceDB is an open-source, Google Zanzibar-inspired database for storing, computing, and validating fine-grained authorization data at scal… | 97 | 7124 | stable |
| 34306/vphone-aio A single shell script that downloads, assembles, and runs a pre-built virtualized iOS environment (vphone) on macOS, complete with a jailbr… | 56 | 7104 | active |
| CASL CASL is an isomorphic JavaScript authorization library that restricts what resources a user is allowed to access, using declarative rules t… | 100 | 7100 | stable |
| erebe/wstunnel wstunnel is a Rust CLI tool that tunnels arbitrary TCP, UDP, Unix socket, or stdio traffic over WebSocket, HTTP2, or WebTransport to bypass… | 98 | 7099 | active |
| guardicore/monkey Infection Monkey is an open-source adversary emulation platform that simulates malware-like self-propagation across a network to test secur… | 28 | 7098 | active |
| LasCC/HackTools HackTools is an all-in-one browser extension for offensive security professionals that bundles penetration testing tools like XSS payloads,… | 23 | 7087 | active |
| Sandstorm Sandstorm is a self-hostable web productivity suite implemented as a security-hardened web app package manager. It lets users install and r… | 76 | 7077 | active |
| albertan017/LLM4Decompile LLM4Decompile is an open-source series of large language models (1.3B to 33B) trained to decompile binary code back into readable, executab… | 53 | 7076 | active |
| ntop/n2n n2n is a lightweight peer-to-peer VPN written in C that creates encrypted virtual networks capable of bypassing intermediate firewalls. It … | 62 | 7017 | active |
| fleetdm/fleet Fleet is an open-source device management (MDM) and security platform for IT and security teams, built on osquery. It provides cross-OS dev… | 96 | 7016 | stable |
| 0xERR0R/blocky Blocky is a fast, lightweight DNS proxy and ad-blocker for local networks, written in Go. It blocks ads and malware via external allow/deny… | 97 | 7011 | active |
| Mbed TLS Mbed TLS is a portable C library implementing TLS, DTLS, and X.509 certificate handling, plus a reference implementation of the PSA Cryptog… | 92 | 6963 | stable |
| Bruce Bruce is an open-source (AGPL-3.0) ESP32 firmware packed with offensive-security and Red Team tools such as WiFi attacks, Evil Portal, ward… | 88 | 6946 | active |
| Tencent/AI-Infra-Guard Tencent's full-stack AI red teaming platform that scans AI infrastructure, agents, MCP servers, and skills for vulnerabilities and evaluate… | 85 | 6916 | active |
| external-secrets/external-secrets External Secrets Operator is a Kubernetes operator that synchronizes secrets from external secret management systems such as AWS Secrets Ma… | 95 | 6900 | stable |
| CTFd CTFd is an open-source Capture The Flag (CTF) platform built on Flask for hosting cybersecurity competitions and workshops. It provides cha… | 95 | 6886 | active |
| MacPass MacPass is a native macOS KeePass password manager client that opens and manages KDBX password databases. It is written in Objective-C and … | 85 | 6884 | active |
| urbanadventurer/WhatWeb WhatWeb is a command-line web scanner that identifies the technologies powering websites, including CMSs, web servers, JavaScript libraries… | 70 | 6869 | stable |
| jstedfast/MailKit MailKit is a cross-platform .NET mail client library built on top of MimeKit, providing IMAP, POP3, and SMTP support along with a high-perf… | 77 | 6863 | stable |
| chaifeng/ufw-docker A shell-based tool that fixes the well-known security flaw where Docker bypasses UFW firewall rules and exposes published ports to the publ… | 63 | 6821 | active |
| travist/jsencrypt JSEncrypt is a tiny, zero-dependency JavaScript library for OpenSSL-compatible RSA encryption, decryption, signing, and key generation. It … | 63 | 6806 | active |
| InterceptSuite/ProxyBridge ProxyBridge is a free, open-source universal proxy client (Proxifier alternative) that transparently redirects TCP and UDP traffic from any… | 85 | 6795 | active |
| AFL++ AFL++ is a superior, actively maintained fork of American Fuzzy Lop, a coverage-guided fuzzer with many mutators, power schedules, and inst… | 92 | 6782 | active |
| Faraday Faraday is an open-source vulnerability management platform that aggregates, normalizes, and deduplicates findings from over 90 security to… | 98 | 6781 | active |
| smol-machines/smolvm smolvm is an open-source CLI and runtime for running lightweight, hardware-isolated Linux microVMs locally on macOS, Linux, and Windows, bu… | 80 | 6778 | active |
| cppcheck-opensource/cppcheck Cppcheck is an open-source static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs w… | 90 | 6774 | stable |
| ticarpi/jwt_tool A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known J… | 28 | 6770 | active |
| superagent-ai/superagent Superagent is an open-source SDK and platform for securing AI applications and agents, offering runtime guardrails that block prompt inject… | 73 | 6759 | active |
| internet-court/internet-court-skill An open Agent Skill / Claude Code plugin that acts as a trust layer for agent-to-agent commerce, combining natural-language mandates, ERC-7… | 55 | 6749 | active |
| curl-impersonate bindings curl_cffi is a Python binding for a curl-impersonate fork via cffi, providing an HTTP client that can impersonate browser TLS/JA3, HTTP/2, … | 99 | 6746 | active |
| opa334/Dopamine Dopamine is a rootless semi-untethered jailbreak tool for iOS 15 through 26.0.1, supporting arm64e and A12/A13 devices. It is written prima… | 96 | 6723 | active |
| zizmor zizmor is a static analysis tool for CI/CD configurations, primarily GitHub Actions workflows, as well as Dependabot and pre-commit configs… | 87 | 6714 | active |
| Suricata Suricata is a high-performance network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring… | 93 | 6683 | stable |
| PHP OAuth2 Server A standards-compliant OAuth 2.0 authorization server library for PHP, supporting all major grants (authorization code, client credentials, … | 88 | 6668 | stable |
| The-Z-Labs/linux-exploit-suggester A shell-based auditing tool that assesses a Linux system's exposure to publicly known kernel privilege escalation exploits based on kernel … | 62 | 6626 | active |
| markbates/goth Goth is a Go library providing a simple, idiomatic way to add multi-provider authentication to web applications via OAuth, OAuth2, and Open… | 52 | 6605 | active |
| j3ssie/osmedeus Osmedeus is a security-focused declarative orchestration engine that lets users define reconnaissance and vulnerability-scanning pipelines … | 94 | 6602 | active |
| SukiSU-Ultra/SukiSU-Ultra SukiSU-Ultra is a kernel-based Android root solution providing kernel-level su and root access management, with support for KPM kernel modu… | 88 | 6601 | active |
| Cowrie Cowrie is a medium-to-high interaction SSH and Telnet honeypot that logs brute-force attacks and full attacker shell sessions, capturing up… | 99 | 6594 | active |
| bmrf/tron Tron is an automated Windows PC cleanup and disinfection script, implemented as a collection of batch files that orchestrate many community… | 85 | 6589 | active |
| lldap/lldap lldap is a lightweight LDAP authentication server written in Rust, providing an opinionated, simplified LDAP interface for user management.… | 78 | 6583 | active |
| EnableSecurity/wafw00f WAFW00F is a Python command-line tool that identifies and fingerprints Web Application Firewall (WAF) products protecting a website. It sen… | 72 | 6574 | stable |
| MISP MISP is an open source threat intelligence platform for collecting, storing, correlating, and sharing cyber security indicators, malware an… | 96 | 6546 | stable |
| Mebus/cupp CUPP is a Python CLI tool that generates targeted password wordlists by profiling personal information about a user, such as birthdays, nic… | 70 | 6546 | active |
| cloudquery/cloudquery CloudQuery is an open-source CLI and plugin-based data pipeline tool that extracts cloud infrastructure configuration and security data fro… | 95 | 6542 | active |
| palera1n palera1n is an open-source jailbreak tool for Apple devices using the checkm8 bootrom exploit, supporting A8 through A11 chips and T2 secur… | 89 | 6528 | active |
| elder-plinius/T3MP3ST T3MP3ST is a multi-agent offensive-security framework that turns existing AI coding agents (Claude Code, Codex, Ollama, etc.) into autonomo… | 65 | 6496 | active |
| BLAKE3 The official Rust and C implementations of the BLAKE3 cryptographic hash function, which is faster than MD5, SHA-2, and BLAKE2 while remain… | 96 | 6468 | stable |
| ikarus23/MifareClassicTool An Android NFC application for reading, writing, analyzing, and cloning MIFARE Classic RFID tags. It includes dictionary-based key manageme… | 86 | 6466 | active |
| cloud-hypervisor/cloud-hypervisor Cloud Hypervisor is an open source Virtual Machine Monitor (VMM) written in Rust that runs on top of KVM or Microsoft's MSHV hypervisor. It… | 95 | 6405 | active |
| s0md3v/Arjun Arjun is a Python command-line tool that discovers hidden HTTP query parameters for URL endpoints using a large dictionary of over 25,000 p… | 23 | 6402 | active |
| derailed/popeye Popeye is a read-only CLI tool that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations.… | 56 | 6397 | active |
| 5ec1cff/TrickyStore Tricky Store is a Magisk module for Android 10+ that modifies the certificate chain generated during Android key attestation to spoof devic… | 41 | 6391 | active |
| zmap/zmap ZMap is a fast, stateless single-packet network scanner written in C, designed for Internet-wide network surveys such as scanning the entir… | 84 | 6390 | active |
| microsoft/Detours Microsoft Detours is a C++ library for intercepting, monitoring, and instrumenting Win32 API calls on Windows via function hooking and bina… | 64 | 6384 | stable |
| Gitleaks Gitleaks is an open-source CLI tool for detecting secrets like passwords, API keys, and tokens in git repositories, files, directories, and… | 87 | 29941 | maintenance |
| crytic/slither Slither is a Python-based static analysis framework for Solidity and Vyper smart contracts. It runs vulnerability detectors, prints contrac… | 90 | 6374 | active |