Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| iText iText is a high-performance PDF library/SDK for Java and .NET that lets developers create, manipulate, inspect, sign, and secure PDF docume… | 95 | 2260 | stable |
| loc567/loc567 loc567 is a fully open-source, free, purely web-based iOS mock location tool that works through Safari without a computer, jailbreak, or Tr… | 50 | 2260 | active |
| Wind4/vlmcsd vlmcsd is a KMS (Key Management Service) emulator written in C that can activate Windows and Microsoft Office products. It runs as a daemon… | 10 | 8830 | maintenance |
| gsliepen/tinc Tinc is a peer-to-peer VPN daemon that creates encrypted private networks over the Internet with automatic full-mesh routing and NAT traver… | 74 | 2256 | stable |
| Seaport Seaport is a Solidity-based marketplace protocol for safely and efficiently buying and selling NFTs, with listings composed of arbitrary of… | 64 | 2254 | active |
| neurobin/shc shc is a generic shell script compiler that converts shell scripts (bash, sh, zsh, ksh, etc.) into C source code, which is then compiled in… | 23 | 2251 | stable |
| salesforce/cloudsplaining Cloudsplaining is an AWS IAM security assessment tool that identifies violations of least privilege in IAM policies. It generates a risk-pr… | 83 | 2247 | active |
| Versent/saml2aws saml2aws is a Go CLI tool that authenticates against SAML-based identity providers such as ADFS and PingFederate and exchanges the SAML ass… | 43 | 2246 | active |
| julian-klode/dns66 DNS66 is an open-source Android app that blocks ads and malicious hosts by intercepting DNS queries through a local VPN service. It uses co… | 10 | 2246 | active |
| kismetwireless/kismet Kismet is a wireless network detector, sniffer, and intrusion detection system for Wi-Fi, Bluetooth, SDR, and other wireless protocols. It … | 77 | 2244 | active |
| e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 74 | 2243 | active |
| tdurieux/anonymous_github Anonymous GitHub is a proxy server that anonymizes GitHub repositories (owner, org, repo name, file names, and file contents) so researcher… | 76 | 2242 | active |
| baresip Baresip is a portable and modular SIP User-Agent written in C with audio and video call support. It provides a rich feature set including m… | 94 | 2240 | active |
| grimdoomer/Xbox360BadUpdate A non-persistent, software-only hypervisor exploit for the Xbox 360 that runs unsigned code on the latest dashboard (17559) using a support… | 10 | 2239 | active |
| AbsInt/CompCert CompCert is a formally verified C compiler whose correctness is machine-checked with the Coq proof assistant, guaranteeing generated assemb… | 85 | 2238 | active |
| asdcorp/ohook ohook is a C-written hook library that masquerades as the Office sppc.dll to intercept the SLGetLicensingStatusInformation license check, e… | 19 | 2237 | active |
| Ylarod/Florida Florida is an automatically patched, anti-detection build of frida-server for Android, tracking the upstream FRIDA project. It rebuilds fri… | 91 | 2236 | active |
| SysSec-KAIST/LTESniffer LTESniffer is an open-source LTE downlink/uplink eavesdropper built on FALCON and srsRAN that decodes PDCCH, PDSCH, and PUSCH channels to c… | 21 | 2234 | active |
| ToolHive ToolHive is an open-source platform for running, securing, and managing Model Context Protocol (MCP) servers. It wraps MCP servers in isola… | 81 | 2233 | active |
| GrapheneOS/Vanadium Vanadium is a privacy and security hardened variant of Chromium that serves as the standard browser and WebView provider on GrapheneOS. It … | 95 | 2231 | active |
| srvrco/getssl A Bash-based CLI tool for obtaining and automatically renewing free SSL/TLS certificates from the Let's Encrypt ACME server. It can deploy … | 93 | 2230 | active |
| martin-ger/esp32_nat_router Open-source firmware that turns an ESP32 into a WiFi NAT router and firewall, routing between an AP interface and a STA or Ethernet uplink.… | 77 | 2228 | active |
| lefayjey/linWinPwn linWinPwn is a bash script that wraps and streamlines a large set of Active Directory penetration testing tools such as impacket, bloodhoun… | 76 | 2228 | active |
| pen4uin/java-memshell-generator A highly customizable Java in-memory webshell (memshell) generator supporting multiple middleware servers, frameworks, shell types, and out… | 33 | 2228 | active |
| kimci86/bkcrack bkcrack is a command-line tool that cracks legacy ZIP encryption (ZipCrypto/PKWARE) using Biham and Kocher's known plaintext attack. Given … | 71 | 2223 | active |
| MatthewKuKanich/FindMyFlipper A FlipperZero application that turns the device into a BLE tracker beacon emulating Apple AirTags, Samsung SmartTags, or Tile trackers. It … | 19 | 2223 | active |
| punk-security/dnsReaper DNS Reaper is a Python CLI tool that scans DNS records for subdomain takeover vulnerabilities using over 50 signatures, at roughly 50 subdo… | 40 | 2221 | active |
| etherized/GenP GenP is a community tool used to patch Adobe desktop applications, and this repository is an unofficial Chinese-localized fork of it. It is… | 75 | 2220 | active |
| shwenzhang/AndResGuard AndResGuard is a tool from the WeChat team that obfuscates and shrinks Android APK resources, working like ProGuard but for resource files … | 23 | 8647 | maintenance |
| lkarlslund/Adalanche Adalanche is an open-source Active Directory attack graph visualizer and explorer written in Go. It collects data via LDAP and SYSVOL, anal… | 100 | 2217 | active |
| mandiant/flare-fakenet-ng FakeNet-NG is a dynamic network analysis tool that intercepts and redirects network traffic while simulating legitimate network services. I… | 60 | 2215 | active |
| login-securite/lsassy Lsassy is a Python CLI tool that remotely extracts credentials from the LSASS process memory of Windows hosts over the network. It uses imp… | 77 | 2214 | active |
| kaaass/ZerotierFix An unofficial ZeroTier Android client patched from the official app, adding features like self-hosted Moon support, custom planet configura… | 23 | 2214 | active |
| DigitalRuby/IPBan IPBan is a free, open-source security service that monitors failed login attempts from event logs and log files on Windows and Linux server… | 81 | 2212 | active |
| ZerBea/hcxdumptool hcxdumptool is a C-based command-line tool that captures packets from WLAN devices and runs layer 2 attacks against the WPA protocol to fin… | 76 | 2209 | active |
| ghostunnel/ghostunnel Ghostunnel is a simple TLS proxy written in Go that adds mutual TLS authentication in front of (or behind) non-TLS backend services, in cli… | 99 | 2208 | active |
| dchristl/macless-haystack Macless-Haystack is a self-hosted application that lets you build your own Apple FindMy network tracker using OpenHaystack-compatible hardw… | 72 | 2205 | active |
| AntiDebug_Breaker A Chrome browser extension built on the Hook_JS library that assists with JavaScript reverse engineering and penetration testing reconnaiss… | 83 | 2203 | active |
| qwj/python-proxy pproxy is a lightweight asynchronous tunnel proxy implemented in pure Python 3 asyncio, supporting HTTP, HTTP2, HTTP3/QUIC, SOCKS4/5, Shado… | 32 | 2203 | active |
| yandex/gixy Gixy is a Python-based static analyzer for Nginx configuration files that detects security misconfigurations and flaws. It ships as a CLI t… | 23 | 8565 | maintenance |
| m13253/dns-over-https A high-performance DNS-over-HTTPS (DoH) client and server written in Go, supporting both the Google DoH JSON API and IETF RFC 8484 wire for… | 74 | 2201 | active |
| hanmaoye/IDM-Activation-Script An open-source batch/PowerShell script that activates Internet Download Manager (IDM) or freezes its 30-day trial indefinitely using a regi… | 19 | 2200 | active |
| bytecode77/r77-rootkit r77 is a fileless ring 3 (userland) rootkit for Windows that hides files, processes, registry keys, services, and network connections using… | 71 | 2199 | active |
| fly8888/cursor_machine_id A cross-platform set of Python, shell, and batch scripts that reset the device/machine identifiers used by the Cursor editor to bypass devi… | 43 | 2199 | active |
| betterleaks/betterleaks Betterleaks is a fast, configurable secrets scanner for finding leaked credentials in git repositories, filesystems, and platforms like Git… | 82 | 2198 | active |
| pass-with-high-score/blockads-android BlockAds is a free, open-source Android app that blocks ads, trackers, and malware system-wide using local VPN-based DNS filtering, with no… | 83 | 2196 | active |
| lenucksi/aur-malware-check A Python CLI tool that detects compromised AUR packages from the June 2026 atomic-lockfile supply-chain attack and other historical campaig… | 51 | 2196 | active |
| dronesploit/dronesploit DroneSploit is a Metasploit-style console framework for pentesting commercial drones, built on sploitkit. It gathers drone-focused hacking … | 23 | 2194 | active |
| 0vercl0k/rp rp++ is a fast C++ command-line tool that finds ROP (Return-Oriented Programming) gadgets in PE, ELF, and Mach-O binaries for x86, x64, ARM… | 38 | 2193 | active |
| beelzebub-labs/beelzebub Beelzebub is an open-source deception runtime framework written in Go that deploys adaptive, LLM-powered honeypot decoy services across SSH… | 97 | 2192 | active |
| zmap/zgrab2 ZGrab2 is a fast, modular application-layer network scanner written in Go, designed for large Internet-wide surveys in tandem with ZMap. It… | 73 | 2190 | active |
| ovh/the-bastion The Bastion is a self-hosted SSH bastion/gateway that acts as the single entry point for operational teams to access infrastructure devices… | 84 | 2189 | stable |
| HomeSpan/HomeSpan HomeSpan is an Arduino library for building custom Apple HomeKit accessories on ESP32 microcontrollers, implementing the HAP-R2 protocol di… | 84 | 2188 | active |
| jwt-dotnet/jwt Jwt.Net is a C# library for generating, encoding, decoding, and validating JSON Web Tokens (JWT) per RFC 7519. It includes fluent builder A… | 83 | 2187 | stable |
| ranisalt/node-argon2 Node.js bindings to the reference Argon2 password-hashing implementation, supporting Argon2i, Argon2d, and Argon2id. It provides a simple a… | 88 | 2185 | stable |
| NeilFraser/JS-Interpreter A sandboxed JavaScript interpreter written in JavaScript that executes arbitrary ES5 code in isolation and safety. It supports line-by-line… | 68 | 2185 | active |
| Harry24k/adversarial-attacks-pytorch Torchattacks is a PyTorch library providing implementations of adversarial attacks to generate adversarial examples against deep learning m… | 23 | 2185 | active |
| safe-fndn/safe-smart-account Safe Smart Account is the set of audited Solidity smart contracts implementing Safe's multisig smart account (contract wallet) for Ethereum… | 66 | 2181 | active |
| Capsule Capsule is a Kubernetes Operator that turns a single cluster into a shared multi-tenant platform by grouping namespaces into Tenant abstrac… | 96 | 2179 | active |
| Jar Analyzer A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysi… | 90 | 2179 | active |
| j-hc/zygisk-detach A Zygisk module for rooted Android devices that detaches installed apps from the Play Store by hooking libbinder, preventing Play Store fro… | 89 | 2175 | active |
| alexbers/mtprotoproxy A fast, async MTProto proxy server for Telegram written in Python, deployable via Docker or directly. It supports channel advertising via M… | 67 | 2174 | stable |
| Canarytokens Canarytokens is a self-hostable service by Thinkst that generates tripwire tokens (URLs, DNS names, AWS keys, files, etc.) which alert you … | 76 | 2171 | active |
| microsoft/SysmonForLinux Sysmon for Linux is a Sysinternals tool that monitors and logs system activity such as process lifetime, network connections, and file syst… | 93 | 2170 | active |
| salesforce/policy_sentry Policy Sentry is a Python CLI tool and library that generates least-privilege AWS IAM policies. It automates writing security-conscious IAM… | 82 | 2170 | stable |
| LukeSmithxyz/emailwiz A shell script that automates installing and configuring a full email server on Debian/Ubuntu using Postfix, Dovecot, Spamassassin, OpenDKI… | 77 | 2170 | active |
| vulhub/java-chains Java Chains is a self-hosted web platform for generating Java exploitation payloads, aimed at security researchers. It supports common Java… | 83 | 2166 | active |
| mcu-tools/mcuboot MCUboot is a secure bootloader for 32-bit microcontrollers that defines common infrastructure for bootloaders and flash layout, enabling se… | 79 | 2166 | stable |
| ffffffff0x/f8x f8x is a Bash-based automation deployment script that installs 100+ security and development tools for red team, blue team, CTF, and cloud-… | 67 | 2166 | active |
| BishopFox/unredacter Unredacter is an Electron-based desktop tool that demonstrates how pixelated redactions in images can be reversed by brute-force guessing t… | 32 | 8398 | maintenance |
| zhzyker/dismap Dismap is a Go-based asset discovery and identification tool that fingerprints web, TCP, UDP, and TLS services using a rule base of 4500+ w… | 23 | 2165 | active |
| 0Chencc/CTFCrackTools CTFCrackTools X is a cross-platform desktop CTF toolkit built with Rust and Tauri, featuring a visual node-based workflow for composing enc… | 74 | 2164 | active |
| p4gefau1t/trojan-go Trojan-Go is a full-featured Trojan proxy written in Go that disguises proxy traffic as normal TLS traffic to bypass censorship systems lik… | 23 | 8387 | maintenance |
| SkyBlue997/enableMacosAI A shell-based installer plus a minimal macOS kernel extension (kext) that spoofs the device region code in IORegistry from CH/A to LL/A, un… | 56 | 2161 | active |
| Ropper Ropper is a Python CLI tool that displays information about binary files (ELF, PE, Mach-O, RAW) and finds ROP/JOP gadgets to build exploit … | 73 | 2152 | active |
| bit4woo/domain_hunter_pro Domain Hunter Pro is a Burp Suite plugin (Java jar) for automated domain and subdomain collection, web title fetching, and target managemen… | 67 | 2151 | active |
| sparrowwallet/sparrow Sparrow is a free, open-source desktop Bitcoin wallet application built in Java with a focus on security, privacy, and transparency. It sup… | 97 | 2150 | active |
| last-byte/PersistenceSniper PersistenceSniper is a PowerShell module for hunting persistence mechanisms implanted in Windows machines. It is aimed at Blue Teams, Incid… | 34 | 2145 | active |
| TrustKit TrustKit is an open-source Objective-C framework that simplifies deploying SSL public key pinning and reporting in iOS, macOS, tvOS, and wa… | 74 | 2144 | active |
| PowerShell/Win32-OpenSSH A Win32 port of OpenSSH for Windows, now serving as a release and issue tracker plus wiki for the project. Active development has moved to … | 71 | 8291 | maintenance |
| chainreactors/gogo gogo is a high-performance, highly configurable automated scanning engine written in pure Go for red team operations. It combines port scan… | 85 | 2141 | active |
| a13xp0p0v/kernel-hardening-checker A Python CLI tool that checks the security hardening options of the Linux kernel across Kconfig options, boot command line arguments, and s… | 75 | 2140 | active |
| fortra/nanodump NanoDump is a C-based tool that creates minidumps of the Windows LSASS process using a variety of stealthy handle-acquisition and dumping t… | 32 | 2140 | active |
| vvb2060/KeyAttestation An Android app for generating, parsing, and verifying Android key and ID attestation data. It performs self-testing locally with no network… | 39 | 2137 | active |
| phra/PEzor PEzor is an open-source shellcode and PE packer that wraps executables or raw shellcode into new binaries with evasion features like unhook… | 32 | 2136 | active |
| PoshC2 PoshC2 is a proxy-aware Command and Control (C2) framework written in Python3 that aids penetration testers with red teaming, post-exploita… | 43 | 2135 | active |
| uBlock-LLC/uBlock uBlock is a fast, lightweight browser extension that blocks ads, pop-ups, and trackers in Chrome, Firefox, Safari, Edge, and Opera. It emph… | 10 | 8248 | maintenance |
| teddysun/shadowsocks_install A collection of shell scripts that automatically install and configure Shadowsocks and ShadowsocksR proxy servers (Python, libev, and Go va… | 60 | 8244 | maintenance |
| Ibex RISC-V Core Ibex is a production-quality, open-source 32-bit RISC-V CPU core written in SystemVerilog, originally developed as 'Zero-riscy' in the PULP… | 77 | 2126 | active |
| znc/znc ZNC is an advanced IRC bouncer (BNC) that stays connected to IRC networks so clients can disconnect and reconnect without losing chat histo… | 76 | 2126 | stable |
| brightio/penelope Penelope is a modern reverse shell handler for penetration testers and CTF players, serving as a more capable alternative to basic netcat l… | 87 | 2125 | active |
| haccer/subjack Subjack is a DNS takeover scanner written in Go that concurrently scans lists of subdomains to identify ones vulnerable to hijacking. It de… | 91 | 2123 | active |
| Trail of Bits Claude Code Config A Claude Code plugin marketplace from Trail of Bits offering skills for AI-assisted security analysis, code auditing, and vulnerability det… | 57 | 2120 | active |
| smartwalle/alipay A Go SDK for integrating with the Alipay payment platform, supporting both public key certificate and plain public key signing/verification… | 71 | 2116 | active |
| eugene1g/agent-safehouse Agent Safehouse is a macOS-native sandboxing tool that runs local LLM coding agents (Claude Code, Codex, Gemini CLI, Aider, etc.) inside a … | 81 | 2115 | active |
| bulianglin/demo A collection of shell scripts and auxiliary files accompanying the 'bulianglin' (不良林) YouTube channel's tutorials on VPN and proxy tools, i… | 81 | 2114 | active |
| hannob/snallygaster Snallygaster is a Python command-line scanner that probes HTTP servers for files that should not be publicly accessible, such as exposed gi… | 67 | 2114 | active |
| Btlejack BtleJack is a Python CLI tool for sniffing, jamming, and hijacking Bluetooth Low Energy (BLE) connections. It relies on BBC Micro:Bit, Blue… | 23 | 2113 | active |
| topjohnwu/libsu libsu is an Android library providing a complete solution for apps that need root (superuser) permissions. It wraps the Unix root shell pro… | 52 | 2112 | active |
| defparam/smuggler Smuggler is a Python 3 command-line tool that tests web servers and proxies for HTTP request smuggling and desync vulnerabilities. It fires… | 32 | 2112 | active |