Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| detect-secrets detect-secrets is a Python CLI tool from Yelp that detects secrets (API keys, passwords, tokens) in codebases using regex and entropy heuri… | 53 | 4649 | active |
| build-trust/ockam Ockam is a Rust library and CLI toolkit for building secure-by-design distributed applications with end-to-end encryption, cryptographic id… | 57 | 4637 | active |
| zrax/pycdc Decompyle++ is a C++ tool that translates compiled Python bytecode (.pyc files) back into readable Python source code. It includes pycdas, … | 63 | 4635 | active |
| Tracee Tracee is a Linux runtime security and forensics tool that uses eBPF to trace system calls, network activity, and file operations in real t… | 77 | 4632 | active |
| Drozer Security Assessment Framework drozer is an open-source security assessment framework for Android that lets testers assume the role of an app and interact with the Androi… | 53 | 4621 | active |
| rfjakob/gocryptfs gocryptfs is an encrypted overlay filesystem written in Go, built on the go-fuse library, that stores each file as a corresponding encrypte… | 77 | 4617 | stable |
| Cerbos Cerbos is an open-core, language-agnostic policy decision point (PDP) that externalizes authorization from application code using context-a… | 94 | 4616 | stable |
| mini-swe-agent SWE-agent is a Python framework that lets a language model autonomously use tools to fix GitHub issues, find cybersecurity vulnerabilities,… | 67 | 20450 | maintenance |
| ntop/nDPI nDPI is an open source LGPLv3 C library for deep packet inspection that detects 450+ layer-7 application protocols from network traffic. It… | 84 | 4613 | stable |
| stratumauth/app Stratum (formerly Authenticator Pro) is a free, open-source two-factor authentication app for Android with a Wear OS companion. It supports… | 90 | 4598 | active |
| sensity-ai/dot dot (Deepfake Offensive Toolkit) is a Python tool that generates real-time, controllable deepfakes from a webcam feed and injects them into… | 23 | 4589 | active |
| aaPanel/BaoTa BaoTa (BT Panel) is a self-hosted web-based server operations panel for Linux (and Windows) that simplifies managing websites, LAMP/LNMP st… | 67 | 4585 | active |
| Oros42/IMSI-catcher A Python tool that decodes GSM radio traffic captured via software-defined radio receivers (RTL-SDR, HackRF, BladeRF, OsmocomBB) to display… | 67 | 4571 | active |
| hacklcx/HFish HFish is a free, enterprise-grade honeypot platform for deception-based defense, threat detection, and attacker tracing. It deploys decoy s… | 61 | 4552 | active |
| hluwa/frida-dexdump A Frida-based CLI tool that finds and dumps DEX files from an Android app's memory, enabling unpacking of packed or obfuscated APKs. It sup… | 10 | 4552 | stable |
| Interactsh Interactsh is an open-source tool for detecting out-of-band (OOB) interactions via DNS, HTTP(S), SMTP(S), and LDAP, useful for identifying … | 88 | 4549 | active |
| samsesh/SocialBox-Termux SocialBox-Termux is a shell-based brute-force attack framework targeting social media and email services like Facebook, Gmail, Instagram, a… | 68 | 4548 | active |
| spipm/Depixelization_poc Depix is a proof-of-concept tool that recovers plaintext from pixelized screenshots by matching pixelated blocks against a rendered font se… | 10 | 4537 | active |
| ProvableHQ/snarkOS snarkOS is a decentralized operating system for zero-knowledge applications, forming the backbone of the Aleo network. It implements node s… | 100 | 4532 | active |
| KernelSU-Next/KernelSU-Next KernelSU Next is a kernel-based root solution for Android devices, providing superuser access via kernel-level hooks with a companion manag… | 85 | 4526 | active |
| sensepost/gowitness gowitness is a Go-based command-line utility that uses Chrome Headless to take screenshots of websites, supporting scans of URL lists, CIDR… | 88 | 4522 | active |
| CISO Assistant CISO Assistant is an open-source, self-hostable GRC (Governance, Risk, and Compliance) platform covering risk management, compliance and au… | 91 | 4521 | active |
| express-jwt Express middleware that validates JSON Web Tokens (JWTs) using the webtoken library and attaches the decoded payload to the request object.… | 69 | 4507 | stable |
| taviso/loadlibrary A library that lets native Linux programs load and call functions from Windows DLLs via a custom PE/COFF loader with a dlopen-like API. It … | 35 | 4507 | active |
| JonathanSalwan/ROPgadget ROPgadget is a Python command-line tool that searches binaries for ROP gadgets to facilitate return-oriented programming exploitation. It s… | 61 | 4501 | active |
| extremecoders-re/pyinstxtractor A Python script that extracts the contents of PyInstaller-generated executables, including fixing pyc headers so bytecode decompilers can p… | 78 | 4500 | stable |
| Tactical RMM Tactical RMM is a self-hosted remote monitoring and management tool built with Django, Vue, and a Go agent, integrating MeshCentral for rem… | 91 | 4496 | active |
| jonaslejon/malicious-pdf A Python CLI tool that generates 67 malicious PDF test files embedding callbacks for SSRF, XSS, XXE, NTLM credential theft, and data exfilt… | 90 | 4483 | active |
| AdguardTeam/AdguardBrowserExtension AdGuard Browser Extension is a free, open-source ad blocker for Chrome, Firefox, Opera, Edge, and other Chromium-based browsers. It blocks … | 98 | 4482 | active |
| mr-karan/doggo doggo is a modern command-line DNS client for humans, written in Go and inspired by the Rust tool 'dog'. It supports multiple DNS transport… | 94 | 4480 | active |
| OpenVPN/easy-rsa easy-rsa is a shell-based CLI utility for building and managing a PKI certificate authority. It creates root and intermediate CAs, signs ce… | 88 | 4479 | active |
| PowerDNS/pdns PowerDNS is a suite of open-source DNS software written in C++, comprising the Authoritative Server, the Recursor, and dnsdist. It provides… | 75 | 4473 | stable |
| trifectatechfoundation/sudo-rs A memory-safe, safety-oriented reimplementation of the classic sudo and su utilities written in Rust. It is actively maintained, independen… | 92 | 4470 | active |
| BeichenDream/Godzilla Godzilla is a Java-based webshell management tool supporting dynamic payloads for JSP, ASPX, and PHP targets with multiple AES/XOR encrypto… | 23 | 4467 | active |
| GerbenJavado/LinkFinder LinkFinder is a Python CLI script that discovers endpoints and their parameters in JavaScript files using jsbeautifier and regular expressi… | 32 | 4464 | stable |
| apache/shiro Apache Shiro is a comprehensive Java security framework providing authentication, authorization, cryptography, and enterprise session manag… | 92 | 4460 | active |
| t3l3machus/Villain Villain is a high-level stage 0/1 command-and-control (C2) framework written in Python that handles multiple reverse TCP and HoaxShell-base… | 29 | 4460 | active |
| ts1/BLEUnlock BLEUnlock is a macOS menu bar utility that locks and unlocks your Mac based on the proximity of a Bluetooth Low Energy device such as an iP… | 23 | 4452 | active |
| Volatility Volatility is an open-source memory forensics framework for extracting digital artifacts from RAM captures of Windows, Linux, and macOS sys… | 88 | 4444 | active |
| meta-llama/PurpleLlama Purple Llama is Meta's umbrella project of tools and benchmarks for assessing and improving the security of large language models. It inclu… | 72 | 4444 | active |
| XTLS/RealiTLScanner A Go-based TLS server scanner built for the XTLS Reality protocol ecosystem. It scans IP ranges, CIDRs, domains, or target lists to find TL… | 80 | 4443 | active |
| orhun/binsider Binsider is a terminal user interface tool for analyzing ELF binaries, offering static and dynamic analysis, string inspection, linked libr… | 76 | 4439 | active |
| zan8in/afrog afrog is an open-source security tool written in Go for vulnerability scanning using PoC (Proof of Concept) rules. It is designed for bug b… | 100 | 4434 | active |
| joxeankoret/diaphora Diaphora is a free and open source program diffing (binary diffing) tool that works as an IDA Pro plugin, comparing binaries to find change… | 95 | 4430 | active |
| WireGuard/wireguard-go A userspace implementation of the WireGuard VPN protocol written in Go. It creates WireGuard tunnel interfaces on Linux, macOS, Windows, Fr… | 66 | 4429 | stable |
| TideSec/TscanPlus TscanPlus is a comprehensive network security detection and operations tool for rapid asset discovery, identification, and vulnerability de… | 92 | 4407 | active |
| OpenZiti OpenZiti is an open-source zero-trust networking platform that provides programmable mesh overlay networks with cryptographic identity, pol… | 97 | 4403 | active |
| microsoft/ApplicationInspector Microsoft Application Inspector is a source code characterization tool that uses a JSON-based rules engine with 400+ regex patterns to iden… | 91 | 4397 | active |
| HaE HaE (Highlighter and Extractor) is a framework-style cybersecurity project for fine-grained tagging and extraction of sensitive information… | 95 | 4393 | active |
| zyantific/zydis Zydis is a fast, lightweight x86/x86-64 disassembler and encoder library written in C with zero dependencies, not even libc. It supports al… | 62 | 4385 | active |
| sshnet/SSH.NET SSH.NET is a Secure Shell (SSH-2) client library for .NET, optimized for parallelism. It provides SSH command execution, SFTP and SCP file … | 81 | 4382 | stable |
| zoontek/react-native-permissions A React Native library providing a unified permissions API across iOS, Android, and Windows. It lets apps check, request, and manage device… | 96 | 4375 | active |
| megadose/toutatis Toutatis is a Python CLI tool that extracts public information from Instagram accounts, such as emails, phone numbers, follower counts, and… | 32 | 4369 | active |
| lazy-luo/smarGate smarGate is a cross-network remote port mapping and NAT traversal tool consisting of an Android client app and lightweight server binaries,… | 73 | 4361 | active |
| Cilium Hubble is a fully distributed network, service, and security observability platform for Kubernetes, built on top of Cilium and eBPF. It pro… | 94 | 4360 | active |
| ufrisk/MemProcFS MemProcFS is an memory forensic tool that exposes physical memory, memory dump files, and live memory acquisition sources as files in a vir… | 84 | 4356 | active |
| iancoleman/bip39 A web-based tool for converting BIP39 mnemonic seed phrases into addresses and private keys across many cryptocurrencies. It can be used on… | 23 | 4351 | stable |
| arxhr007/Aliens_eye Aliens Eye is an AI-powered OSINT CLI tool that scans 840+ social media and web platforms to find accounts associated with a given username… | 99 | 4344 | active |
| Authlogic Authlogic is an unobtrusive Ruby authentication library built on ActiveRecord, treating user sessions as models. It handles login, logout, … | 58 | 4342 | stable |
| jazzband/djangorestframework-simplejwt Simple JWT is a JSON Web Token authentication plugin for the Django REST Framework. It provides token-based authentication for Django REST … | 70 | 4336 | stable |
| kubernetes-sigs/agent-sandbox Agent Sandbox is a Kubernetes SIG project providing a Sandbox Custom Resource Definition (CRD) and controller for managing isolated, statef… | 86 | 4335 | active |
| JonathanSalwan/Triton Triton is a dynamic binary analysis library providing dynamic symbolic execution, taint analysis, and ISA semantics for x86, x86-64, ARM32,… | 67 | 4334 | active |
| smallstep/cli Step CLI is a Go-based command-line tool for building, operating, and automating PKI systems, working with X.509 certificates, JWTs, OAuth … | 97 | 4333 | active |
| jtesta/ssh-audit ssh-audit is a Python CLI tool that audits SSH server and client configurations, analyzing banners, key exchange, encryption, MAC, and comp… | 83 | 4324 | active |
| Lucksi/Mr.Holmes Mr.Holmes is a Python-based OSINT (open-source intelligence) CLI tool that gathers information about usernames, domains, phone numbers, and… | 50 | 4314 | active |
| x64dbg/ScyllaHide ScyllaHide is an advanced usermode anti-anti-debug library that hooks Windows functions to hide the presence of a debugger from debugged pr… | 23 | 4312 | active |
| Velociraptor Velociraptor is an open-source endpoint visibility, digital forensics, and incident response platform that collects host-based state inform… | 94 | 4304 | stable |
| open-policy-agent/gatekeeper Gatekeeper is a CNCF policy controller for Kubernetes built on Open Policy Agent (OPA). It enforces admission policies via customizable con… | 97 | 4303 | stable |
| nolabs-ai/nono nono is a Rust-based CLI and SDK that runs AI coding agents and their tool invocations in ephemeral, kernel-enforced micro sandboxes with c… | 76 | 4273 | active |
| ConsenSysDiligence/mythril Mythril is a symbolic-execution-based security analysis tool for EVM bytecode that detects vulnerabilities in Ethereum and other EVM-compat… | 55 | 4272 | active |
| OWASP Dependency-Track OWASP Dependency-Track is an open-source component analysis platform that ingests CycloneDX SBOMs to continuously identify vulnerabilities,… | 99 | 4269 | active |
| irbis-sh/zen-desktop Zen is an open-source, system-wide ad-blocker and privacy guard for Windows, macOS, and Linux. It runs a local proxy that intercepts HTTP/H… | 97 | 4265 | active |
| jasonxtn/Argus Argus is a Python-based all-in-one information gathering and reconnaissance toolkit with an interactive console and modular architecture. I… | 44 | 4264 | active |
| baihengaead/wlan-sec-test-tool A Python-based GUI tool for wireless network security testing that checks WiFi networks for weak passwords by attempting connections with a… | 67 | 4243 | active |
| i2pd i2pd (I2P Daemon) is a full-featured C++ implementation of an I2P client, providing a universal anonymous network layer with end-to-end enc… | 92 | 4241 | active |
| google/tamperchrome Tamper Dev is a browser extension that intercepts and edits HTTP/HTTPS requests and responses in real time without requiring a proxy or aux… | 50 | 4227 | active |
| JaveleyQAQ/WeChatOpenDevTools-Python A Python tool that force-enables the hidden developer tools (F12) in WeChat mini programs and WeChat's built-in browser. It is a Python rew… | 17 | 4225 | active |
| marmotedu/iam IAM is an enterprise-grade identity and access management system written in Go, used to authenticate users and authorize access to resource… | 25 | 4212 | active |
| wux1an/wxapkg A cross-platform desktop GUI tool built with Wails for scanning, decrypting, and unpacking WeChat mini-program .wxapkg files. It restores t… | 64 | 4206 | active |
| guelfoweb/knockpy KnockPy is a modular Python 3 CLI tool for enumerating subdomains of a target domain using passive reconnaissance sources and DNS bruteforc… | 58 | 4204 | active |
| mandiant/flare-floss FLOSS (FLARE Obfuscated String Solver) is a Python CLI tool from Mandiant that automatically extracts and deobfuscates strings from malware… | 88 | 4199 | active |
| Authboss Authboss is a modular authentication system for Go web applications, providing pluggable modules for common auth features like login, regis… | 64 | 4198 | active |
| hellzerg/optimizer Optimizer is a Windows GUI configuration utility for enhancing privacy and security, applying system tweaks, disabling telemetry, cleaning … | 10 | 18244 | maintenance |
| nextdns/nextdns NextDNS CLI is an open-source command-line client (written in Go) that connects to NextDNS's DNS-over-HTTPS service, acting as a local DoH … | 90 | 4184 | active |
| monasticacademy/httptap httptap is a static Go CLI binary that shows the HTTP and HTTPS requests made by any Linux program by running it inside an isolated network… | 60 | 4181 | active |
| RetireJS/retire.js Retire.js is a scanner that detects the use of JavaScript libraries and Node.js modules with known vulnerabilities, available as a CLI scan… | 95 | 4180 | active |
| sooryathejas/METATRON METATRON is a CLI-based AI penetration testing assistant that runs a local LLM (via Ollama) entirely offline on Linux, primarily Parrot OS.… | 46 | 4178 | active |
| ivre/ivre IVRE is an open-source network recon framework written in Python that collects, stores, and analyzes network intelligence from active scann… | 66 | 4177 | active |
| Bubka/2FAuth 2FAuth is a self-hosted web application for managing Two-Factor Authentication accounts and generating TOTP, HOTP, and Steam Guard security… | 97 | 4173 | active |
| square/Valet Valet is a Swift library that simplifies securely storing data in the iOS, tvOS, watchOS, and macOS Keychain. It wraps the Keychain's compl… | 84 | 4170 | stable |
| simov/grant Grant is an OAuth proxy middleware for Node.js supporting 200+ OAuth providers across OAuth 1.0a, OAuth 2.0, and OpenID Connect. It integra… | 32 | 4165 | stable |
| yusing/godoxy GoDoxy is a lightweight, high-performance reverse proxy with a built-in WebUI, designed for self-hosters running Docker or Podman. It autom… | 87 | 4161 | active |
| google/nsjail NsJail is a lightweight Linux process isolation tool that uses namespaces, cgroups, rlimits, and seccomp-bpf syscall filters (via the Kafel… | 87 | 4152 | stable |
| cartography-cncf/cartography Cartography is a Python CLI tool that ingests infrastructure assets and their relationships from 30+ platforms (AWS, GCP, Azure, Kubernetes… | 99 | 4147 | active |
| cifertech/ESP32-DIV ESP32-DIV is open-source firmware (with open schematics and PCB files) for a custom ESP32-S3 handheld device that bundles Wi-Fi, BLE, 2.4GH… | 86 | 4146 | active |
| vvo/iron-session iron-session is a secure, stateless, cookie-based session library for JavaScript, storing session data in signed and encrypted cookies deco… | 95 | 4143 | active |
| sundowndev/phoneinfoga PhoneInfoga is an information gathering framework for scanning international phone numbers, built in Go. It collects basic data like countr… | 64 | 18004 | maintenance |
| HyperDbg HyperDbg is an open-source, hypervisor-assisted debugger for Windows (with Linux support in development) that uses Intel VT-x and EPT to de… | 94 | 4137 | active |
| Microsoft Authentication Library (MSAL) Microsoft Authentication Library (MSAL) for JavaScript enables client-side and server-side JS apps to authenticate users with Microsoft Ent… | 95 | 4126 | active |
| alexandreborges/malwoverview Malwoverview is a Python command-line first-response tool for threat hunting that queries many threat intelligence sources such as VirusTot… | 97 | 4120 | active |