Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| ionuttbara/windows-defender-remover A script-based tool that removes or disables Windows Defender and related security components (Windows Security app, SmartScreen, VBS, tamp… | 85 | 8559 | active |
| Havoc Havoc is a modern, malleable post-exploitation command and control (C2) framework with a Go teamserver, a Qt-based cross-platform client, a… | 10 | 8505 | active |
| ZyperWave/ZyperWinOptimize ZyperWin++ is a lightweight Windows optimization tool built in C# (.NET 4) supporting Windows 7 through Windows 11. It offers performance a… | 38 | 8422 | active |
| GEF GEF (GDB Enhanced Features) is a single-file Python plugin for GDB that adds a modern, feature-rich debugging experience for exploit develo… | 71 | 8401 | active |
| Sysdig Sysdig is a Linux system exploration and troubleshooting tool that captures system calls and OS events at the kernel level, with native sup… | 72 | 8301 | active |
| PyCQA/bandit Bandit is a security-oriented static analysis tool that finds common security issues in Python code. It parses each file into an AST, runs … | 81 | 8285 | active |
| kyverno/kyverno Kyverno is a Kubernetes-native policy engine for policy as code, letting platform teams author validate, mutate, generate, and cleanup poli… | 100 | 8268 | stable |
| kishikawakatsumi/KeychainAccess KeychainAccess is a simple Swift wrapper around Apple's Keychain APIs for iOS, macOS, watchOS, tvOS, and Mac Catalyst. It provides an ergon… | 23 | 8256 | stable |
| aquasecurity/kube-bench kube-bench is a Go-based tool that checks whether Kubernetes clusters are deployed securely by running the checks documented in the CIS Kub… | 95 | 8216 | active |
| ntop/ntopng ntopng is a web-based network traffic monitoring and cybersecurity application that provides real-time visibility into hosts, applications,… | 86 | 8202 | stable |
| six2dez/reconftw reconFTW is an open-source (MIT) automated reconnaissance framework written in Shell that orchestrates 80+ security tools to perform full r… | 82 | 8155 | active |
| Zeek Zeek (formerly Bro) is an open-source network security monitor and analysis framework that passively inspects network traffic and produces … | 97 | 8123 | stable |
| alsyundawy/Microsoft-Office-For-MacOS A shell-script-based installer that downloads and installs Microsoft Office suites for macOS, including serializers and troubleshooting res… | 90 | 8117 | active |
| epi052/feroxbuster feroxbuster is a fast, recursive content discovery tool written in Rust that performs forced browsing against web servers. It brute-forces … | 76 | 8112 | active |
| Solid Solid is a set of open standards and tools for building decentralized web applications where users store their data in personal online data… | 10 | 8091 | active |
| vercel-labs/deepsec Deepsec is an open-source, agent-powered vulnerability scanner that runs AI coding agents over your entire existing codebase to find hard-t… | 58 | 8075 | active |
| robinmoisson/staticrypt StatiCrypt is a CLI tool and browser-based utility that encrypts static HTML files with AES-256 using a password, producing a self-containe… | 60 | 8048 | active |
| v1s1t0r1sh3r3/airgeddon A multi-use bash script for auditing wireless networks on Linux, wrapping tools like aircrack-ng to automate attacks such as evil twin, WPS… | 93 | 8035 | active |
| APatch APatch is a kernel-based root solution for Android devices that patches the Android kernel and system, relying on KernelPatch. It supports … | 83 | 8021 | active |
| tutao/tutanota Tuta Mail (formerly Tutanota) is an open-source, end-to-end encrypted email service with integrated encrypted calendar and contacts, availa… | 93 | 7967 | active |
| PCILeech PCILeech is DMA attack software that uses PCIe hardware devices (or software memory acquisition methods) to read and write target system me… | 62 | 7945 | active |
| tiagozip/cap Cap is a lightweight, open-source, self-hosted CAPTCHA alternative to reCAPTCHA, hCaptcha, and Cloudflare Turnstile. It uses invisible proo… | 82 | 7906 | active |
| maharmstone/btrfs WinBtrfs is an open-source Btrfs filesystem driver for Windows, reimplemented from scratch in C with no Linux kernel code. It supports read… | 84 | 7857 | active |
| mandiant/commando-vm Commando VM is a fully customizable Windows-based security distribution for penetration testing and red teaming, packaged as a PowerShell i… | 50 | 7824 | active |
| Scout Suite Scout Suite is an open source multi-cloud security auditing tool that assesses the security posture of cloud environments. It gathers confi… | 39 | 7824 | stable |
| hfiref0x/UACME UACMe is a C-based command-line tool that demonstrates dozens of Windows User Account Control (UAC) bypass techniques abusing built-in Auto… | 81 | 7821 | active |
| boltgolt/howdy Howdy provides Windows Hello-style facial authentication for Linux using IR emitters and a camera with facial recognition. It integrates wi… | 34 | 7813 | active |
| kelektiv/node.bcrypt.js A Node.js library providing bcrypt password hashing implemented as a native C++ addon. It handles salting and hashing passwords for secure … | 54 | 7804 | stable |
| yaklang/yakit Yakit is an all-in-one interactive application security testing platform built as a GUI client for the Yaklang security DSL engine over gRP… | 93 | 7786 | active |
| pyca/cryptography pyca/cryptography is a Python package providing cryptographic recipes and primitives, aiming to be Python's 'cryptographic standard library… | 75 | 7785 | stable |
| r0ysue/r0capture A Frida-based universal Android application-layer packet capture script that hooks SSL/TLS regardless of certificate pinning, obfuscation, … | 61 | 7766 | active |
| OWASP Dependency-Check OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project… | 96 | 7723 | active |
| aircrack-ng/aircrack-ng Aircrack-ng is a complete suite of command-line tools for assessing WiFi network security, covering packet capture, injection, monitor mode… | 65 | 7705 | active |
| mullvad/mullvadvpn-app The official Mullvad VPN client app for desktop and mobile, including a Rust system service/daemon, an Electron-based GUI, a CLI, and dedic… | 99 | 7692 | active |
| netblue30/firejail Firejail is a SUID security sandbox program for Linux that uses kernel namespaces, seccomp-bpf filters, and Linux capabilities to run appli… | 79 | 7688 | active |
| youki-dev/youki youki is an implementation of the OCI container runtime specification written in Rust, serving as a low-level container runtime similar to … | 91 | 7640 | active |
| rustls/rustls Rustls is a modern TLS library written in Rust implementing TLS 1.2 and TLS 1.3 for both clients and servers. It provides secure defaults w… | 96 | 7638 | stable |
| aceberg/WatchYourLAN WatchYourLAN is a lightweight network IP scanner written in Go with a web GUI, designed to discover and track hosts on a local network via … | 49 | 7629 | active |
| markqvist/Reticulum Reticulum is a cryptography-based networking stack written in Python that builds encrypted, resilient local and wide-area networks over LoR… | 98 | 7588 | active |
| Mailu Mailu is a full-featured, self-hosted email server distributed as a set of Docker images, providing SMTP, IMAP, webmail, and an admin inter… | 100 | 7567 | active |
| arkime/arkime Arkime is an open-source, large-scale network analysis, full packet capture, and session indexing system that stores traffic in standard PC… | 98 | 7536 | active |
| TigerVNC/tigervnc TigerVNC is a high-performance, multi-platform implementation of VNC (Virtual Network Computing), providing both a client (vncviewer) and s… | 83 | 7526 | active |
| Kunzisoft/KeePassDX KeePassDX is a lightweight, open-source password manager and encrypted vault for Android, compatible with the KeePass format (.kdb/.kdbx). … | 100 | 7506 | active |
| lcobucci/jwt A PHP library for creating, parsing, and validating JSON Web Tokens (JWT) and JSON Web Signatures (JWS) per RFC 7519. It is installed via C… | 95 | 7480 | stable |
| aonez/Keka Keka is a file archiver application for macOS and iOS that supports compressing and extracting many archive formats such as zip, 7z, rar, a… | 93 | 7442 | active |
| Recaf Recaf is a modern Java bytecode editor with a JavaFX GUI that abstracts away low-level class file complexities like constant pools and stac… | 66 | 7418 | active |
| Calico Calico is an open-source cloud-native networking and network security platform for Kubernetes, providing pod networking (CNI), network poli… | 99 | 7398 | stable |
| jonasstrehle/supercookie A demonstration web application that assigns persistent unique identifiers to website visitors via favicon-based browser fingerprinting. It… | 10 | 7383 | active |
| leminlimez/Nugget Nugget is a cross-platform desktop GUI application for customizing iOS and iPadOS devices without jailbreaking, using Apple's MobileDevice/… | 88 | 7357 | active |
| Cisco-Talos/clamav ClamAV is an open-source antivirus engine and toolkit for detecting trojans, viruses, malware, and other malicious threats. It includes a m… | 92 | 7350 | active |
| apache/caldera Apache Caldera is a cybersecurity platform for automated adversary emulation built on the MITRE ATT&CK framework. It provides an asynchrono… | 75 | 7317 | active |
| greatfire/wiki A GreatFire wiki/repository page that serves as the distribution hub for FreeBrowser (自由浏览), an Android app for circumventing internet cens… | 56 | 7293 | active |
| Lerist/FakeLocation FakeLocation is an Android app for mocking GPS and location data, supporting both root and non-root modes. It simulates GPS signals, cell t… | 10 | 7288 | active |
| presidentbeef/brakeman Brakeman is a free, open-source static analysis security scanner built specifically for Ruby on Rails applications. It analyzes Rails sourc… | 95 | 7286 | stable |
| SQLCipher SQLCipher is an open-source fork of SQLite that adds full-database 256-bit AES encryption, tamper detection, and strong key derivation. It … | 91 | 7286 | stable |
| LibChecker An Android app that inspects libraries, native ABIs, permissions, components, and signing details of installed apps and APK files. It also … | 85 | 7270 | active |
| gopass gopass is a command-line password manager for teams, serving as a drop-in replacement for the standard UNIX pass tool. It encrypts secrets … | 99 | 7257 | stable |
| Soft Serve Soft Serve is a self-hostable Git server that runs as a single Go binary and is managed entirely from the command line. It serves repositor… | 98 | 7253 | active |
| BleachBit BleachBit is an open-source system cleaner for Windows and Linux that frees disk space and protects privacy by deleting caches, cookies, lo… | 96 | 7196 | stable |
| NVIDIA-NeMo/Guardrails NVIDIA NeMo Guardrails is an open-source Python toolkit for adding programmable guardrails to LLM-based conversational applications. It sit… | 90 | 7181 | active |
| lintsinghua/DeepAudit DeepAudit is an open-source multi-agent AI system for automated code vulnerability discovery and security auditing, with a React frontend a… | 72 | 7178 | active |
| OnionShare OnionShare is an open-source desktop and mobile application that lets users securely and anonymously share files, host websites, and chat o… | 84 | 7156 | active |
| hwdsl2/docker-ipsec-vpn-server A Docker image that runs a self-hosted IPsec VPN server supporting IPsec/L2TP, Cisco IPsec, and IKEv2, built on Libreswan and xl2tpd. It au… | 76 | 7150 | active |
| RsaCtfTool/RsaCtfTool A Python CLI tool that attacks weak RSA public keys to recover private keys and decrypt ciphertext, combining many factorization and lattic… | 75 | 7143 | active |
| curl-impersonate A special build of curl (and libcurl) whose TLS and HTTP/2 handshakes are identical to real browsers like Chrome, Edge, Safari, and Firefox… | 23 | 7142 | active |
| ayoubfaouzi/al-khaser Al-Khaser is a proof-of-concept Windows application that demonstrates a wide range of malware anti-analysis techniques, including anti-debu… | 67 | 7141 | active |
| Intel Wi-Fi for macOS (itlwm + HeliPort) itlwm is an open-source kernel extension providing Intel Wi-Fi adapter support on macOS, ported largely from OpenBSD's iwm/iwx/net80211 dri… | 23 | 7107 | active |
| CASL CASL is an isomorphic JavaScript authorization library that restricts what resources a user is allowed to access, using declarative rules t… | 100 | 7100 | stable |
| guardicore/monkey Infection Monkey is an open-source adversary emulation platform that simulates malware-like self-propagation across a network to test secur… | 28 | 7098 | active |
| LasCC/HackTools HackTools is an all-in-one browser extension for offensive security professionals that bundles penetration testing tools like XSS payloads,… | 23 | 7087 | active |
| OpenSignLabs/OpenSign OpenSign is a free, open-source document e-signing application and DocuSign alternative built with React, Node.js, and MongoDB. It supports… | 88 | 7023 | active |
| fleetdm/fleet Fleet is an open-source device management (MDM) and security platform for IT and security teams, built on osquery. It provides cross-OS dev… | 96 | 7019 | stable |
| SimpleLogin SimpleLogin is an open-source email aliasing service that lets users create unique aliases to receive and send emails without exposing thei… | 93 | 7012 | active |
| 0xERR0R/blocky Blocky is a fast, lightweight DNS proxy and ad-blocker for local networks, written in Go. It blocks ads and malware via external allow/deny… | 97 | 7011 | active |
| Mbed TLS Mbed TLS is a portable C library implementing TLS, DTLS, and X.509 certificate handling, plus a reference implementation of the PSA Cryptog… | 94 | 7011 | stable |
| shiaho777/web-to-app WebToApp is an Android application that lets users build signed, installable APKs from web projects entirely on their phone, without a PC o… | 85 | 6961 | active |
| Bruce Bruce is an open-source (AGPL-3.0) ESP32 firmware packed with offensive-security and Red Team tools such as WiFi attacks, Evil Portal, ward… | 88 | 6946 | active |
| wxxsfxyzm/InstallerX-Revived InstallerX Revived is a modern Android package installer app supporting APK, APKS, APKM, XAPK, and ZIP formats with batch installation. It … | 88 | 6933 | active |
| haproxy/haproxy HAProxy is a fast, reliable open-source reverse proxy and load balancer for TCP and HTTP-based applications, providing high availability, T… | 77 | 6929 | stable |
| TelegramMessenger/MTProxy MTProxy is the official MT-Proto proxy server for Telegram, written in C. It lets users self-host a proxy so others can access Telegram whe… | 62 | 6927 | active |
| Tencent/AI-Infra-Guard Tencent's full-stack AI red teaming platform that scans AI infrastructure, agents, MCP servers, and skills for vulnerabilities and evaluate… | 85 | 6916 | active |
| MacPass MacPass is a native macOS KeePass password manager client that opens and manages KDBX password databases. It is written in Objective-C and … | 85 | 6884 | active |
| urbanadventurer/WhatWeb WhatWeb is a command-line web scanner that identifies the technologies powering websites, including CMSs, web servers, JavaScript libraries… | 70 | 6869 | stable |
| aistra0528/Hail Hail is a free, open-source Android app for freezing, disabling, hiding, or suspending other apps without root, using Shizuku or root privi… | 85 | 6832 | active |
| chaifeng/ufw-docker A shell-based tool that fixes the well-known security flaw where Docker bypasses UFW firewall rules and exposes published ports to the publ… | 62 | 6821 | active |
| travist/jsencrypt JSEncrypt is a tiny, zero-dependency JavaScript library for OpenSSL-compatible RSA encryption, decryption, signing, and key generation. It … | 63 | 6806 | active |
| InterceptSuite/ProxyBridge ProxyBridge is a free, open-source universal proxy client (Proxifier alternative) that transparently redirects TCP and UDP traffic from any… | 84 | 6795 | active |
| LumaTeam/Luma3DS Luma3DS is custom firmware for the Nintendo 3DS family of consoles that patches and reimplements parts of the system software. It adds home… | 81 | 6789 | active |
| smol-machines/smolvm smolvm is an open-source CLI and runtime for running lightweight, hardware-isolated Linux microVMs locally on macOS, Linux, and Windows, bu… | 80 | 6786 | active |
| AFL++ AFL++ is a superior, actively maintained fork of American Fuzzy Lop, a coverage-guided fuzzer with many mutators, power schedules, and inst… | 92 | 6782 | active |
| Faraday Faraday is an open-source vulnerability management platform that aggregates, normalizes, and deduplicates findings from over 90 security to… | 98 | 6781 | active |
| VeNoMouS/cloudscraper A Python library that wraps Requests to bypass Cloudflare's anti-bot protection pages (IUAM), supporting challenge types v1, v2, v3, and Tu… | 30 | 6776 | active |
| cppcheck-opensource/cppcheck Cppcheck is an open-source static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs w… | 89 | 6774 | stable |
| ticarpi/jwt_tool A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known J… | 28 | 6770 | active |
| superagent-ai/superagent Superagent is an open-source SDK and platform for securing AI applications and agents, offering runtime guardrails that block prompt inject… | 73 | 6759 | active |
| internet-court/internet-court-skill An open Agent Skill / Claude Code plugin that acts as a trust layer for agent-to-agent commerce, combining natural-language mandates, ERC-7… | 55 | 6749 | active |
| curl-impersonate bindings curl_cffi is a Python binding for a curl-impersonate fork via cffi, providing an HTTP client that can impersonate browser TLS/JA3, HTTP/2, … | 98 | 6746 | active |
| xrdp xrdp is an open-source RDP server that provides graphical login to remote Linux machines using the Microsoft Remote Desktop Protocol. It ac… | 88 | 6733 | stable |
| opa334/Dopamine Dopamine is a rootless semi-untethered jailbreak tool for iOS 15 through 26.0.1, supporting arm64e and A12/A13 devices. It is written prima… | 96 | 6723 | active |
| zizmor zizmor is a static analysis tool for CI/CD configurations, primarily GitHub Actions workflows, as well as Dependabot and pre-commit configs… | 86 | 6714 | active |