Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| microsoft/msquic MsQuic is Microsoft's cross-platform C implementation of the IETF QUIC transport protocol (RFC 9000), with API wrappers for C++, C#, and Ru… | 100 | 4790 | stable |
| aws/s2n-tls s2n-tls is a C99 implementation of the TLS/SSL protocols designed to be simple, small, fast, and security-focused, maintained by AWS. It pr… | 98 | 4769 | stable |
| diafygi/acme-tiny A tiny, auditable Python script (under 200 lines) that issues and renews TLS certificates from Let's Encrypt using the ACME protocol. It re… | 64 | 4767 | stable |
| cdk-team/CDK CDK is a zero-dependency container penetration toolkit written in Go for security testing of Kubernetes, Docker, and Containerd environment… | 64 | 4767 | active |
| IntelOwl IntelOwl is an open-source, self-hosted application for managing threat intelligence at scale, querying many online analyzers and malware a… | 93 | 4759 | active |
| MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass A proof-of-concept PHP tool that exploits a vulnerability to bypass Xiaomi HyperOS community account restrictions on BootLoader unlock bind… | 37 | 4759 | active |
| openziti/zrok zrok is an open-source tool for securely sharing local web services, files, and TCP/UDP resources over the internet without firewall or NAT… | 98 | 4751 | active |
| kingparks/cursor-vip cursor-vip is a Go-based command-line tool that grants the Cursor IDE VIP/Pro-like access by sharing pooled accounts, installed via shell s… | 42 | 4745 | active |
| Hyperlight Hyperlight is a lightweight Virtual Machine Manager (VMM) library, written in Rust, that embeds micro virtual machines into applications fo… | 90 | 4740 | active |
| GhostPack/Seatbelt Seatbelt is a C# command-line tool that performs security-oriented host-survey 'safety checks' on Windows systems. It enumerates system and… | 32 | 4738 | active |
| AntSword AntSword is a cross-platform, open-source website administration toolkit built with Electron, designed for penetration testers, security re… | 66 | 4725 | active |
| TheWover/donut Donut is a shellcode generator that converts VBScript, JScript, EXE, DLL files, and .NET assemblies into x86, x64, or AMD64+x86 position-in… | 33 | 4716 | stable |
| M66B/FairEmail FairEmail is a fully featured, open source, privacy oriented email client for Android. It supports unlimited accounts via standard protocol… | 95 | 4714 | active |
| Authenticator A browser extension that generates two-factor authentication (2FA) codes, acting as a software TOTP authenticator. It is available for Chro… | 66 | 4705 | active |
| dmno-dev/varlock Varlock is a CLI tool and library for managing environment variables and secrets via a typed .env.schema file, serving as a drop-in dotenv … | 83 | 4696 | active |
| OPNsense OPNsense is an open-source, FreeBSD-based firewall and routing platform with a web GUI, REST API, and extensible plugin system. It provides… | 75 | 4696 | active |
| SteveLTN/https-portal HTTPS-PORTAL is a Dockerized reverse proxy that automatically obtains and renews Let's Encrypt TLS certificates and serves any web applicat… | 82 | 4694 | active |
| microsoft/PyRIT PyRIT is Microsoft's open-source Python framework for identifying security and safety risks in generative AI systems. It provides automatio… | 88 | 4668 | active |
| martin-olivier/airgorah Airgorah is a WiFi security auditing application built in Rust with a GTK4 graphical interface, wrapping the aircrack-ng tools suite. It ca… | 94 | 4665 | active |
| detect-secrets detect-secrets is a Python CLI tool from Yelp that detects secrets (API keys, passwords, tokens) in codebases using regex and entropy heuri… | 53 | 4649 | active |
| ThioJoe/YT-Spammer-Purge A Python-based desktop application that scans YouTube comment sections for spam and scam comments using 15 different filtering methods, the… | 36 | 4636 | active |
| Tracee Tracee is a Linux runtime security and forensics tool that uses eBPF to trace system calls, network activity, and file operations in real t… | 77 | 4632 | active |
| Drozer Security Assessment Framework drozer is an open-source security assessment framework for Android that lets testers assume the role of an app and interact with the Androi… | 53 | 4621 | active |
| rfjakob/gocryptfs gocryptfs is an encrypted overlay filesystem written in Go, built on the go-fuse library, that stores each file as a corresponding encrypte… | 77 | 4617 | stable |
| Cerbos Cerbos is an open-core, language-agnostic policy decision point (PDP) that externalizes authorization from application code using context-a… | 94 | 4616 | stable |
| ntop/nDPI nDPI is an open source LGPLv3 C library for deep packet inspection that detects 450+ layer-7 application protocols from network traffic. It… | 84 | 4613 | stable |
| activemerchant/active_merchant Active Merchant is a Ruby payment abstraction library extracted from Shopify that provides a unified API across dozens of payment gateways.… | 89 | 4603 | stable |
| stratumauth/app Stratum (formerly Authenticator Pro) is a free, open-source two-factor authentication app for Android with a Wear OS companion. It supports… | 90 | 4598 | active |
| szabodanika/microbin MicroBin is a self-hosted pastebin and file-sharing web application written in Rust, packaged as a single self-contained executable. It sup… | 71 | 4574 | active |
| Oros42/IMSI-catcher A Python tool that decodes GSM radio traffic captured via software-defined radio receivers (RTL-SDR, HackRF, BladeRF, OsmocomBB) to display… | 67 | 4571 | active |
| hacklcx/HFish HFish is a free, enterprise-grade honeypot platform for deception-based defense, threat detection, and attacker tracing. It deploys decoy s… | 61 | 4552 | active |
| hluwa/frida-dexdump A Frida-based CLI tool that finds and dumps DEX files from an Android app's memory, enabling unpacking of packed or obfuscated APKs. It sup… | 10 | 4552 | stable |
| Interactsh Interactsh is an open-source tool for detecting out-of-band (OOB) interactions via DNS, HTTP(S), SMTP(S), and LDAP, useful for identifying … | 88 | 4549 | active |
| samsesh/SocialBox-Termux SocialBox-Termux is a shell-based brute-force attack framework targeting social media and email services like Facebook, Gmail, Instagram, a… | 68 | 4548 | active |
| limbopro/Adblock4limbo A userscript-based ad-blocking project that removes popups, banners, and video ads on specific streaming, comic, novel, and adult sites via… | 77 | 4542 | active |
| KernelSU-Next/KernelSU-Next KernelSU Next is a kernel-based root solution for Android devices, providing superuser access via kernel-level hooks with a companion manag… | 85 | 4526 | active |
| mekos2772/ios-location-spoofer A standalone iOS location spoofing solution that intercepts and rewrites Apple's network-based location service (WLOC) responses via proxy … | 58 | 4525 | active |
| CISO Assistant CISO Assistant is an open-source, self-hostable GRC (Governance, Risk, and Compliance) platform covering risk management, compliance and au… | 91 | 4521 | active |
| taviso/loadlibrary A library that lets native Linux programs load and call functions from Windows DLLs via a custom PE/COFF loader with a dlopen-like API. It … | 35 | 4507 | active |
| JonathanSalwan/ROPgadget ROPgadget is a Python command-line tool that searches binaries for ROP gadgets to facilitate return-oriented programming exploitation. It s… | 61 | 4501 | active |
| extremecoders-re/pyinstxtractor A Python script that extracts the contents of PyInstaller-generated executables, including fixing pyc headers so bytecode decompilers can p… | 78 | 4500 | stable |
| Judge0 Judge0 is an open-source, sandboxed online code execution system exposing a simple HTTP JSON API for compiling and running untrusted code i… | 68 | 4485 | active |
| jonaslejon/malicious-pdf A Python CLI tool that generates 67 malicious PDF test files embedding callbacks for SSRF, XSS, XXE, NTLM credential theft, and data exfilt… | 90 | 4483 | active |
| AdguardTeam/AdguardBrowserExtension AdGuard Browser Extension is a free, open-source ad blocker for Chrome, Firefox, Opera, Edge, and other Chromium-based browsers. It blocks … | 98 | 4482 | active |
| OpenVPN/easy-rsa easy-rsa is a shell-based CLI utility for building and managing a PKI certificate authority. It creates root and intermediate CAs, signs ce… | 88 | 4479 | active |
| PowerDNS/pdns PowerDNS is a suite of open-source DNS software written in C++, comprising the Authoritative Server, the Recursor, and dnsdist. It provides… | 75 | 4473 | stable |
| trifectatechfoundation/sudo-rs A memory-safe, safety-oriented reimplementation of the classic sudo and su utilities written in Rust. It is actively maintained, independen… | 92 | 4470 | active |
| BeichenDream/Godzilla Godzilla is a Java-based webshell management tool supporting dynamic payloads for JSP, ASPX, and PHP targets with multiple AES/XOR encrypto… | 23 | 4467 | active |
| GerbenJavado/LinkFinder LinkFinder is a Python CLI script that discovers endpoints and their parameters in JavaScript files using jsbeautifier and regular expressi… | 32 | 4464 | stable |
| t3l3machus/Villain Villain is a high-level stage 0/1 command-and-control (C2) framework written in Python that handles multiple reverse TCP and HoaxShell-base… | 29 | 4460 | active |
| ts1/BLEUnlock BLEUnlock is a macOS menu bar utility that locks and unlocks your Mac based on the proximity of a Bluetooth Low Energy device such as an iP… | 23 | 4452 | active |
| ankane/strong_migrations A Ruby gem for Rails that catches unsafe database migrations in development by detecting potentially dangerous operations like removing col… | 75 | 4449 | stable |
| Volatility Volatility is an open-source memory forensics framework for extracting digital artifacts from RAM captures of Windows, Linux, and macOS sys… | 88 | 4444 | active |
| meta-llama/PurpleLlama Purple Llama is Meta's umbrella project of tools and benchmarks for assessing and improving the security of large language models. It inclu… | 72 | 4444 | active |
| XTLS/RealiTLScanner A Go-based TLS server scanner built for the XTLS Reality protocol ecosystem. It scans IP ranges, CIDRs, domains, or target lists to find TL… | 80 | 4443 | active |
| lwch/natpass natpass is a self-hosted host management tool written in Go that provides web-based shell access, remote desktop (VNC), and code-server int… | 64 | 4442 | active |
| zan8in/afrog afrog is an open-source security tool written in Go for vulnerability scanning using PoC (Proof of Concept) rules. It is designed for bug b… | 100 | 4434 | active |
| joxeankoret/diaphora Diaphora is a free and open source program diffing (binary diffing) tool that works as an IDA Pro plugin, comparing binaries to find change… | 95 | 4430 | active |
| WireGuard/wireguard-go A userspace implementation of the WireGuard VPN protocol written in Go. It creates WireGuard tunnel interfaces on Linux, macOS, Windows, Fr… | 66 | 4429 | stable |
| vercel-labs/just-bash just-bash is a TypeScript-implemented bash interpreter with an in-memory virtual filesystem, designed to give AI agents a secure, sandboxed… | 83 | 4421 | active |
| Qovery/Replibyte Replibyte is a stateless Rust CLI tool that dumps production databases (PostgreSQL, MySQL, MongoDB), masks sensitive data with fake data, a… | 35 | 4413 | active |
| TideSec/TscanPlus TscanPlus is a comprehensive network security detection and operations tool for rapid asset discovery, identification, and vulnerability de… | 92 | 4407 | active |
| OpenZiti OpenZiti is an open-source zero-trust networking platform that provides programmable mesh overlay networks with cryptographic identity, pol… | 97 | 4403 | active |
| SelfControlApp/selfcontrol SelfControl is a free, open-source macOS application that blocks your own access to distracting websites, mail servers, or other internet r… | 69 | 4402 | active |
| microsoft/ApplicationInspector Microsoft Application Inspector is a source code characterization tool that uses a JSON-based rules engine with 400+ regex patterns to iden… | 91 | 4397 | active |
| Rainbow Wallet Rainbow is a self-custody Ethereum wallet app for iOS, Android, and desktop browsers, built with React Native and TypeScript. It lets users… | 95 | 4396 | active |
| HaE HaE (Highlighter and Extractor) is a framework-style cybersecurity project for fine-grained tagging and extraction of sensitive information… | 95 | 4393 | active |
| lazy-luo/smarGate smarGate is a cross-network remote port mapping and NAT traversal tool consisting of an Android client app and lightweight server binaries,… | 73 | 4361 | active |
| ufrisk/MemProcFS MemProcFS is an memory forensic tool that exposes physical memory, memory dump files, and live memory acquisition sources as files in a vir… | 84 | 4356 | active |
| kubernetes-sigs/agent-sandbox Agent Sandbox is a Kubernetes SIG project providing a Sandbox Custom Resource Definition (CRD) and controller for managing isolated, statef… | 86 | 4335 | active |
| smallstep/cli Step CLI is a Go-based command-line tool for building, operating, and automating PKI systems, working with X.509 certificates, JWTs, OAuth … | 97 | 4333 | active |
| jtesta/ssh-audit ssh-audit is a Python CLI tool that audits SSH server and client configurations, analyzing banners, key exchange, encryption, MAC, and comp… | 83 | 4324 | active |
| yuaotian/antigravity-proxy A Windows transparent proxy injector for the Antigravity editor that forces its traffic through SOCKS5/HTTP proxies via DLL injection and M… | 78 | 4320 | active |
| x64dbg/ScyllaHide ScyllaHide is an advanced usermode anti-anti-debug library that hooks Windows functions to hide the presence of a debugger from debugged pr… | 23 | 4312 | active |
| kanshurichard/enableAppleAI A shell script that enables Apple Intelligence on Macs sold in Mainland China by patching macOS eligibility checks (eligibilityd plist file… | 10 | 4306 | active |
| open-policy-agent/gatekeeper Gatekeeper is a CNCF policy controller for Kubernetes built on Open Policy Agent (OPA). It enforces admission policies via customizable con… | 97 | 4303 | stable |
| Sycnex/Windows10Debloater A PowerShell script collection that removes pre-installed bloatware from Windows 10, disables telemetry, Cortana search indexing, and unnec… | 10 | 18817 | maintenance |
| nolabs-ai/nono nono is a Rust-based CLI and SDK that runs AI coding agents and their tool invocations in ephemeral, kernel-enforced micro sandboxes with c… | 76 | 4273 | active |
| ConsenSysDiligence/mythril Mythril is a symbolic-execution-based security analysis tool for EVM bytecode that detects vulnerabilities in Ethereum and other EVM-compat… | 55 | 4272 | active |
| OWASP Dependency-Track OWASP Dependency-Track is an open-source component analysis platform that ingests CycloneDX SBOMs to continuously identify vulnerabilities,… | 99 | 4269 | active |
| irbis-sh/zen-desktop Zen is an open-source, system-wide ad-blocker and privacy guard for Windows, macOS, and Linux. It runs a local proxy that intercepts HTTP/H… | 97 | 4265 | active |
| jasonxtn/Argus Argus is a Python-based all-in-one information gathering and reconnaissance toolkit with an interactive console and modular architecture. I… | 44 | 4264 | active |
| baihengaead/wlan-sec-test-tool A Python-based GUI tool for wireless network security testing that checks WiFi networks for weak passwords by attempting connections with a… | 67 | 4243 | active |
| i2pd i2pd (I2P Daemon) is a full-featured C++ implementation of an I2P client, providing a universal anonymous network layer with end-to-end enc… | 92 | 4241 | active |
| fw876/helloworld A collection of OpenWrt packages (including Xray-core and related proxy tools) distributed as a git repository that can be cloned, added as… | 99 | 4231 | active |
| google/tamperchrome Tamper Dev is a browser extension that intercepts and edits HTTP/HTTPS requests and responses in real time without requiring a proxy or aux… | 50 | 4227 | active |
| JaveleyQAQ/WeChatOpenDevTools-Python A Python tool that force-enables the hidden developer tools (F12) in WeChat mini programs and WeChat's built-in browser. It is a Python rew… | 17 | 4225 | active |
| NoName-exe/revanced-extended ReVanced eXtended (now Morphe) is a Magisk/KernelSU module builder that patches YouTube and YouTube Music APKs with ad-blocking and feature… | 98 | 4223 | active |
| wux1an/wxapkg A cross-platform desktop GUI tool built with Wails for scanning, decrypting, and unpacking WeChat mini-program .wxapkg files. It restores t… | 64 | 4206 | active |
| guelfoweb/knockpy KnockPy is a modular Python 3 CLI tool for enumerating subdomains of a target domain using passive reconnaissance sources and DNS bruteforc… | 58 | 4204 | active |
| mandiant/flare-floss FLOSS (FLARE Obfuscated String Solver) is a Python CLI tool from Mandiant that automatically extracts and deobfuscates strings from malware… | 88 | 4199 | active |
| fwupd/fwupd fwupd is a system daemon for Linux that enables session software to safely and automatically update device firmware. It provides a D-Bus in… | 98 | 4192 | stable |
| hellzerg/optimizer Optimizer is a Windows GUI configuration utility for enhancing privacy and security, applying system tweaks, disabling telemetry, cleaning … | 10 | 18244 | maintenance |
| nextdns/nextdns NextDNS CLI is an open-source command-line client (written in Go) that connects to NextDNS's DNS-over-HTTPS service, acting as a local DoH … | 90 | 4184 | active |
| RetireJS/retire.js Retire.js is a scanner that detects the use of JavaScript libraries and Node.js modules with known vulnerabilities, available as a CLI scan… | 95 | 4180 | active |
| ivre/ivre IVRE is an open-source network recon framework written in Python that collects, stores, and analyzes network intelligence from active scann… | 66 | 4177 | active |
| Bubka/2FAuth 2FAuth is a self-hosted web application for managing Two-Factor Authentication accounts and generating TOTP, HOTP, and Steam Guard security… | 97 | 4173 | active |
| square/Valet Valet is a Swift library that simplifies securely storing data in the iOS, tvOS, watchOS, and macOS Keychain. It wraps the Keychain's compl… | 84 | 4170 | stable |
| bitcoin-wallet/bitcoin-wallet Bitcoin Wallet is a standalone Bitcoin payment app for Android devices that runs its own Bitcoin node via bitcoinj, requiring no centralize… | 33 | 4164 | active |
| google/nsjail NsJail is a lightweight Linux process isolation tool that uses namespaces, cgroups, rlimits, and seccomp-bpf syscall filters (via the Kafel… | 87 | 4152 | stable |