Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| paragonie/random_compat A PHP 5.x polyfill providing the random_bytes() and random_int() CSPRNG functions that were introduced in PHP 7. It fails with an exception… | 50 | 8151 | maintenance |
| afaa1991/BetterWX-UI A Windows desktop utility that patches WeChat, WeCom, DingTalk, and Douyin chat clients to allow running multiple instances simultaneously,… | 52 | 2110 | active |
| meetrevision/playbook ReviOS Playbook is a collection of Windows system modifications applied via AME Wizard to create a lightweight, privacy-focused, performanc… | 86 | 2108 | active |
| al0ne/LinuxCheck A shell-based Linux emergency response and information gathering tool that performs 70+ security checks across 13 categories, including roo… | 23 | 2106 | active |
| sleep3r/mtproto.zig A tiny, dependency-free MTProto proxy written in Zig that disguises Telegram traffic as standard TLS 1.3 HTTPS traffic. It is designed for … | 75 | 2103 | active |
| thoughtworks/talisman Talisman is a Go-based CLI tool that installs a git pre-commit/pre-push hook to scan outgoing changesets for potential secrets such as toke… | 61 | 2099 | active |
| authgear/authgear-server Authgear is an open-source customer identity and access management (CIAM) platform serving as a self-hostable alternative to Auth0, Clerk, … | 98 | 2098 | active |
| oss-review-toolkit/ort The OSS Review Toolkit (ORT) is a FOSS policy automation toolkit that analyzes project dependencies, scans licenses and copyrights, checks … | 94 | 2098 | active |
| hanc00l/nemo_go Nemo is an automated information-gathering platform for penetration testing that integrates common recon tools (Masscan, Nmap, Subfinder, H… | 82 | 2098 | active |
| CorentinTh/enclosed Enclosed is a minimalistic self-hostable web application for sharing end-to-end encrypted notes and file attachments. Notes are encrypted c… | 69 | 2096 | active |
| Sh1Yo/x8 x8 is a hidden parameter discovery suite written in Rust for security testing of web applications. It brute-forces parameter names against … | 23 | 2096 | active |
| 520coding/confuse A Mac application that performs source-to-source obfuscation of iOS projects, simulating human-style renaming with context awareness includ… | 83 | 2090 | active |
| SBOM Tool Microsoft's SBOM Tool is a scalable, enterprise-ready CLI that generates SPDX 2.2 and SPDX 3.0 compatible Software Bill of Materials docume… | 77 | 2088 | active |
| pivpn/pivpn PiVPN is a set of shell scripts that turn a Raspberry Pi or any Debian/Ubuntu server into a WireGuard or OpenVPN VPN server with a one-comm… | 75 | 8044 | maintenance |
| rebootuser/LinEnum LinEnum is a shell script that performs scripted local Linux enumeration and privilege escalation checks. It gathers system, user, network,… | 32 | 8039 | maintenance |
| OpenPubkey opkssh is a Go CLI tool that enables SSH authentication via OpenID Connect identities instead of long-lived SSH keys. It generates SSH publ… | 88 | 2083 | active |
| iPXE iPXE is the leading open source network boot firmware, providing a full PXE implementation enhanced with features like booting from HTTP/HT… | 76 | 2083 | active |
| TrianguloY/URLCheck URLCheck is an open-source Android app that acts as an intermediary when opening URLs, letting users inspect, clean, and modify links befor… | 83 | 2082 | active |
| SamueleAmato/sosec sosec is a Python command-line toolkit with a terminal UI for automated credential testing and HTTP request orchestration against social me… | 57 | 2082 | active |
| mandiant/speakeasy Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows ru… | 79 | 2081 | active |
| lasting-yang/frida_dump A collection of Frida scripts for dumping DEX files and native shared libraries (.so) from running Android processes. It includes SoFixer-b… | 45 | 2081 | active |
| someengineering/fixinventory Fix Inventory is an open-source cloud asset inventory and security tool that collects metadata from cloud providers (AWS, GCP, Azure, Digit… | 52 | 2078 | active |
| erocarrera/pefile pefile is a multi-platform Python module for parsing and working with Portable Executable (PE) files such as EXE and DLL binaries. It expos… | 67 | 2076 | stable |
| kaikramer/keystore-explorer KeyStore Explorer is a free, open-source Java desktop application that provides a graphical interface replacing the keytool and jarsigner c… | 86 | 2071 | active |
| redballoonsecurity/ofrak OFRAK is a binary analysis and modification platform that identifies, unpacks, analyzes, modifies, and repacks binaries, with first-class s… | 63 | 2070 | active |
| haad/proxychains ProxyChains is a UNIX command-line tool that forces TCP connections and DNS lookups of any dynamically linked program through SOCKS4/5 or H… | 32 | 7964 | maintenance |
| lukechilds/reverse-shell A hosted service (reverse-shell.sh) that generates reverse shell payloads on demand; piping its URL output into sh on a target spawns a she… | 59 | 2069 | active |
| w2016561536/android_virtual_cam An Xposed module for Android that replaces the camera feed of target apps with a custom video or image. It hooks camera APIs so apps receiv… | 23 | 2068 | active |
| CYB3RMX/Qu1cksc0pe Qu1cksc0pe is an all-in-one malware analysis tool that statically and dynamically analyzes many file types, including Windows/Linux/macOS e… | 75 | 2067 | active |
| SAP/macOS-enterprise-privileges Privileges is a free macOS application from SAP that lets enterprise users temporarily elevate their accounts to administrator rights for a… | 92 | 2065 | active |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 86 | 2063 | active |
| pixelspark/sushitrain Sushitrain is an open-source iOS and macOS app that brings Syncthing-based secure file synchronization to Apple devices, built with a Go co… | 82 | 2062 | active |
| cifertech/nRFBox nRFBox is an open-source ESP32-based handheld tool that scans, analyzes, jams, and spoofs BLE, Wi-Fi, and 2.4GHz signals using an nRF24L01 … | 69 | 2060 | active |
| garywill/linux-router A single-file bash script that turns a Linux machine into a router in one command, wrapping iptables, dnsmasq, and related tools. It suppor… | 76 | 2058 | active |
| canonical/snapd snapd is the background daemon and snap CLI tool that manages snap packages on Linux systems, handling installation, updates, confinement, … | 98 | 2055 | stable |
| ine-labs/AWSGoat AWSGoat is a deliberately vulnerable AWS infrastructure deployed via Terraform, featuring OWASP Top 10 web vulnerabilities and cloud miscon… | 39 | 2055 | active |
| jtsylve/LiME LiME (Linux Memory Extractor) is a loadable kernel module that acquires volatile memory from Linux and Android devices, writing captures to… | 74 | 2050 | active |
| Sergeydigl3/zapret-discord-youtube-linux A plug-and-play Linux shell script adapter that ports Flowseal's zapret-discord-youtube and bol-van's zapret for bypassing DPI-based thrott… | 73 | 2049 | active |
| GhostPack/Certify Certify is a C# command-line tool for enumerating and abusing misconfigurations in Active Directory Certificate Services (AD CS). It was re… | 76 | 2044 | active |
| sipt/shuttle Shuttle is a cross-platform network proxy tool written in Go supporting SOCKS5, SOCKS5 over TLS, and shadowsocks protocols. It offers rule-… | 44 | 2044 | active |
| berdav/CVE-2021-4034 A proof-of-concept exploit and vulnerability checker for CVE-2021-4034 (PwnKit), a polkit pkexec local privilege escalation vulnerability i… | 32 | 2044 | stable |
| lirantal/is-website-vulnerable A Node.js CLI tool that scans a website's frontend JavaScript libraries for publicly known security vulnerabilities using the Snyk database… | 91 | 2043 | active |
| jdx/aube aube is a fast Node.js package manager written in Rust that auto-installs dependencies when you run scripts, with secure defaults like a li… | 78 | 2041 | active |
| pgkt04/defender-control An open-source Windows utility that permanently disables or re-enables Windows Defender by running as TrustedInstaller, setting disabling p… | 74 | 2040 | active |
| shivaya-dav/DogeRat DogeRat is a Telegram-controlled Android remote access tool (RAT) consisting of a Node.js/Express/Socket.IO server and a Kotlin Android APK… | 39 | 2038 | active |
| tensorflow/privacy TensorFlow Privacy is a Python library providing TensorFlow optimizers for training machine learning models with differential privacy. It i… | 64 | 2036 | active |
| jkroepke/helm-secrets helm-secrets is a Helm plugin that transparently encrypts and decrypts Helm value files using sops, allowing secrets to be safely stored in… | 99 | 2033 | active |
| GrapheneOS/hardened_malloc hardened_malloc is a security-focused general purpose memory allocator implementing the malloc API with extensive hardening against heap co… | 75 | 2029 | active |
| daymade/Twitter-Block-Porn A Tampermonkey/Greasemonkey userscript that batch-blocks Twitter/X accounts from shared blocklists of porn-spam scammers. It simulates Twit… | 74 | 2029 | active |
| hyperion-cs/dpi-checkers A collection of checkers (a comprehensive Go-based DPI-CH tool plus browser-based checkers) that detect whether an ISP or datacenter applie… | 83 | 2027 | active |
| sc0tfree/mentalist Mentalist is a graphical Python tool for generating custom password wordlists based on common human password-construction patterns. It can … | 57 | 2027 | active |
| Tencent/soter TENCENT SOTER is a biometric authentication standard and platform for Android, developed by Tencent and used in WeChat fingerprint payment.… | 47 | 2027 | active |
| Evil Limiter A Python command-line tool that monitors, analyzes, and limits the bandwidth of devices on a local network using ARP spoofing and traffic s… | 52 | 2025 | active |
| chris2511/xca XCA is a cross-platform desktop GUI application for creating and managing X.509 certificates, certificate requests, RSA/DSA/EC private keys… | 62 | 2020 | active |
| attr-encrypted/attr_encrypted A Ruby gem that generates attr_accessors which transparently encrypt and decrypt attributes on any Ruby class. It integrates with ActiveRec… | 40 | 2017 | active |
| wyzxxz/jndi_tool A Java-based JNDI exploitation tool that runs malicious RMI/LDAP reference servers to test and exploit JNDI injection vulnerabilities, incl… | 32 | 2017 | active |
| Cookie-AutoDelete/Cookie-AutoDelete A Firefox, Chrome, and Edge WebExtension that automatically deletes cookies and other browsing site data when a tab closes, the domain chan… | 46 | 2016 | active |
| endrazine/wcc The Witchcraft Compiler Collection (WCC) is a set of compilation tools for performing binary manipulation on ELF executables across POSIX p… | 83 | 2014 | active |
| trycompai/comp Comp AI is an open-source, AI-native compliance platform that automates evidence collection, policy generation, and continuous monitoring f… | 80 | 2013 | active |
| Google2FA A PHP library implementing Google-compatible two-factor authentication via HMAC-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-… | 63 | 2009 | stable |
| ggshield ggshield is a CLI application from GitGuardian that detects over 500 types of hardcoded secrets in files, git history, and CI environments … | 98 | 2006 | active |
| ambethia/recaptcha A Ruby gem providing helper methods for Google's reCAPTCHA API, supporting v2 checkbox, invisible, and v3 score-based verification. It offe… | 68 | 2006 | stable |
| EgeBalci/sgn SGN is a polymorphic binary encoder that encodes shellcode using an additive feedback loop similar to an LFSR, producing statically undetec… | 85 | 2005 | active |
| msoedov/agentic_security Agentic Security is an open-source LLM vulnerability scanner and AI red-teaming toolkit that probes large language models and agent workflo… | 83 | 2004 | active |
| FouadRaheb/Watusi-for-WhatsApp Watusi is an all-in-one tweak for WhatsApp Messenger on iOS, distributed as a jailbreak package or pre-patched sideloadable IPA files. It a… | 76 | 2001 | active |
| mashirozx/Pixiv-Nginx A fork of nginx preconfigured with reverse-proxy configs, TLS certificates, and hosts entries to restore access to Pixiv from networks wher… | 55 | 2001 | active |
| gin-contrib/cors The official CORS (Cross-Origin Resource Sharing) middleware for the Gin web framework in Go. It provides configurable handling of allowed … | 93 | 2000 | stable |
| pyupio/safety Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local de… | 89 | 1996 | active |
| mfontanini/libtins libtins is a high-level, multiplatform C++ library for network packet sniffing, parsing, and crafting. It provides an efficient, endianness… | 80 | 1994 | stable |
| bcrypt-ruby/bcrypt-ruby bcrypt-ruby is a Ruby binding to the OpenBSD bcrypt() password hashing algorithm, provided as a gem with a native C extension. It lets deve… | 76 | 1994 | stable |
| i12bp8/TagTinker TagTinker is a Flipper Zero application for researching infrared electronic shelf label (ESL) protocols, letting users transmit custom imag… | 58 | 1992 | active |
| hBlock hBlock is a POSIX-compliant shell script that aggregates domains serving ads, trackers, and malware from multiple blocklist sources and gen… | 62 | 1991 | active |
| t6x/reaver-wps-fork-t6x Reaver is a C-based command-line tool that performs brute force attacks against Wi-Fi Protected Setup (WPS) registrar PINs to recover WPA/W… | 41 | 1991 | active |
| libimobiledevice/idevicerestore A cross-platform command-line application that restores or upgrades firmware (IPSW files) on iOS devices, reimplementing all granular resto… | 67 | 1990 | active |
| hfiref0x/WinObjEx64 WinObjEx64 is a 64-bit Windows utility for exploring the Windows Object Manager namespace, viewing detailed object properties, structure du… | 86 | 1986 | active |
| ys1231/MoveCertificate A Magisk/KernelSU/APatch root module that moves user-installed certificates into Android's system CA store, supporting Android 7 through 16… | 94 | 1984 | active |
| Apptainer Apptainer (formerly Singularity) is an open-source container platform designed for secure, portable, and reproducible containers on shared … | 93 | 1984 | active |
| cake-tech/cake_wallet Cake Wallet is an open-source, noncustodial multi-currency cryptocurrency wallet supporting Monero, Bitcoin, Ethereum, Litecoin, Solana, an… | 100 | 1983 | active |
| manfredsteyer/angular-oauth2-oidc A TypeScript library adding OAuth 2, OAuth 2.1, and OpenID Connect support to Angular applications. It handles token issuance, validation, … | 86 | 1983 | stable |
| 1Password/for-open-source 1Password for Open Source is a program that grants eligible open source projects a free 1Password Teams account for securely storing and sh… | 67 | 1982 | active |
| mewebstudio/Purifier A Laravel service provider that wraps the HTMLPurifier library for sanitizing HTML input. It provides a simple clean() helper and Purifier … | 69 | 1980 | stable |
| cossacklabs/themis Themis is a cross-platform, high-level cryptographic library providing ready-made building blocks for secure data storage, encrypted messag… | 69 | 1978 | stable |
| anthropics/defending-code-reference-harness A reference implementation from Anthropic for autonomous vulnerability discovery and remediation using Claude, including Claude Code skills… | 54 | 7548 | maintenance |
| dswd/vpncloud VpnCloud is a high-performance peer-to-peer mesh VPN written in Rust that runs over UDP with strong end-to-end encryption (Curve25519 and A… | 23 | 1977 | stable |
| dromara/MaxKey MaxKey is an open-source IAM/IDaaS product providing Single Sign-On (SSO), identity management, and RBAC-based access control. It supports … | 96 | 1974 | active |
| MichaelGrafnetter/DSInternals DSInternals is a PowerShell module and .NET framework for working with Active Directory internals, including offline NTDS.DIT database pars… | 93 | 1970 | active |
| bit4woo/knife Knife is a Burp Suite extension written in Java that adds useful right-click context menu functions to improve penetration testing workflow… | 67 | 1970 | active |
| rsc/2fa A command-line two-factor authentication agent written in Go that stores TOTP and HOTP keys and generates one-time authentication codes. Ke… | 32 | 1970 | stable |
| Ragnt/AngryOxide AngryOxide is an 802.11 WiFi attack tool written in Rust that provides a single-interface survey capability with automated attacks to captu… | 66 | 1967 | active |
| Jailhouse Jailhouse is a Linux-based partitioning hypervisor that splits hardware resources into isolated cells running bare-metal applications or ad… | 32 | 1967 | stable |
| zs1083339604/FaceWinUnlock-Tauri A Windows face-recognition unlock application built with Tauri, Vue 3, and OpenCV that injects a custom Credential Provider DLL into the Wi… | 82 | 1962 | active |
| guofei9987/text_blind_watermark A Python library that embeds invisible blind watermarks into plain text without changing its appearance or readability, using a password-pr… | 37 | 1960 | active |
| Azure/Microsoft-Defender-for-Cloud The official Microsoft Defender for Cloud community repository containing PowerShell scripts, Azure Policy definitions, Logic App templates… | 76 | 1959 | active |
| RustSec RustSec is the Rust ecosystem's security advisory database plus a workspace of tooling crates, including the rustsec client library, cargo-… | 97 | 1956 | stable |
| owtf/owtf OWASP OWTF (Offensive Web Testing Framework) is a penetration testing framework that unites multiple security tools and aligns testing work… | 83 | 1956 | active |
| intruder-io/autoswagger Autoswagger is a Python command-line tool that discovers Swagger/OpenAPI specifications, parses their endpoints, and automatically tests th… | 31 | 1956 | active |
| black-ant/Ant-Browser Ant Browser is a desktop anti-detect (fingerprint) browser for managing multiple isolated browser profiles, each with its own proxy binding… | 75 | 1955 | active |
| autoDecoder A modified version of the captcha-killer Burp Suite extension that intercepts captcha images from HTTP responses and recognizes them using … | 36 | 1954 | active |
| ipwndfu ipwndfu is an open-source Python tool that exploits iOS device bootroms, most notably via the checkm8 exploit, to put devices into pwned DF… | 32 | 7430 | maintenance |
| de4dot/de4dot de4dot is an open-source .NET deobfuscator and unpacker written in C# that restores packed and obfuscated .NET assemblies to near-original … | 10 | 7429 | maintenance |