Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| VeraCrypt VeraCrypt is a free, open-source disk encryption application based on TrueCrypt 7.1a with security enhancements. It creates encrypted volum… | 89 | 11832 | stable |
| Netmaker Netmaker is an open-source platform that automates the creation and management of WireGuard-based virtual mesh networks, from homelab to en… | 93 | 11826 | active |
| Kubescape Kubescape is an open-source Kubernetes security platform (a CNCF incubating project) offering misconfiguration scanning, vulnerability asse… | 100 | 11815 | active |
| chaitin/xray xray is a security assessment tool from Chaitin that scans web applications for common vulnerabilities like XSS and SQL injection, supporti… | 23 | 11752 | active |
| ImmortalWrt ImmortalWrt is an open-source fork of OpenWrt, a Linux-based operating system for embedded network devices like WiFi routers. It targets ma… | 77 | 11751 | active |
| Detect It Easy Detect It Easy (DiE) is a cross-platform file type identification tool that uses signature-based and heuristic analysis to detect compilers… | 79 | 11734 | active |
| egulias/EmailValidator A PHP library for validating email addresses against multiple RFC standards (5321, 5322, 6530-6532, 1035). It offers pluggable validation s… | 32 | 11639 | stable |
| jhy/jsoup jsoup is a Java library for parsing, manipulating, and cleaning real-world HTML and XML, implementing the WHATWG HTML5 specification to pro… | 93 | 11410 | stable |
| ZCShou/GoGoGo GoGoGo (影梭) is an Android app that fakes GPS location using Android's mock location debug API combined with Baidu Maps, without requiring r… | 43 | 11410 | active |
| angristan/wireguard-install A bash script that installs and configures a WireGuard VPN server on Linux with NAT and IPv4/IPv6 support. Re-running the script lets you a… | 65 | 11325 | active |
| pymumu/smartdns SmartDNS is a local DNS server written in C that queries multiple upstream DNS servers concurrently and returns the fastest-responding IP t… | 93 | 11316 | active |
| podman-container-tools/skopeo Skopeo is a command line utility for performing operations on container images and image registries, such as copying, inspecting, deleting,… | 98 | 11313 | stable |
| Presidio Presidio is an open-source Python SDK for detecting, redacting, masking, and anonymizing sensitive data (PII) in text, images, and structur… | 91 | 11271 | active |
| siderolabs/talos Talos Linux is a minimal, immutable, API-managed Linux distribution purpose-built for running Kubernetes. It ships no shell, SSH, or packag… | 96 | 11246 | stable |
| hashsigs A Rust library implementing hash-based post-quantum digital signatures (WOTS+ and SHRINCS primitives) with an account policy wrapper. It co… | 64 | 11213 | active |
| QuipNetwork/hashsigs-solidity A Solidity implementation of the Winternitz One-Time Signature Plus (WOTS+) scheme, a hash-based post-quantum signature algorithm. It enabl… | 63 | 11211 | active |
| QuipNetwork/hashsigs-ts A TypeScript library implementing hash-based digital signatures, specifically the WOTS+ (Winternitz One-Time Signature Plus) scheme. It is … | 59 | 11191 | active |
| google/osv-scanner OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across ma… | 99 | 11184 | active |
| openai/codex-security OpenAI's Codex Security is a CLI and TypeScript SDK that uses AI to find, validate, and fix security vulnerabilities in codebases. It suppo… | 81 | 11143 | active |
| mRemoteNG/mRemoteNG mRemoteNG is an open-source, tabbed, multi-protocol remote connections manager for Windows, supporting RDP, VNC, SSH, HTTP/S and more. It l… | 84 | 11119 | active |
| quay/clair Clair is an open-source service for static analysis of vulnerabilities in container images (OCI and Docker). It indexes image contents via … | 71 | 11065 | active |
| BunkerWeb BunkerWeb is an open-source, cloud-native Web Application Firewall (WAF) built on NGINX that acts as a reverse proxy to protect web service… | 94 | 11054 | active |
| beefproject/beef BeEF (Browser Exploitation Framework) is a penetration testing tool focused on the web browser, hooking one or more browsers and using them… | 69 | 11046 | active |
| SonarQube SonarQube is a continuous code inspection platform that performs static analysis to track code quality, security vulnerabilities, and techn… | 96 | 11035 | stable |
| pwndbg/pwndbg Pwndbg is a Python-based plug-in for GDB and LLDB that enhances low-level debugging with features tailored to reverse engineering and explo… | 94 | 11015 | active |
| LaZagne LaZagne is an open-source Python application that recovers passwords stored locally by common software such as browsers, mail clients, WiFi… | 38 | 11006 | active |
| yokoffing/Betterfox Betterfox is a curated user.js preference file that hardens Mozilla Firefox for privacy, security, and speed via about:config tweaks. It bu… | 90 | 10895 | active |
| Monero Monero is the reference implementation of the Monero (XMR) privacy-focused cryptocurrency, including the full node daemon (monerod), wallet… | 88 | 10865 | active |
| sullo/nikto Nikto is a Perl-based command-line web server scanner that tests servers for dangerous files, outdated software, misconfigurations, and kno… | 86 | 10747 | active |
| Helmet Helmet is a Node.js middleware library that secures Express and Connect apps by setting HTTP response headers such as Content-Security-Poli… | 76 | 10736 | stable |
| BBOT BBOT is a recursive, multipurpose internet scanner built in Python for automating OSINT reconnaissance, bug bounty hunting, and attack surf… | 97 | 10709 | active |
| rofl0r/proxychains-ng ProxyChains-NG is a UNIX CLI tool that uses LD_PRELOAD to hook socket-related libc functions in dynamically linked programs and redirect th… | 64 | 10683 | active |
| Dr-TSNG/ZygiskNext Zygisk Next is a standalone implementation of the Zygisk injection framework for Android, providing Zygisk API support for KernelSU and ser… | 93 | 10595 | active |
| xykt/IPQuality A shell-based IP quality check script that reports IP type, risk scores from multiple databases, streaming/AI service unlock status, email … | 69 | 10586 | active |
| krzyzanowskim/CryptoSwift CryptoSwift is a pure Swift library providing standard cryptographic algorithms including AES, ChaCha20, SHA family hashes, HMAC, and CRC. … | 75 | 10579 | active |
| projectdiscovery/httpx httpx is a fast, multi-purpose HTTP toolkit written in Go that runs multiple probes (status codes, titles, TLS certificates, tech detection… | 94 | 10500 | active |
| itsfatduck/optimizerDuck optimizerDuck is a free, open-source Windows optimization tool built with C#/WinUI that provides performance tweaks, privacy controls, debl… | 80 | 10464 | active |
| yonggekkk/sing-box-yg A one-click Shell script for VPS servers that installs and configures five coexisting proxy protocols (Vless-Reality, Vmess-WS/Argo, Hyster… | 62 | 10374 | active |
| pennersr/django-allauth django-allauth is an integrated set of Django applications covering authentication, registration, account management, and third-party (soci… | 75 | 10373 | stable |
| Astrid Astrid is a portable, capability-secure operating system for composable software, where every component runs as a sealed WebAssembly capsul… | 82 | 10279 | active |
| CodeQL CodeQL is a semantic code analysis engine that treats code as a queryable database, letting you write queries to find security vulnerabilit… | 77 | 10201 | active |
| samratashok/nishang Nishang is a framework and collection of PowerShell scripts and payloads for offensive security, penetration testing, and red teaming. It c… | 23 | 10125 | active |
| shmilylty/OneForAll OneForAll is a powerful Python-based subdomain collection and enumeration tool for reconnaissance. It gathers subdomains via brute forcing,… | 56 | 10094 | active |
| thewhiteh4t/seeker Seeker is a security testing tool that hosts a fake website asking users for browser location permission, capturing GPS coordinates (longit… | 68 | 10055 | active |
| wireshark/wireshark Wireshark is the world's leading open-source network protocol analyzer (packet sniffer) with a Qt GUI, deep inspection of hundreds of proto… | 77 | 10046 | stable |
| TechnitiumSoftware/DnsServer Technitium DNS Server is an open-source, cross-platform authoritative and recursive DNS server built on .NET, designed for self-hosting wit… | 97 | 10032 | stable |
| Passwall Passwall is a LuCI application for OpenWrt routers that manages multiple proxy clients (Xray, Sing-box, Shadowsocks, Hysteria, etc.) to rou… | 98 | 9948 | active |
| AGWA/git-crypt git-crypt is a command-line tool that provides transparent encryption and decryption of selected files in a git repository. It lets teams s… | 39 | 9943 | active |
| go-acme/lego Lego is an ACME client and Go library for obtaining, renewing, and revoking TLS certificates from Let's Encrypt and other ACME CAs. It supp… | 98 | 9938 | active |
| Xtreme Firmware Xtreme Firmware is a feature-rich custom firmware for the Flipper Zero multitool device, written in C. It bundles many community apps, adde… | 10 | 9900 | active |
| paramiko/paramiko Paramiko is a pure-Python implementation of the SSHv2 protocol providing both client and server functionality, built on the cryptography li… | 74 | 9861 | stable |
| Sparkle Sparkle is a secure and reliable software update framework for macOS applications, serving as the de-facto standard used by thousands of ap… | 98 | 9824 | stable |
| wpscanteam/wpscan WPScan is a black-box WordPress security scanner written in Ruby, used by security professionals and site maintainers to audit WordPress in… | 90 | 9792 | active |
| ModSecurity ModSecurity (libmodsecurity v3) is an open source, cross-platform web application firewall (WAF) engine written in C++ that inspects HTTP(S… | 88 | 9784 | stable |
| docker/docker-bench-security Docker Bench for Security is a shell script that automates checks of Docker hosts and containers against the CIS Docker Benchmark best prac… | 57 | 9703 | active |
| anchore/syft Syft is a CLI tool and Go library that generates Software Bill of Materials (SBOM) documents from container images, filesystems, and archiv… | 99 | 9663 | active |
| spring-projects/spring-security Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications, and the de-facto s… | 97 | 9650 | stable |
| telekom-security/tpotce T-Pot is an all-in-one, optionally distributed honeypot platform that bundles 20+ honeypots with the Elastic Stack for visualization, live … | 66 | 9547 | active |
| klzgrad/naiveproxy NaïveProxy is a censorship-resistant proxy that uses Chromium's network stack to make proxy traffic indistinguishable from regular Chrome b… | 98 | 9530 | active |
| malwaredllc/byob BYOB is an open-source post-exploitation framework written in Python, featuring a command-and-control server with a web GUI, a cross-platfo… | 77 | 9512 | active |
| CFSSL CFSSL is Cloudflare's PKI/TLS toolkit for signing, verifying, and bundling TLS certificates, available as both a command line tool and an H… | 98 | 9483 | stable |
| Falco Falco is a CNCF-graduated cloud native runtime security tool for Linux that monitors kernel events (syscalls) via eBPF or kernel modules an… | 94 | 9478 | stable |
| AdAway AdAway is a free and open source ad blocker for Android that blocks ads system-wide using the hosts file or a local VPN. It supports both r… | 65 | 9474 | active |
| sensepost/objection objection is a runtime mobile exploration toolkit powered by Frida for assessing the security posture of iOS and Android applications witho… | 86 | 9412 | active |
| FreeBSD The official publish-only Git mirror of the FreeBSD source tree, containing the complete kernel, userland, libraries, boot loader, and buil… | 77 | 9398 | stable |
| unicorn-engine/unicorn Unicorn is a lightweight, multi-architecture CPU emulator framework based on QEMU, supporting ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, SPAR… | 67 | 9388 | stable |
| certimate-go/certimate Certimate is a free, open-source, self-hosted ACME tool for managing SSL/TLS certificates with a visual web UI. It automates the full certi… | 87 | 9378 | active |
| git-ecosystem/git-credential-manager Git Credential Manager is a secure, cross-platform Git credential helper built on .NET that stores credentials in the OS-native secure stor… | 95 | 9368 | active |
| Buster Buster is a browser extension that solves reCAPTCHA challenges by completing their audio challenges using speech recognition. It works on C… | 85 | 9335 | active |
| NVIDIA/garak garak is a command-line LLM vulnerability scanner that probes large language models for failures like hallucination, data leakage, prompt i… | 89 | 9332 | active |
| Universal-Debloater-Alliance/universal-android-debloater-next-generation A cross-platform desktop GUI application written in Rust that uses ADB to remove bloatware from non-rooted Android devices. It aims to impr… | 71 | 9307 | active |
| App Manager App Manager is a full-featured open-source package manager and app inspector for Android. It lets users install, uninstall, back up, and de… | 93 | 9285 | active |
| angr angr is a Python 3 binary analysis framework that loads executables across many architectures and formats, providing disassembly, IR liftin… | 77 | 9226 | active |
| Pwnagotchi Pwnagotchi is an A2C deep reinforcement learning agent built on bettercap that learns from its surrounding WiFi environment to maximize cap… | 63 | 9223 | active |
| testssl/testssl.sh testssl.sh is a free, bash-based command line tool that checks any server's service on any port for TLS/SSL cipher, protocol, and cryptogra… | 85 | 9218 | active |
| Momentum Firmware Momentum Firmware is a feature-rich, stable, and highly customizable custom firmware for the Flipper Zero multitool device, written in C. I… | 70 | 9166 | active |
| henrypp/simplewall Simplewall is a lightweight, open-source Windows application for configuring network activity via the Windows Filtering Platform (WFP). It … | 73 | 9150 | active |
| Firezone Firezone is an open-source, enterprise-ready zero-trust access platform built on WireGuard that replaces traditional VPNs with granular, po… | 96 | 9121 | active |
| frohoff/ysoserial ysoserial is a proof-of-concept command-line tool that generates serialized Java payloads exploiting unsafe object deserialization using ga… | 44 | 9088 | active |
| Ackites/Nrfr Nrfr is a root-free Android tool that changes the SIM card country code by calling native system APIs (CarrierConfigLoader) with Shizuku pe… | 34 | 9088 | active |
| Capstone Engine Capstone is a lightweight, multi-architecture, multi-platform disassembly framework written in pure C, designed to be the ultimate disassem… | 98 | 9066 | stable |
| Checkov Checkov is a static code analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and more) that … | 94 | 9060 | stable |
| containers/bubblewrap Bubblewrap is a low-level unprivileged sandboxing tool for Linux that uses user namespaces to let any user run processes in isolated contai… | 93 | 8998 | active |
| Matter SDK The official open-source SDK for Matter (formerly Project CHIP), the Connectivity Standards Alliance's IP-based smart home connectivity sta… | 90 | 8971 | active |
| Yearning Yearning is a self-hosted web-based SQL audit platform for MySQL, providing audit tickets with approval workflows, automated syntax checkin… | 75 | 8969 | active |
| Kata Containers Kata Containers is an open source container runtime that builds lightweight virtual machines which plug seamlessly into the container ecosy… | 98 | 8963 | stable |
| securego/gosec gosec is a security scanner for Go source code that inspects the AST and SSA representations to detect common security problems. It include… | 92 | 8961 | active |
| smallstep/certificates step-ca is an online private certificate authority (X.509 and SSH) and ACME server for secure, automated certificate management in DevOps e… | 84 | 8939 | active |
| maxgoedjen/secretive Secretive is a native macOS app that stores and manages SSH keys inside the Mac's Secure Enclave, making them non-exportable. It adds Touch… | 92 | 8888 | active |
| yogeshojha/rengine reNgine is a self-hosted automated web reconnaissance and vulnerability scanning framework with configurable recon engines, data correlatio… | 66 | 8869 | active |
| ViRb3/wgcf wgcf is an unofficial cross-platform command-line tool for Cloudflare Warp written in Go. It registers Warp accounts, binds Warp+ license k… | 92 | 8751 | active |
| superradcompany/microsandbox Microsandbox is a local-first microVM runtime and library for running untrusted workloads (AI agents, user code, plugins, CI jobs) inside f… | 86 | 8745 | active |
| stamparm/maltrail Maltrail is a malicious network traffic detection system that matches observed domains, URLs, IP addresses, and User-Agent values against o… | 97 | 8620 | active |
| Tsunami Security Scanner Tsunami is a general-purpose network security scanner from Google that detects high-severity vulnerabilities with high confidence. It relie… | 75 | 8620 | active |
| PrivateBin PrivateBin is a minimalist, self-hosted pastebin where the server stores only encrypted data and never learns the paste contents. Encryptio… | 94 | 8612 | active |
| spesmilo/electrum Electrum is a lightweight Bitcoin wallet client written in Python that uses SPV verification instead of downloading the full blockchain. It… | 76 | 8609 | stable |
| EmenstaNougat/ESP32-BlueJammer ESP32-BlueJammer is firmware for an ESP32 paired with nRF24 modules that disrupts 2.4GHz communications (Bluetooth, BLE, WiFi, RC) by flood… | 45 | 8594 | active |
| wangyu-/udp2raw A C++ command-line tunnel that converts UDP traffic into encrypted FakeTCP, UDP, or ICMP traffic using raw sockets, helping bypass UDP fire… | 40 | 8571 | active |
| skeeto/endlessh Endlessh is an SSH tarpit daemon written in C that slowly sends an endless, random SSH pre-authentication banner to keep malicious clients … | 23 | 8565 | stable |
| ionuttbara/windows-defender-remover A script-based tool that removes or disables Windows Defender and related security components (Windows Security app, SmartScreen, VBS, tamp… | 85 | 8559 | active |