Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| slackhq/nebula Nebula is a scalable overlay networking tool (mesh VPN) built on the Noise Protocol Framework, using certificates and security groups for m… | 93 | 18399 | stable |
| auth0/node-jsonwebtoken A Node.js library implementing JSON Web Tokens (JWT) per RFC 7519, supporting signing and verification with HMAC, RSA, and ECDSA algorithms… | 69 | 18183 | stable |
| NVIDIA/SkillSpector SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnera… | 79 | 18115 | active |
| cure53/DOMPurify DOMPurify is a fast, DOM-only XSS sanitizer for HTML, MathML and SVG that removes malicious markup while allowing safe content. It works in… | 98 | 17450 | stable |
| zhishile/codex-auth-helper A Chrome (Manifest V3) browser extension that extracts a logged-in ChatGPT session locally and generates a Codex-compatible auth. credentia… | 54 | 17403 | active |
| Wazuh Wazuh is a free, open source security platform that unifies XDR and SIEM capabilities for threat prevention, detection, and response across… | 98 | 17197 | stable |
| goproxy GoProxy is a high-performance, cross-platform proxy server written in Go supporting HTTP(S), SOCKS5, SS, WebSocket, TCP, UDP, and DNS proxy… | 88 | 17142 | active |
| ZPhisher Zphisher is a beginner-friendly, automated phishing toolkit written in Bash with 30+ ready-made login page templates. It supports multiple … | 23 | 17031 | active |
| Semgrep Semgrep is a fast, open-source static analysis tool that searches code, finds bugs, and enforces secure coding standards using rules that l… | 95 | 16978 | active |
| Hyperledger Fabric Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework written in Go for building blockchain solutions and app… | 93 | 16743 | stable |
| MatrixTM/MHDDoS MHDDoS is a Python 3 command-line DDoS attack script offering 57 flood methods across Layer 7 (HTTP) and Layer 4 (TCP/UDP), including bypas… | 86 | 16730 | active |
| flipperdevices/flipperzero-firmware The official open-source firmware for the Flipper Zero, a portable multi-tool device for interacting with access control systems. It implem… | 79 | 16718 | active |
| Zephyr RTOS Zephyr is a scalable, secure, real-time operating system (RTOS) designed for resource-constrained embedded devices across multiple hardware… | 91 | 16683 | stable |
| jpillora/chisel Chisel is a fast TCP/UDP tunnel transported over HTTP and secured via SSH, shipped as a single Go executable containing both client and ser… | 93 | 16662 | active |
| redox-os/redox Redox is a full-featured Unix-like operating system written in Rust with a microkernel architecture, inspired by seL4, MINIX, Plan 9, Linux… | 66 | 16594 | active |
| Lynis Lynis is an open-source security auditing and hardening tool for UNIX-based systems including Linux, macOS, and BSD. It performs in-depth l… | 83 | 16450 | stable |
| yonggekkk/Cloudflare-vless-trojan A set of Cloudflare Workers/Pages proxy scripts supporting Vless-ws(tls) and Trojan-ws(tls) nodes, plus a local Socks5/HTTP proxy script wi… | 62 | 16415 | active |
| JavaScript Obfuscator A powerful open-source JavaScript and Node.js obfuscator that transforms readable source code into hard-to-reverse-engineer output using id… | 98 | 16309 | active |
| Cryptomator Cryptomator is an open-source desktop and mobile application that provides transparent client-side encryption for files stored in any cloud… | 94 | 16282 | stable |
| System Informer System Informer (formerly Process Hacker) is a free, open-source, multi-purpose Windows tool for monitoring system resources, debugging sof… | 86 | 16265 | active |
| fortra/impacket Impacket is a collection of Python classes for low-level programmatic access to network protocols, including full implementations of SMB1-3… | 79 | 16168 | active |
| angristan/openvpn-install A Bash script that installs and manages a self-hosted OpenVPN VPN server on many Linux distributions. It handles client certificate generat… | 76 | 16155 | active |
| cloudflare/cloudflared cloudflared is the command-line client and daemon for Cloudflare Tunnel, which creates outbound-only connections from your origin servers t… | 98 | 16080 | stable |
| opensandbox-group/OpenSandbox OpenSandbox is a general-purpose sandbox platform for AI applications that securely runs commands, code interpreters, browsers, and develop… | 80 | 15952 | active |
| Zed Attack Proxy (ZAP) Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source web application security scanner used for finding vulnerabilities in web apps du… | 74 | 15865 | stable |
| Evilginx Evilginx is a standalone man-in-the-middle attack framework written in Go that proxies traffic between a victim's browser and a legitimate … | 58 | 15743 | active |
| Lakr233/vphone-cli A Swift CLI tool that boots virtual iPhone instances on Apple Silicon Macs using Apple's Virtualization.framework and PCC research VM infra… | 83 | 15734 | active |
| facebook/infer Infer is a static analysis tool, written in OCaml, that detects bugs in Java, C, C++, Objective-C, and Erlang code before it ships. It inte… | 80 | 15722 | active |
| Karing Karing is a free, cross-platform proxy utility built with Flutter that serves as a GUI for a modified sing-box core. It supports Clash, V2r… | 93 | 15593 | active |
| OpenCore OpenCore is a UEFI bootloader for booting macOS (Hackintosh) and other operating systems on PC hardware, with an accompanying UEFI developm… | 89 | 15505 | active |
| eCapture eCapture is an eBPF-based CLI tool that captures SSL/TLS plaintext traffic without needing CA certificates, supporting OpenSSL, LibreSSL, B… | 99 | 15501 | active |
| documenso/documenso Documenso is an open-source, self-hostable alternative to DocuSign for digitally signing documents, built with Next.js, TypeScript, and Pos… | 99 | 15463 | active |
| amnezia-vpn/amnezia-client Amnezia VPN is an open-source, cross-platform VPN client (desktop and mobile) that can automatically deploy a self-hosted VPN server on you… | 93 | 15351 | active |
| trustedsec/social-engineer-toolkit The Social-Engineer Toolkit (SET) is an open-source Python-based penetration testing framework for authorized social-engineering assessment… | 67 | 15346 | active |
| Amass OWASP Amass is a Go-based framework for in-depth attack surface mapping and external asset discovery using OSINT gathering and active recon… | 75 | 15211 | active |
| CrowdSec CrowdSec is an open-source, crowdsourced security engine that analyzes logs and HTTP requests to detect malicious behavior and block offend… | 93 | 15138 | stable |
| mvt-project/mvt Mobile Verification Toolkit (MVT) is a Python command-line toolkit for conducting forensic analysis of Android and iOS devices to detect tr… | 97 | 14938 | active |
| xcanwin/KeepChatGPT KeepChatGPT is a userscript/browser plugin that enhances ChatGPT's data security and usability. It keeps sessions alive, blocks tracking, d… | 69 | 14898 | active |
| Stalwart Mail & Collaboration Server Stalwart is an open-source, all-in-one mail and collaboration server written in Rust, supporting JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV a… | 96 | 14870 | active |
| Prowler Prowler is an open-source cloud security platform that performs security best-practice assessments, audits, continuous monitoring, hardenin… | 93 | 14863 | active |
| maurosoria/dirsearch dirsearch is an advanced web path scanner that brute-forces directories and files on web servers using wordlists. It is a Python CLI tool w… | 84 | 14811 | active |
| guofei9987/blind_watermark A Python library for embedding and extracting blind (invisible) watermarks in images using DWT-DCT-SVD transforms, with watermark recovery … | 52 | 14809 | stable |
| OpenVPN/openvpn OpenVPN is an open-source VPN daemon that creates secure point-to-point or site-to-site TLS-encrypted tunnels over the network. It is a mat… | 97 | 14605 | stable |
| shadow1ng/fscan Fscan is a comprehensive intranet scanning tool written in Go that automates host discovery, port scanning, service identification, weak-pa… | 91 | 14590 | active |
| moonD4rk/HackBrowserData HackBrowserData is a self-contained Go CLI that extracts and decrypts browser data (passwords, cookies, history, bookmarks, credit cards, d… | 86 | 14545 | active |
| mobile-shell/mosh Mosh is a remote terminal application that replaces interactive SSH sessions with a UDP-based protocol that survives roaming, IP changes, s… | 52 | 14505 | stable |
| altstoreio/AltStore AltStore is an open-source alternative app store for non-jailbroken iOS devices that lets users sideload .ipa apps with just their Apple ID… | 86 | 14501 | active |
| projectdiscovery/subfinder Subfinder is a fast, passive subdomain discovery tool written in Go that enumerates valid subdomains for target domains using online passiv… | 91 | 14500 | active |
| coturn coturn is a free open-source implementation of TURN and STUN servers written in C, serving as a VoIP/WebRTC media traffic NAT traversal ser… | 97 | 14474 | stable |
| ReFirmLabs/binwalk Binwalk is a fast firmware analysis tool rewritten in Rust that identifies and optionally extracts files and data embedded inside other fil… | 63 | 14370 | active |
| gophish/gophish Gophish is an open-source phishing framework for running phishing simulations and security awareness training. It provides a web UI and RES… | 23 | 14317 | stable |
| rathole-org/rathole rathole is a lightweight, high-performance reverse proxy for NAT traversal written in Rust, exposing services behind NAT to the internet vi… | 82 | 14260 | stable |
| OJ/gobuster Gobuster is a fast, multi-threaded brute-forcing tool written in Go for enumerating web directories/files, DNS subdomains, virtual hosts, c… | 76 | 14150 | active |
| evilsocket/opensnitch OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch, intercepting and filtering outbound connections per a… | 73 | 14149 | active |
| OWASP Juice Shop OWASP Juice Shop is an intentionally insecure web application written in Node.js, Express, and Angular that covers vulnerabilities from the… | 95 | 14148 | active |
| cert-manager cert-manager is a Kubernetes controller that adds Certificate and Issuer resource types to clusters and automates obtaining, renewing, and … | 98 | 14111 | stable |
| thunderbird/thunderbird-android Thunderbird for Android is a free, open-source, privacy-focused email client for Android, formerly known as K-9 Mail and now part of the Mo… | 97 | 14050 | active |
| libsodium libsodium is a modern, portable, easy-to-use C library for cryptographic operations, forked from NaCl with a compatible but extended API. I… | 81 | 13997 | stable |
| OpenNHP/opennhp OpenNHP is a lightweight, cryptography-powered open-source toolkit written in Go that implements the Cloud Security Alliance's Network-infr… | 97 | 13936 | active |
| WeChatTweak A command-line tool that patches the WeChat macOS client to add features like preventing message revocation, blocking automatic updates, an… | 65 | 13840 | active |
| Portmaster Portmaster is a free and open-source application firewall and privacy suite for Windows and Linux desktops. It intercepts all network traff… | 95 | 13824 | active |
| digininja/DVWA Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application intentionally riddled with common web vulnerabilities at multiple d… | 67 | 13809 | active |
| fancyss fancyss is a transparent proxy plugin for ASUS routers running asuswrt/asuswrt-merlin firmware with a software center. It supports multiple… | 67 | 13792 | active |
| QwikDev/partytown Partytown is a lazy-loaded JavaScript library that relocates resource-intensive third-party scripts (analytics, ads, trackers) off the main… | 91 | 13779 | active |
| pwntools Pwntools is a Python CTF framework and exploit development library designed for rapid prototyping of binary exploits. It provides utilities… | 69 | 13768 | active |
| nmap/nmap Nmap is the industry-standard open-source network scanner for host discovery, port scanning, service/version detection, and OS fingerprinti… | 77 | 13743 | stable |
| DNSCrypt/dnscrypt-proxy dnscrypt-proxy is a flexible local DNS proxy that encrypts and authenticates DNS traffic using DNSCrypt v2, DNS-over-HTTPS, Anonymized DNS,… | 90 | 13730 | stable |
| 墨鱼去广告 (Cuttlefish AdBlock) A curated collection of ad-blocking rules, rewrite scripts, and ready-made configuration files for proxy tools like QuantumultX, Surge, Sha… | 65 | 13709 | active |
| openwall/john John the Ripper jumbo is an open-source offline password cracker supporting hundreds of hash and cipher types, from Unix and Windows passwo… | 71 | 13668 | active |
| mailcow mailcow: dockerized is a full-featured, self-hosted mail server suite delivered as a set of Docker containers, bundling Postfix, Dovecot, S… | 99 | 13632 | stable |
| SoftEther VPN SoftEther VPN is an open-source, cross-platform, multi-protocol VPN server and client software written in C. It supports SSL-VPN, OpenVPN, … | 66 | 13597 | active |
| mozilla-firefox/firefox Firefox is Mozilla's free and open-source web browser built on the Gecko engine, available for desktop and mobile platforms. It emphasizes … | 69 | 13515 | active |
| opencontainers/runc runc is a command-line tool for spawning and running containers on Linux according to the Open Container Initiative (OCI) runtime specifica… | 97 | 13470 | stable |
| awslabs/git-secrets git-secrets is a command-line tool that scans git commits, commit messages, and merge histories for secrets and credentials, rejecting comm… | 48 | 13411 | stable |
| memstechtips/Winhance Winhance is a C#/WinUI3 desktop application for debloating, optimizing, and customizing Windows 10 and 11 systems. It provides a GUI for re… | 82 | 13335 | active |
| threat9/routersploit RouterSploit is an open-source exploitation framework dedicated to embedded devices like routers, modeled after Metasploit. It provides mod… | 55 | 13256 | active |
| LiveContainer/LiveContainer LiveContainer is an iOS app launcher that runs apps inside a single host application without actually installing them, bypassing the free d… | 88 | 13244 | active |
| MetaMask MetaMask is a self-custodial crypto wallet available as a browser extension (Chrome, Firefox, Brave, Edge, Opera) and mobile app, enabling … | 95 | 13237 | active |
| beemdevelopment/Aegis Aegis Authenticator is a free, open-source Android app for managing two-factor authentication (2FA) tokens. It stores HOTP/TOTP tokens in a… | 90 | 13227 | stable |
| objective-see/LuLu LuLu is a free, open-source macOS firewall that monitors and blocks unknown outgoing network connections. It uses a system extension and ne… | 91 | 13221 | active |
| zoicware/RemoveWindowsAI A PowerShell script that forcibly removes or disables all AI features in Windows 11, including Copilot, Recall, and AI components in built-… | 69 | 13206 | active |
| mozilla-mobile/firefox-ios The official Mozilla monorepo containing Firefox for iOS and Firefox Focus for iOS, full-featured open-source web browsers built in Swift. … | 93 | 13050 | active |
| KeeWeb KeeWeb is a free, cross-platform password manager compatible with KeePass kdbx database files, available as a desktop app (Electron) or a b… | 74 | 13016 | active |
| anchore/grype Grype is an open-source vulnerability scanner for container images, filesystems, and SBOMs, written in Go by Anchore. It identifies known C… | 98 | 12985 | active |
| TencentCloud/CubeSandbox CubeSandbox is a high-performance sandbox service for AI agents built on RustVMM and KVM, creating hardware-isolated MicroVM sandboxes in u… | 81 | 12853 | active |
| Marauder ESP32 Marauder is a suite of WiFi and Bluetooth offensive and defensive security tools distributed as firmware for ESP32-based hardware. It… | 99 | 12834 | active |
| JingMatrix/Vector Vector is a Zygisk module providing a high-performance ART hooking framework for modern Android, maintaining API compatibility with the ori… | 84 | 12800 | active |
| google/oss-fuzz OSS-Fuzz is Google's free continuous fuzzing service for open source software, combining fuzzing engines like libFuzzer, AFL++, and Honggfu… | 77 | 12743 | active |
| daijro/camoufox Camoufox is an open-source anti-detect browser built on Firefox for web scraping and AI agents, with browser fingerprint spoofing and Playw… | 91 | 12641 | active |
| secdev/scapy Scapy is a powerful Python-based interactive packet manipulation program and library that can forge, decode, send, capture, and match packe… | 88 | 12599 | stable |
| jopohl/urh Universal Radio Hacker (URH) is a complete open-source suite for investigating wireless protocols, with native support for many common Soft… | 10 | 12592 | active |
| Atomic Red Team Atomic Red Team is a library of small, portable detection tests mapped to the MITRE ATT&CK framework, letting security teams validate their… | 75 | 12582 | active |
| 0x4m4/hexstrike-ai HexStrike AI is an MCP server that bridges LLM agents (Claude, GPT, Copilot) with 150+ cybersecurity tools for autonomous penetration testi… | 58 | 12431 | active |
| vanhauser-thc/thc-hydra THC-Hydra is a parallelized network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, SMB, RDP, databases, and more). It … | 74 | 12322 | active |
| future-architect/vuls Vuls is an agent-less vulnerability scanner written in Go that detects CVEs on Linux, FreeBSD, Windows, macOS, containers, WordPress, progr… | 98 | 12284 | active |
| open-policy-agent/opa Open Policy Agent (OPA) is a general-purpose, open-source policy engine that unifies policy enforcement across the stack using a high-level… | 96 | 12264 | stable |
| rtyley/bfg-repo-cleaner BFG Repo-Cleaner is a command-line tool for removing large files, passwords, credentials, and other unwanted data from Git repository histo… | 23 | 12190 | active |
| jason5ng32/MyIP MyIP (IPCheck.ing) is an open-source, self-hostable web application that acts as an all-in-one IP toolbox. It shows your IPv4/IPv6 and geol… | 94 | 12156 | active |
| kubeshark/kubeshark Kubeshark is an eBPF-powered network observability tool for Kubernetes that indexes cluster-wide L4/L7 traffic with full Kubernetes context… | 99 | 12101 | active |
| BishopFox/sliver Sliver is an open-source cross-platform adversary emulation and red team framework written in Go. It generates dynamically compiled implant… | 98 | 11996 | active |