Open-source cryptography software
1245 open-source libraries, tools and applications tagged cryptography, ranked by how closely cryptography is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
1245 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| The Update Framework (TUF) Python reference implementation of The Update Framework (TUF), a CNCF-graduated specification for securing software update systems against … | 85 | 1728 | stable |
| cloudflare/circl CIRCL is Cloudflare's Go library of cryptographic primitives covering post-quantum algorithms (ML-KEM/Kyber, ML-DSA/Dilithium, SIKE/CSIDH),… | 91 | 1727 | active |
| upspin/upspin Upspin is an experimental framework of protocols and reference implementations providing a secure, global naming system for sharing files a… | 43 | 6405 | maintenance |
| keepassium/KeePassium KeePassium is a KeePass-compatible password manager app for iOS and macOS, written in Swift. It supports all KeePass database formats (kdb,… | 68 | 1714 | active |
| elasticdog/transcrypt A single Bash script that configures transparent encryption of sensitive files in a Git repository using Git's clean/smudge filters and Ope… | 74 | 1712 | stable |
| iden3/circom Circom is a domain-specific language and compiler for defining arithmetic circuits used to generate zero-knowledge proofs (zk-SNARKs). Writ… | 73 | 1698 | active |
| zama-ai/tfhe-rs TFHE-rs is a pure Rust implementation of the TFHE fully homomorphic encryption scheme, enabling boolean and integer arithmetic over encrypt… | 97 | 1667 | active |
| klezVirus/SysWhispers3 SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kerne… | 32 | 1667 | active |
| node-opcua/node-opcua node-opcua is a full OPC UA (IEC 62541) protocol stack for Node.js and the browser, written in TypeScript. It provides client, server, disc… | 97 | 1661 | stable |
| coral-xyz/backpack Backpack is an open-source crypto wallet browser extension built in TypeScript, serving as a home for xNFTs and supporting Solana, Ethereum… | 23 | 1660 | active |
| tevador/RandomX RandomX is a proof-of-work algorithm optimized for general-purpose CPUs that uses random code execution and memory-hard techniques to resis… | 89 | 1655 | stable |
| whwlsfb/BurpCrypto BurpCrypto is a Burp Suite extension that encrypts Intruder payloads with algorithms like AES, RSA, and DES, or by executing arbitrary Java… | 23 | 1652 | active |
| rust-openssl/rust-openssl Rust bindings to the OpenSSL cryptography and TLS library, exposing its APIs (certificates, keys, hashing, SSL/TLS connections) to Rust pro… | 92 | 1650 | stable |
| mssun/passforios Pass for iOS is an iOS password manager client compatible with ZX2C4's Pass command line application. It encrypts password entries with GPG… | 74 | 1645 | active |
| Kodiqa-Solutions/VaultS3 VaultS3 is a lightweight, S3-compatible object storage server written in Go, shipped as a single binary with a built-in web dashboard, encr… | 79 | 1634 | active |
| cathugger/mkp224o mkp224o is a C command-line tool that generates vanity ed25519 onion service (Tor hidden service v3) addresses by brute-forcing keypairs ma… | 23 | 1632 | active |
| LANDrop/LANDrop LANDrop is a cross-platform application for transferring files between devices on the same local network, similar to AirDrop. It uses Qt an… | 23 | 5987 | maintenance |
| Proton Mail Proton Mail's official iOS client for end-to-end encrypted email, written in Swift/SwiftUI with core business logic in a Rust-based SDK. Th… | 63 | 1620 | active |
| iotexproject/iotex-core The official Go implementation of the IoTeX blockchain protocol, a modular DePIN-focused Layer-1 EVM-compatible network. It provides the fu… | 99 | 1616 | active |
| ankane/lockbox Lockbox is a Ruby gem providing modern encryption for database fields, files, and strings in Ruby and Rails applications. It integrates wit… | 75 | 1609 | stable |
| Heads Heads is an open-source firmware and OS configuration that runs a minimal Linux as a coreboot or LinuxBoot ROM payload, moving the root of … | 68 | 1602 | active |
| libssh2/libssh2 libssh2 is a client-side C library implementing the SSH2 protocol, licensed under the revised BSD license. It provides session establishmen… | 68 | 1596 | stable |
| dyne/tomb Tomb is a minimalist command-line tool for GNU/Linux that creates and manages encrypted storage folders ('tombs') using dm-crypt and LUKS v… | 54 | 1596 | stable |
| tendermint/tendermint Tendermint Core is a Byzantine Fault Tolerant (BFT) consensus engine and blockchain application platform written in Go. It securely replica… | 66 | 5864 | maintenance |
| gurnec/btcrecover btcrecover is an open-source Python command-line tool for recovering Bitcoin (and altcoin) wallet passwords and seed phrases when most of t… | 32 | 1589 | active |
| DimensionDev/Maskbook Mask Network is a browser extension that bridges Web2 social media platforms (X, Facebook, Instagram, Minds, Mirror) with Web3 services. It… | 97 | 1586 | active |
| zama-ai/concrete Concrete is an open-source fully homomorphic encryption (FHE) compiler built on TFHE and LLVM that converts Python programs into their FHE … | 52 | 1580 | active |
| drduh/pwd.sh pwd.sh is a single Bash script that manages text secrets such as passwords using GnuPG symmetric encryption. Secrets are stored in randomly… | 86 | 1563 | active |
| Verge Verge Core is the official full-node source code for the Verge (XVG) cryptocurrency, providing a wallet client, mining support, and blockch… | 92 | 1559 | active |
| unlir/XDrive XDrive is open-source firmware (with hardware schematics and enclosure designs) for a stepper motor driver featuring a multi-function inter… | 32 | 1550 | active |
| cupcakearmy/cryptgeon Cryptgeon is a secure, open-source note and file sharing service inspired by PrivNote, built with Rust and Svelte. Notes are encrypted clie… | 94 | 1547 | active |
| wfb-ng WFB-NG is a long-range packet radio link that transmits video, MAVLink telemetry, and IP traffic over raw (unconnected) WiFi frames, bypass… | 82 | 1546 | active |
| wechatpay-apiv3/wechatpay-java The official Java SDK for WeChat Pay APIv3, consisting of a core library with automatic request signing, response verification, callback ha… | 33 | 1546 | active |
| Profanity Profanity is a console-based XMPP chat client written in C using ncurses and libstrophe, inspired by Irssi. It supports MUC chat rooms, OTR… | 85 | 1542 | active |
| sartoopjj/thefeed TheFeed is a DNS-based feed reader and lightweight messenger that works on networks where only DNS queries pass through, letting users read… | 71 | 1542 | active |
| Tongsuo-Project/Tongsuo Tongsuo (铜锁) is an open-source cryptographic library providing modern cryptographic primitives and secure communication protocols, includin… | 86 | 1540 | active |
| janmojzis/tinyssh TinySSH (tinysshd) is a minimalistic SSHv2 server written in C with under 100,000 words of code, implementing only a secure subset of the p… | 95 | 1535 | active |
| hudikhq/hoodik Hoodik is a self-hosted, end-to-end encrypted cloud storage server written in Rust with a Vue 3 frontend, where all encryption happens in t… | 99 | 1528 | active |
| polhenarejos/pico-fido Open-source firmware that turns a Raspberry Pi Pico (RP2040/RP2350) or ESP32-S3 microcontroller into a FIDO2 passkey authenticator, support… | 91 | 1526 | active |
| twofas/2fas-android The official open-source Android app for 2FAS, a two-factor authentication service that generates one-time passwords (TOTP and HOTP) for se… | 89 | 1524 | active |
| jaraco/keyring A Python library providing a simple API to access the operating system's native keyring service for safe password storage and retrieval. It… | 71 | 1514 | stable |
| 0xsp-SRD/mortar Mortar Loader is a red team evasion tool that encrypts PE binaries and shellcode and executes them in memory using various injection techni… | 23 | 1511 | active |
| DarthTon/Blackbone Blackbone is a C++ library for Windows memory hacking, providing APIs for process memory manipulation, DLL injection, manual PE image mappi… | 32 | 5499 | maintenance |
| robinkarlberg/transfer.zip-web Transfer.zip is an open-source, self-hostable file-sharing service and website, an alternative to WeTransfer, with stored transfers (S3 or … | 72 | 1505 | active |
| cryptii/cryptii Cryptii is a web app and framework for modular conversion, encoding, and encryption, performed entirely in the browser with no server inter… | 23 | 1505 | active |
| project-oak/oak Oak is a Rust-based platform for building distributed systems whose components can produce externally verifiable claims about their behavio… | 75 | 1504 | active |
| zlib-ng/minizip-ng minizip-ng is a zip manipulation library written in C, forked from the minizip code contributed to zlib. It adds features like WinZip AES e… | 88 | 1503 | active |
| traceless/alist-encrypt A Node.js proxy service for Alist that adds transparent WebDAV encryption and decryption of files. It supports streaming encrypted video pl… | 71 | 1503 | active |
| T4y1oR/RingQ RingQ is a post-exploitation antivirus evasion tool that obfuscates and loads arbitrary Windows executables or shellcode (e.g., Cobalt Stri… | 25 | 1503 | active |
| pyca/bcrypt pyca/bcrypt is a Python library providing bcrypt password hashing and a bcrypt_pbkdf key derivation function. It offers salted hashing with… | 75 | 1501 | active |
| libressl/portable LibreSSL Portable is the portable build of LibreSSL, a TLS and cryptography stack forked from OpenSSL 1.0.1g by the OpenBSD project. It pro… | 99 | 1500 | stable |
| Meckazin/ChromeKatz ChromeKatz is a set of offensive security tools (CookieKatz, ElevationKatz) written in C that dump cookies and decryption keys directly fro… | 62 | 1500 | active |
| pass-extension/pass-otp pass-otp is an extension for the pass password manager that stores and manages one-time-password (OTP) tokens as otpauth:// URIs. It genera… | 35 | 1498 | active |
| SChernykh/p2pool P2Pool is a decentralized, peer-to-peer mining pool for Monero written in C++. It combines the regular payouts of centralized pools with th… | 97 | 1495 | active |
| cossacklabs/acra Acra is a database security suite that provides field-level encryption, searchable encryption, tokenization, data masking, SQL firewalling,… | 54 | 1493 | active |
| Spomky-Labs/otphp A PHP library for generating one-time passwords according to RFC 4226 (HOTP) and RFC 6238 (TOTP). It is compatible with Google Authenticato… | 89 | 1492 | stable |
| hellman/xortool xortool is a Python command-line tool for cryptanalysis of multi-byte XOR ciphers. It guesses the key length based on character frequency s… | 39 | 1491 | active |
| securitybunker/databunker Databunker is a self-hosted, Go-based secure vault for tokenizing and storing personal records such as PII, PHI, KYC, and PCI data. It expo… | 71 | 1487 | active |
| hectorm/otpauth A JavaScript One-Time Password library implementing HOTP (RFC 4226) and TOTP (RFC 6238) for generating and validating 2FA tokens. It runs i… | 89 | 1485 | stable |
| Shopify/ejson EJSON is a Go CLI utility for managing encrypted secrets in JSON files using asymmetric elliptic-curve (NaCl Box) encryption. It lets teams… | 80 | 1481 | stable |
| vslavik/winsparkle WinSparkle is an app update framework for Windows desktop applications, inspired by Sparkle for macOS. It ships as a single dependency-free… | 85 | 1479 | stable |
| meganz/sdk The official MEGA C++ SDK providing client access to MEGA's end-to-end encrypted cloud storage, including a low-level API, an intermediate … | 92 | 1475 | active |
| puleos/object-hash A JavaScript library that generates hashes from arbitrary JavaScript objects, working in both Node.js and the browser. It supports hashing … | 32 | 1474 | stable |
| digitalbazaar/forge Forge is a pure-JavaScript implementation of the TLS protocol plus a broad set of cryptographic utilities including AES, RSA, X.509 certifi… | 75 | 5337 | maintenance |
| napi-rs A collection of Node.js native addons written in Rust using napi-rs, providing packages like @node-rs/bcrypt, @node-rs/argon2, @node-rs/crc… | 96 | 1470 | active |
| strongbox-password-safe/Strongbox Strongbox is a native password manager client for iOS and macOS that opens KeePass (KDB/KDBX) and Password Safe (v3) vault files. It encryp… | 70 | 1466 | active |
| potatameister/PaperKnife PaperKnife is a privacy-first PDF utility that merges, splits, compresses, encrypts, signs, and sanitizes PDFs entirely on-device with no s… | 69 | 1465 | active |
| eljojo/rememory ReMemory is a tool that encrypts your files with age and splits the key using Shamir's Secret Sharing among trusted people, who each receiv… | 72 | 1464 | active |
| passwordless-lib/fido2-net-lib A battle-tested .NET library implementing a FIDO2 server / WebAuthn relying party for passkey registration (attestation) and authentication… | 100 | 1456 | active |
| intel/confidential-computing.sgx Intel Software Guard Extensions (SGX) software stack for Linux, comprising the SGX driver, SDK, and Platform Software (PSW). It enables dev… | 87 | 1455 | active |
| GhostPack/SharpDPAPI SharpDPAPI is a C# port of Mimikatz's Windows DPAPI functionality, allowing triage of DPAPI masterkeys, credentials, vaults, certificates, … | 32 | 1455 | active |
| zama-ai/concrete-ml Concrete ML is a privacy-preserving machine learning library built on top of Zama's Concrete FHE compiler. It lets data scientists convert … | 65 | 1453 | active |
| tuneinsight/lattigo Lattigo is a pure Go library implementing lattice-based (RLWE) homomorphic encryption schemes such as BFV/BGV and CKKS, along with their mu… | 74 | 1452 | active |
| Harmony The core protocol implementation of the Harmony blockchain, a sharded proof-of-stake network written in Go. It implements consensus (PBFT-b… | 90 | 1447 | active |
| Superpowered SDK Superpowered is a commercial cross-platform C++ SDK suite providing low-latency interactive audio processing, HTTP/HTTPS networking, and cr… | 75 | 1443 | active |
| tahoe-lafs/tahoe-lafs Tahoe-LAFS is a free and open-source decentralized storage system that distributes encrypted, erasure-coded file shares across multiple unt… | 59 | 1443 | active |
| EgeBalci/amber Amber is a reflective PE packer that converts Windows PE files (EXE, DLL, SYS) into position-independent shellcode payloads for in-memory e… | 23 | 1443 | active |
| richardkiss/pycoin A Python library providing utilities for Bitcoin and Bitcoin-like altcoins, including key creation/parsing, BIP32 hierarchical deterministi… | 68 | 1441 | active |
| Algorand The official Go implementation of the Algorand blockchain protocol, including the algod node software and goal CLI tool. It lets users run … | 97 | 1438 | active |
| boku7/BokuLoader BokuLoader is a proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike written in C and assembly. It recreates, integrate… | 32 | 1438 | active |
| beakthoven/TrickyStoreOSS A fully open-source Magisk module that spoofs Android hardware keystore attestation, serving as a FOSS rewrite of the proprietary TrickySto… | 83 | 1437 | active |
| Isaacdelly/Plutus Plutus is a Python CLI tool that brute-forces Bitcoin private keys by generating sequential keys via elliptic curve point addition and chec… | 56 | 1437 | active |
| at_client_sdk The Dart implementation of the atSDK for building applications on the Atsign Platform, a protocol for personal data ownership and controlle… | 67 | 1434 | active |
| autoDecoder A Burp Suite extension (written in Java) that lets users plug in custom encryption/decryption logic so intercepted HTTP traffic can be view… | 68 | 1431 | active |
| rubyzip/rubyzip Rubyzip is a Ruby library (gem) for reading and writing zip archives, including support for AES encryption. It provides both high-level Zip… | 96 | 1429 | stable |
| Kianmhz/GooseRelayVPN A Go-based SOCKS5 VPN client that tunnels raw TCP traffic through Google Apps Script web apps to a user-controlled VPS exit server. Traffic… | 64 | 1429 | active |
| enarx/enarx Enarx is an open-source command-line tool and runtime for running applications inside hardware Trusted Execution Environments (TEEs) such a… | 48 | 1429 | active |
| Aiven-Open/pghoard PGHoard is a PostgreSQL backup daemon and restore tooling that continuously stores basebackups and WAL transaction logs in cloud object sto… | 90 | 1424 | active |
| cr-marcstevens/sha1collisiondetection A C library and command-line tool that computes SHA-1 hashes while detecting known cryptanalytic collision attacks against SHA-1 with proba… | 41 | 1420 | stable |
| Horcrux A Go CLI tool that splits a file into encrypted fragments using Shamir's Secret Sharing, requiring only a threshold of fragments to reconst… | 23 | 5105 | maintenance |
| rosenpass/rosenpass Rosenpass is a post-quantum-secure key exchange tool written in Rust that establishes symmetric keys and feeds them to WireGuard via its pr… | 82 | 1417 | active |
| bepaald/signalbackup-tools A C++ command-line tool for working with backup files generated by the Signal Android app. It can decrypt, inspect, export, merge, crop, an… | 94 | 1412 | active |
| PrimiHub PrimiHub is an open-source privacy-preserving computing platform built by a team of cryptography experts, supporting secure multi-party com… | 41 | 1409 | active |
| Noir Noir is a Rust-inspired domain-specific language for writing privacy-preserving programs that compile to zero-knowledge (SNARK) proofs via … | 96 | 1402 | active |
| cisco/libsrtp libSRTP is Cisco's open-source C library implementing the Secure Real-time Transport Protocol (SRTP, RFC 3711) along with a supporting cryp… | 87 | 1401 | stable |
| ZeusLN/zeus ZEUS is a self-custodial mobile Bitcoin and Lightning Network wallet built with React Native and TypeScript. It doubles as a remote node ma… | 100 | 1400 | active |
| PeculiarVentures/PKI.js PKI.js is a pure TypeScript library implementing the common formats and protocols used in PKI applications, including X.509 certificates, P… | 97 | 1399 | stable |
| Holochain Holochain is an open-source Rust framework for building peer-to-peer applications that run on users' own devices without centralized server… | 100 | 1396 | active |
| mrrfv/open-android-backup Open Android Backup is a shell script paired with a Flutter companion app that backs up Android devices over ADB without root, vendor lock-… | 79 | 1395 | active |
| libbitcoin/libbitcoin-system Libbitcoin System is a cross-platform C++ toolkit library for building Bitcoin applications, serving as the base library of the broader lib… | 68 | 1395 | active |