Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| LSPosed/LSPosed.github.io The official website for LSPosed, an Xposed framework implementation for rooted Android devices, providing downloads and changelogs. It als… | 73 | 6355 | active |
| google/syzkaller syzkaller is an unsupervised coverage-guided kernel fuzzer originally built for the Linux kernel and now supporting FreeBSD, Fuchsia, gViso… | 77 | 6352 | active |
| expressjs/session express-session is official session middleware for the Express web framework that manages user sessions via cookies holding only a session … | 74 | 6352 | stable |
| dwisiswant0/apkleaks APKLeaks is a Python CLI tool that decompiles Android APK files with jadx and scans them for URIs, endpoints, and hardcoded secrets using r… | 36 | 6344 | active |
| AzeemIdrisi/PhoneSploit-Pro PhoneSploit Pro is an all-in-one Python CLI tool for remotely exploiting and testing Android devices using ADB and the Metasploit Framework… | 90 | 6343 | active |
| snare/voltron Voltron is an extensible debugger UI toolkit written in Python that adds utility views (registers, disassembly, stack, memory, breakpoints,… | 23 | 6342 | active |
| sigstore/cosign Cosign is a CLI tool from the Sigstore project for signing and verifying OCI containers and other software artifacts, with support for keyl… | 95 | 6339 | stable |
| dnSpy dnSpy is a Windows GUI application for debugging and editing .NET and Unity assemblies without needing source code. It combines a debugger,… | 10 | 29672 | maintenance |
| PurpleAILAB/Decepticon Decepticon is an autonomous AI red-team hacking agent that uses LLMs (built on LangChain/LangGraph) to plan and execute context-aware offen… | 83 | 6328 | active |
| Bjorn Bjorn is an autonomous network scanning and offensive security tool that runs on a Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers … | 58 | 6328 | active |
| androguard/androguard Androguard is a full Python tool and library for reverse engineering and analyzing Android files, including DEX/ODEX bytecode disassembly a… | 81 | 6323 | active |
| projectdiscovery/naabu Naabu is a fast, lightweight port scanner written in Go that performs SYN, CONNECT, and UDP scans to enumerate open ports on hosts. It is d… | 87 | 6320 | active |
| mviereck/x11docker x11docker is a shell-based CLI tool that runs graphical applications and entire desktop environments inside Docker, podman, or nerdctl cont… | 78 | 6320 | stable |
| anthropics/claude-code-security-review A GitHub Action that uses Anthropic's Claude to perform AI-powered security reviews of pull requests, analyzing code diffs for vulnerabilit… | 45 | 6319 | active |
| GNU Radio GNU Radio is a free and open-source signal processing runtime and development toolkit for building software-defined radios and simulating w… | 67 | 6292 | stable |
| PeerBanHelper PeerBanHelper is a self-hosted Java application that automatically bans unwanted, leeching, and abnormal BitTorrent peers by connecting to … | 85 | 6284 | active |
| capa capa is Mandiant FLARE's open-source tool that identifies capabilities in executable files (PE, ELF, .NET, shellcode) by matching expert-wr… | 95 | 6261 | active |
| dehydrated-io/dehydrated Dehydrated is an ACME client for signing TLS certificates from CAs like Let's Encrypt and ZeroSSL, implemented as a single bash/zsh-compati… | 55 | 6259 | active |
| Outline Outline is a pair of open-source applications from Jigsaw (Google) for creating and using your own VPN server: Outline Manager sets up and … | 67 | 6254 | active |
| Trusted-AI/adversarial-robustness-toolbox Adversarial Robustness Toolbox (ART) is a Python library for machine learning security covering evasion, poisoning, extraction, and inferen… | 56 | 6250 | stable |
| PhilippC/keepass2android Keepass2android is an open-source password manager app for Android, compatible with the KeePass 2.x database format. It stores credentials … | 96 | 6247 | active |
| auth0/java-jwt A Java library for creating and verifying JSON Web Tokens (JWT) per RFC 7519, supporting HMAC, RSA, and ECDSA signing algorithms. It is mai… | 92 | 6237 | active |
| k8gege/K8tools K8tools is a large curated collection of penetration testing and offensive security tools covering internal network penetration, privilege … | 32 | 6234 | active |
| mishakorzik/AllHackingTools AllHackingTools is an all-in-one installer and menu system for Termux that automates downloading and installing a large collection of penet… | 75 | 6215 | active |
| DominicBreuker/pspy pspy is a command line tool that snoops on Linux processes without root permissions by combining procfs scans with inotify watchers to catc… | 51 | 6211 | stable |
| Dicklesworthstone/destructive_command_guard A high-performance Rust CLI hook that intercepts and blocks destructive git and shell commands before AI coding agents execute them. It int… | 79 | 6195 | active |
| Azure/Azure-Sentinel The official community repository for Microsoft Sentinel, a cloud-native SIEM, containing out-of-the-box detections, hunting queries, workb… | 77 | 6189 | active |
| Cosmos Cosmos-Server is a self-hosted home server platform that acts as a secure gateway and server manager for your applications. It bundles auth… | 92 | 6178 | active |
| GhostTroops/scan4all scan4all is a Go-based automated vulnerability scanning and reconnaissance tool that integrates vscan, nuclei, ksubdomain, and subfinder. I… | 23 | 6178 | active |
| GmSSL GmSSL is an open-source cryptographic toolkit developed at Peking University implementing Chinese national commercial cryptography standard… | 74 | 6166 | stable |
| Passbolt Passbolt Community Edition API is the JSON backend for the open source, security-first password manager for teams, built in PHP on CakePHP.… | 96 | 6136 | stable |
| Clash for Windows Chinese Clash for Windows Chinese is a modified, Chinese‑localized version of the Clash proxy client with support for the Mihomo core and modern pr… | 86 | 28586 | maintenance |
| AutoRecon/AutoRecon AutoRecon is a multi-threaded Python CLI tool that automates network reconnaissance by performing port and service detection scans, then la… | 57 | 6128 | active |
| qilingframework/qiling Qiling is a Python-based binary emulation framework built on Unicorn Engine that emulates executables across multiple platforms (Windows, m… | 85 | 6110 | active |
| Proxmark3 The Iceman fork of Proxmark3, the client software for the Proxmark3 RFID analysis device, supporting reading, cloning, simulating, and snif… | 88 | 6100 | active |
| Auth.js (next-auth) Auth.js (formerly NextAuth.js) is an open-source, runtime-agnostic authentication library built on standard Web APIs, with deep integration… | 84 | 28373 | maintenance |
| cloud-custodian/cloud-custodian Cloud Custodian (c7n) is a Python-based stateless rules engine for managing public cloud accounts and resources via YAML policy DSLs with f… | 95 | 6088 | stable |
| ESP32 Bit Pirate ESP32 Bit Pirate is open-source C++ firmware that turns an ESP32-S3 board into a multi-protocol hardware debugging and analysis workbench, … | 86 | 6078 | active |
| undergroundwires/privacy.sexy privacy.sexy is an open-source desktop application that enforces privacy and security best practices on Windows, macOS, and Linux. It provi… | 56 | 6075 | active |
| lesspass/lesspass LessPass is a stateless, open-source password manager that deterministically generates site-specific passwords from a single master passwor… | 77 | 6065 | active |
| gerardog/gsudo gsudo is a sudo equivalent for Windows that lets users run commands or relaunch shells with elevated permissions from the current console. … | 64 | 6059 | active |
| alpkeskin/mosint Mosint is an automated email OSINT tool written in Go that investigates target email addresses by consolidating multiple services. It check… | 23 | 6048 | active |
| oomol-lab/open-connector OpenConnector is an open-source connector gateway that lets users authorize SaaS app accounts once and exposes 1,000+ providers and 10,000+… | 81 | 6046 | active |
| TsudaKageyu/minhook MinHook is a minimalistic, lightweight C library for intercepting (hooking) x86 and x64 function calls on Windows, using a trampoline/detou… | 65 | 6012 | stable |
| Recon-ng Recon-ng is a full-featured, modular reconnaissance framework for conducting web-based open source intelligence (OSINT) gathering. It offer… | 76 | 6003 | active |
| Ackites/KillWxapkg A Go-based CLI tool that automatically decrypts, unpacks, and decompiles WeChat mini-program .wxapkg packages, restoring the original proje… | 14 | 5995 | active |
| FluxionNetwork/fluxion Fluxion is a security auditing and social-engineering research tool that retrieves WPA/WPA2 keys via phishing attacks using rogue access po… | 92 | 5985 | active |
| openpgpjs/openpgpjs OpenPGP.js is a pure JavaScript implementation of the OpenPGP protocol (RFC 9580), maintained by Proton Mail. It lets applications encrypt,… | 87 | 5966 | stable |
| EFForg/rayhunter Rayhunter is an EFF-developed Rust tool that detects IMSI catchers (cell-site simulators, also known as stingrays) used for cellular survei… | 93 | 5945 | active |
| ZoneMinder/zoneminder ZoneMinder is an open-source video surveillance (CCTV) application for Linux that captures, records, analyzes, and monitors security camera… | 95 | 5940 | stable |
| garinasset/leak-check A self-hostable personal information leak detection service that checks whether your personal data (name, phone, email, address, QQ, etc.) … | 46 | 5921 | active |
| golang/oauth2 The official Go client implementation of the OAuth 2.0 specification, maintained by the Go team. It provides token acquisition, refresh, an… | 74 | 5903 | stable |
| vimeo/psalm Psalm is an open-source static analysis tool for PHP that finds type-related bugs and security vulnerabilities through type inference and t… | 98 | 5896 | active |
| NetExec NetExec (nxc) is a community-maintained, open-source network execution tool and successor to CrackMapExec, used for pentesting and red-team… | 74 | 5882 | active |
| commix Commix (short for command injection exploiter) is an open-source penetration testing tool that automates the detection and exploitation of … | 72 | 5874 | active |
| sammwyy/MikuMikuBeam MikuMikuBeam is a network stress testing tool written in Go with a Hatsune Miku-themed web UI, supporting HTTP flood, HTTP bypass, Slowlori… | 60 | 5864 | active |
| microsoft/sudo Sudo for Windows is a Windows-specific implementation of the sudo concept, letting users run elevated commands directly from unelevated ter… | 67 | 5859 | active |
| RedSiege/EyeWitness EyeWitness is a Python CLI tool that takes screenshots of websites using headless Chromium, captures server header information, and identif… | 46 | 5858 | active |
| yonggekkk/argosbx ArgoSBX is a one-click, non-interactive shell script ('little cannon') that deploys proxy servers on VPS or Docker by combining Sing-box, X… | 55 | 5849 | active |
| OpenFGA OpenFGA is a high-performance, open-source fine-grained authorization and permission engine inspired by Google's Zanzibar, owned by the CNC… | 97 | 5846 | stable |
| windtf/wireproxy wireproxy is a userspace WireGuard client written in Go that exposes a WireGuard connection as a SOCKS5/HTTP proxy or TCP tunnels, without … | 95 | 5838 | active |
| dotenvx/dotenvx Dotenvx is a secure, cross-platform CLI and SDK for managing .env files, adding encryption so secrets can be safely committed to git and de… | 90 | 5833 | active |
| mscdex/ssh2 SSH2 client and server modules written in pure JavaScript for Node.js. It supports exec, shell, SFTP, port forwarding, and custom HTTP(S) a… | 73 | 5821 | stable |
| jedisct1/dsvpn DSVPN is a dead-simple, single-binary VPN tool written in C that tunnels traffic over TCP with modern, formally verified cryptography. It r… | 71 | 5817 | stable |
| Dependabot Dependabot-Core is the Ruby library powering GitHub's Dependabot automated dependency updates. It resolves and updates dependencies across … | 96 | 5807 | active |
| win-acme/win-acme win-acme is an ACMEv2 client for Windows that automates obtaining and installing SSL/TLS certificates from Let's Encrypt, ZeroSSL, and othe… | 58 | 5806 | active |
| freedomofpress/dangerzone Dangerzone is a desktop application from Freedom of the Press Foundation that converts untrusted documents (PDFs, office files, images) int… | 86 | 5785 | active |
| seL4/seL4 seL4 is a formally verified microkernel operating system kernel written in C, providing high-assurance isolation and capability-based secur… | 85 | 5768 | active |
| letsencrypt/boulder Boulder is the Go implementation of an ACME-based certificate authority that powers Let's Encrypt. It automates domain validation and issua… | 95 | 5764 | active |
| rack/rack-attack Rack::Attack is Rack middleware for protecting Ruby and Rails web applications from abusive clients. It lets you define rules to allow, blo… | 66 | 5764 | stable |
| OpenSSF Scorecard OpenSSF Scorecard is an automated tool that scores open source projects on security best practices through a series of checks. It can be ru… | 91 | 5761 | active |
| UEFITool UEFITool is a cross-platform C++/Qt application that parses UEFI-compatible firmware images into a tree structure, verifies their integrity… | 84 | 5761 | active |
| elceef/dnstwist dnstwist is a Python command-line tool that generates permutations of a domain name (typos, homoglyphs, IDN tricks) and checks which ones r… | 26 | 5758 | active |
| burrowers/garble Garble is a CLI tool that obfuscates Go binaries by wrapping the Go toolchain's compiler and linker. It replaces identifiers, package paths… | 94 | 5749 | active |
| laravel/socialite Laravel Socialite is a first-party Laravel package providing a fluent interface for OAuth 1 and OAuth 2 social authentication. It handles t… | 98 | 5742 | stable |
| pfSense pfSense is a free, open-source network firewall and router distribution based on FreeBSD with a custom kernel, managed entirely through a w… | 62 | 5742 | stable |
| jpadilla/pyjwt PyJWT is a Python library implementing JSON Web Tokens (JWT) per RFC 7519, supporting encoding and decoding of signed tokens. It is the de … | 98 | 5719 | stable |
| gilbertchen/duplicacy Duplicacy is a cross-platform cloud backup tool built around lock-free deduplication, allowing multiple computers to back up to the same st… | 70 | 5696 | stable |
| CanCanCommunity/cancancan CanCanCan is an authorization library for Ruby and Ruby on Rails that restricts which resources a user can access. Permissions are defined … | 65 | 5683 | stable |
| Snyk CLI The Snyk CLI is a command-line tool that scans projects for security vulnerabilities across open-source dependencies, application code, con… | 97 | 5668 | active |
| bethington/ghidra-mcp A Model Context Protocol (MCP) server and Ghidra plugin exposing 250+ tools that let AI agents drive Ghidra's reverse engineering capabilit… | 81 | 5661 | active |
| next-terminal/next-terminal Next Terminal is an open-source bastion host (jump server) and interactive session auditing system supporting SSH, RDP, VNC, Telnet, HTTP, … | 96 | 5647 | active |
| pk910/PoWFaucet A self-hostable, modularized faucet for EVM-compatible blockchain testnets that distributes test ETH with multiple bot-protection mechanism… | 90 | 5622 | active |
| OWASP/Nettacker OWASP Nettacker is a Python-based automated penetration testing and information-gathering framework for reconnaissance, vulnerability scann… | 84 | 5616 | active |
| google/clusterfuzz ClusterFuzz is Google's scalable fuzzing infrastructure that finds security and stability bugs in software, serving as the backend for OSS-… | 95 | 5613 | active |
| Caddy CertMagic is a Go library that provides fully-managed automatic HTTPS, handling TLS certificate issuance, renewal, and OCSP stapling via AC… | 93 | 5608 | stable |
| lief-project/LIEF LIEF is a cross-platform C++ library (with Python and Rust bindings) for parsing, inspecting, modifying, and writing executable file format… | 95 | 5598 | stable |
| Dr-TSNG/Hide-My-Applist An Xposed module for rooted Android devices that hides installed apps from other apps' package list queries. It intercepts app list detecti… | 82 | 5597 | active |
| phpseclib/phpseclib A MIT-licensed pure-PHP library providing implementations of SSH-2, SFTP, X.509/CSR/CRL/PFX/CMS, and a wide range of cryptographic primitiv… | 95 | 5592 | stable |
| the1812/Malware-Patch A Windows utility that blocks administrator (UAC) authorization for specified software, such as known Chinese rogueware, using digital sign… | 70 | 5592 | active |
| trustedsec/ptf The PenTesters Framework (PTF) is a Python-based modular framework that installs, compiles, and keeps penetration testing tools up to date … | 32 | 5573 | active |
| Rethink DNS + Firewall Rethink DNS + Firewall is an open-source Android app combining an encrypted DNS client (DoH, Oblivious DoH, DoT, DNSCrypt) with blocklists,… | 97 | 5554 | active |
| tonarino/innernet innernet is a self-hosted private network (overlay VPN) system built on WireGuard, with a coordination server and client CLI written in Rus… | 80 | 5554 | active |
| charmbracelet/wish Wish is a Go library for building custom SSH applications, built on gliderlabs/ssh with sensible defaults and a middleware system analogous… | 94 | 5552 | active |
| Hackplayers/evil-winrm Evil-WinRM is a Ruby-based command-line WinRM shell designed for hacking and penetration testing of Windows servers. It supports features l… | 89 | 5552 | active |
| docker-easyconnect/docker-easyconnect A Docker/Podman image that runs Sangfor's proprietary EasyConnect and aTrust VPN clients inside containers, exposing socks5 and HTTP proxie… | 61 | 5546 | active |
| Doorkeeper Doorkeeper is a Ruby gem (Rails engine) that adds OAuth 2.0 provider functionality to Ruby on Rails or Grape applications. It implements th… | 94 | 5523 | stable |
| permitio/opal OPAL (Open Policy Administration Layer) is an administration layer for policy engines such as Open Policy Agent (OPA) and Cedar Agent. It d… | 95 | 5513 | active |
| xjasonlyu/tun2socks A Go-based tool that transparently routes all network traffic from any application through a proxy (SOCKS4/5, HTTP, Shadowsocks, SSH, WireG… | 81 | 5513 | active |
| intel/hyperscan Hyperscan is a high-performance C library (written in C++) for simultaneously matching large numbers of regular expressions, using hybrid a… | 67 | 5502 | stable |