Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| guardianproject/orbot-android Orbot is a free Android app that routes device internet traffic through the Tor network, acting as a VPN and proxy to encrypt and anonymize… | 99 | 3623 | active |
| SRT (Secure Reliable Transport) SRT (Secure Reliable Transport) is an open-source transport protocol and C++ library for ultra-low-latency live video and audio streaming o… | 93 | 3613 | stable |
| nmap/npcap Npcap is the Nmap Project's packet capture and injection library for Microsoft Windows, implementing the portable Pcap API via a custom NDI… | 91 | 3604 | active |
| allinssl/allinssl AllinSSL is a self-hosted, open-source SSL certificate lifecycle management platform with a web dashboard. It automates certificate applica… | 77 | 3604 | active |
| Pentest-Windows A pre-built Windows 11 penetration testing virtual machine image bundling 400+ security tools and scripts, distributed for VMware, Parallel… | 43 | 3599 | active |
| frknkrc44/HMA-OSS HMA-OSS is a Zygisk module that hides your app list, settings, and package installers from other apps on rooted Android devices. It is a Ko… | 84 | 3593 | active |
| animir/node-rate-limiter-flexible A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, … | 96 | 3589 | stable |
| Joern Joern is an open-source code analysis platform that generates code property graphs (CPGs) from source code, bytecode, and binaries for C/C+… | 95 | 3581 | active |
| acidanthera/AppleALC AppleALC is an open-source macOS kernel extension (kext) that enables native HD audio for codecs not officially supported by Apple, without… | 88 | 3579 | active |
| google/recaptcha Google's official PHP client library for verifying reCAPTCHA responses server-side, supporting both reCAPTCHA v2 and v3. It wraps the verif… | 97 | 3578 | active |
| microsoft/ebpf-for-windows eBPF for Windows is an MIT-licensed implementation of the eBPF runtime that runs on top of the Windows kernel, letting developers reuse fam… | 86 | 3573 | active |
| CAPEv2 CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior a… | 77 | 3573 | active |
| model-checking/kani Kani is a bit-precise model checker for Rust that formally verifies safety and correctness properties of Rust programs. It uses proof harne… | 94 | 3572 | active |
| bastillion-io/Bastillion Bastillion is a self-hosted, web-based SSH console and SSH key management platform that acts like a bastion host with a dashboard. It provi… | 100 | 3551 | active |
| theajack/disable-devtool A lightweight TypeScript library that disables browser developer tools with one line of code, blocking F12, right-click, and browser menu a… | 57 | 3546 | active |
| SpacehuhnTech/esp8266_deauther ESP8266 Deauther is open-source firmware that turns an ESP8266 microcontroller into a WiFi testing tool capable of scanning networks, sendi… | 23 | 14997 | maintenance |
| epinna/weevely3 Weevely is a weaponized web shell for post-exploitation that generates a small obfuscated PHP agent to upload to a target web server, provi… | 40 | 3541 | active |
| openwrt-xiaomi/xmir-patcher XMiR-Patcher is a Python-based firmware patcher for Xiaomi routers that exploits vulnerabilities to unlock SSH and install custom firmware … | 75 | 3539 | active |
| Meshbird Meshbird is an open-source cloud-native distributed private networking tool that creates encrypted peer-to-peer overlay networks across mul… | 51 | 3530 | active |
| stackrox/kube-linter KubeLinter is a static analysis CLI tool that checks Kubernetes YAML files, Helm charts, and Kustomize manifests against security and produ… | 84 | 3527 | active |
| BlackArch Linux BlackArch Linux is an Arch Linux-based penetration testing distribution bundling over 2,800 security tools for penetration testers and secu… | 76 | 3524 | active |
| Wifiphisher Wifiphisher is a rogue Access Point framework for Wi-Fi security testing and red team engagements, enabling man-in-the-middle positioning v… | 57 | 14873 | maintenance |
| gtworek/PSBits A collection of relatively simple C and PowerShell snippets for digging deeper into Windows internals, security, and forensics. Each folder… | 72 | 3518 | active |
| PLFJY/ContextMenuMgr Context Menu Manager Plus is a Windows utility for managing right-click context menu entries, including classic and Windows 11 menus. It in… | 82 | 3517 | active |
| builtbybel/FluentTweaker FluentTweaker is a modern Windows tweaking application built with WinUI 3 that lets power users adjust UI, taskbar, privacy, AI features, E… | 67 | 3516 | active |
| ConnectBot ConnectBot is an open-source Secure Shell (SSH) client for Android that lets users open encrypted shell sessions and transfer files with re… | 99 | 3515 | active |
| onecli/onecli OneCLI is an open-source platform that gives every employee a personal, sandboxed AI agent, with all tool calls routed through a gateway th… | 74 | 3511 | active |
| benbaker76/Hackintool Hackintool is a macOS GUI utility for vanilla Hackintosh hardware patching, best known for Intel framebuffer patching from Sandy Bridge thr… | 69 | 3504 | active |
| fofapro/vulfocus Vulfocus is a self-hosted vulnerability integration platform that runs vulnerability environments as Docker images with one-click startup. … | 38 | 3503 | active |
| t3l3machus/hoaxshell Hoaxshell is a Windows reverse shell payload generator and handler that abuses the HTTP(S) protocol to establish a beacon-like reverse shel… | 32 | 3499 | active |
| straight-tamago/misakaX misakaX is a desktop application for macOS and Windows that customizes iOS/iPadOS 16.0-18.2 beta devices by exploiting the bug behind Troll… | 34 | 3495 | active |
| vulnersCom/nmap-vulners A collection of Nmap NSE scripts that enrich service scans with CVEs, CVSS scores and known exploits from the Vulners database. It fingerpr… | 95 | 3494 | active |
| KOWX712/Tricky-Addon-Update-Target-List A KernelSU/Apatch/Magisk WebUI addon for configuring Tricky Store's target.txt on rooted Android devices. It provides a graphical interface… | 84 | 3493 | active |
| sentient-agi/OML-1.0-Fingerprinting A Python library for embedding secret cryptographic fingerprints into LLMs via fine-tuning, so model owners can prove ownership and detect … | 13 | 3493 | active |
| TrustTunnel TrustTunnel is a modern open-source VPN protocol originally developed by AdGuard VPN, with this repository containing the VPN endpoint (ser… | 81 | 3489 | active |
| BloodHound Community Edition BloodHound Community Edition is a free, open-source application that uses graph theory to reveal hidden relationships and attack paths in A… | 91 | 3487 | active |
| ukanth/afwall AFWall+ is an open-source firewall application for rooted Android devices built on Linux iptables. It provides per-app granular control ove… | 91 | 3487 | active |
| sigp/lighthouse Lighthouse is an open-source Ethereum consensus (beacon chain) client written in Rust, maintained by Sigma Prime. It implements the Ethereu… | 98 | 3477 | stable |
| oblador/react-native-keychain A React Native library providing access to the iOS Keychain and Android Keystore for securely storing credentials such as passwords, tokens… | 66 | 3477 | stable |
| LSPosed/CorePatch Core Patch N is an Xposed module that modifies Android's package manager service to bypass installation restrictions. It disables APK signa… | 86 | 3476 | active |
| TextAttack TextAttack is a Python framework for generating adversarial examples against NLP models, as well as for data augmentation and model trainin… | 80 | 3471 | active |
| ropnop/kerbrute Kerbrute is a Go-based CLI tool for brute-forcing and enumerating valid Active Directory accounts through Kerberos Pre-Authentication. It o… | 23 | 3452 | stable |
| google/OpenSK OpenSK is an open-source Rust implementation of a FIDO2/FIDO U2F security key, developed by Google as a research platform. It can run as fi… | 67 | 3451 | active |
| claration/Impactor Impactor is an open-source, cross-platform GUI application for signing and sideloading IPA apps onto iOS, iPadOS, and tvOS devices using an… | 82 | 3435 | active |
| L-codes/Neo-reGeorg Neo-reGeorg is a Python CLI tool that generates encrypted tunnel server files (aspx/jsp/php/etc.) to be uploaded to a compromised web serve… | 69 | 3433 | active |
| Snort++ Snort 3 (Snort++) is the next-generation open-source intrusion prevention system (IPS) written in C++17, supporting multi-threaded packet p… | 77 | 3428 | active |
| adrienverge/openfortivpn openfortivpn is a command-line client for PPP+TLS VPN tunnel services, compatible with Fortinet VPN gateways. It spawns a pppd process and … | 76 | 3428 | active |
| decalage2/oletools oletools is a Python package of tools for analyzing Microsoft OLE2 (Structured Storage/Compound File Binary Format) files and MS Office doc… | 49 | 3428 | active |
| hufrea/byedpi ByeDPI (ciadpi) is a C program implementing various DPI (Deep Packet Inspection) bypass methods, running as a local SOCKS proxy server. It … | 62 | 3427 | active |
| EntySec/Ghost Ghost Framework is a Python-based Android post-exploitation framework that leverages the Android Debug Bridge (ADB) to gain remote access t… | 51 | 3425 | active |
| ph4ntonn/Stowaway Stowaway is a multi-hop proxy tool written in Go, designed for penetration testers to route external traffic through chains of nodes into r… | 51 | 3419 | active |
| iamlive A Go CLI tool that generates IAM policies by monitoring AWS, Azure, or GCP API calls via client-side monitoring or an embedded proxy. It ob… | 77 | 3416 | active |
| Yamato-Security/hayabusa Hayabusa is a fast, Rust-based Windows event log analysis tool that generates forensic timelines and performs threat hunting using Sigma de… | 95 | 3409 | active |
| Moli-X/Resources A curated collection of rewrite configurations, JavaScript scripts, and plugins for the iOS proxy apps QuantumultX, Loon, and Surge. It agg… | 75 | 3409 | active |
| paralleldrive/cuid2 Cuid2 is a JavaScript library and CLI for generating secure, collision-resistant unique identifiers optimized for horizontal scaling and pe… | 72 | 3402 | active |
| robinrodricks/FluentFTP FluentFTP is a fully managed FTP and FTPS client library for .NET and .NET Standard, written entirely in C# with no external dependencies a… | 66 | 3402 | stable |
| paragonie/paseto A PHP reference implementation of PASETO (Platform-Agnostic Security Tokens), a secure alternative to JWT/JWS/JWE. It supports PASETO proto… | 36 | 3398 | stable |
| google/honggfuzz Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in bin… | 66 | 3397 | active |
| FairwindsOps/polaris Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration against 30+ built-in best-pract… | 97 | 3396 | active |
| H4ckForJob/dirmap Dirmap is an advanced web directory and file scanning tool written in Python, designed to be more powerful than DirBuster, Dirsearch, cansi… | 65 | 3375 | stable |
| google/differential-privacy Google's collection of differential privacy libraries for computing ε- and (ε, δ)-differentially private statistics over datasets. It inclu… | 75 | 3369 | active |
| PatchMon/PatchMon PatchMon is a self-hostable, AGPL-licensed Linux patch management and server monitoring platform with a lightweight outbound-only agent and… | 78 | 3368 | active |
| AChep/keyguard-app Keyguard is a multiplatform password manager client for the Bitwarden platform and KeePass (KDBX) files, built with Kotlin and Jetpack Comp… | 90 | 3366 | active |
| SteamAutoCracks/Steam-auto-crack A C# tool that automatically cracks Steam games by unpacking SteamStub-protected executables and applying the Goldberg Steam emulator. It a… | 97 | 3360 | active |
| pypykatz pypykatz is a pure Python implementation of parts of Mimikatz, the well-known Windows credential extraction tool. It parses LSASS process m… | 59 | 3359 | active |
| dbisu/pico-ducky A project that turns a Raspberry Pi Pico into a USB Rubber Ducky-style HID injection device running CircuitPython. It executes Ducky Script… | 65 | 3355 | active |
| RNCryptor RNCryptor is a Swift (and Objective-C) library wrapping CommonCrypto AES encryption, implementing a cross-language encrypted data format (v… | 25 | 3355 | stable |
| golang/crypto golang/crypto is the official supplementary cryptography library for the Go programming language, providing packages beyond the standard li… | 77 | 3351 | stable |
| ergochat/ergo Ergo is a modern IRC server (ircd) written in Go that integrates services (NickServ, ChanServ, HostServ) and bouncer functionality such as … | 87 | 3350 | active |
| hanwckf/rt-n56u A custom Padavan-based firmware for the ASUS RT-N56U and other MT7621-based routers, written in C. It gives power users full control over t… | 23 | 3346 | active |
| randombit/botan Botan is a C++ cryptography library offering TLS 1.2/1.3, X.509 PKI, modern AEAD ciphers, post-quantum algorithms, and hardware token suppo… | 77 | 3336 | stable |
| almandin/fuxploider Fuxploider is an open-source penetration testing tool that automates detection and exploitation of file upload form vulnerabilities. It ide… | 28 | 3332 | active |
| BlueWallet BlueWallet is an open-source, self-custody Bitcoin and Lightning Network wallet for iOS and Android, built with React Native and TypeScript… | 99 | 3322 | active |
| chipsec/chipsec CHIPSEC is a Python framework for analyzing the security of PC platforms, including hardware, system firmware (BIOS/UEFI), and platform com… | 98 | 3314 | active |
| express-rate-limit/express-rate-limit A rate-limiting middleware library for the Express web server, written in TypeScript. It limits repeated requests per IP or key over config… | 99 | 3311 | stable |
| Telegram-FOSS-Team/Telegram-FOSS An unofficial, FOSS-friendly fork of the official Telegram client for Android that removes proprietary binaries and replaces them with free… | 23 | 3309 | active |
| basil00/WinDivert WinDivert is a user-mode packet interception library for Windows that allows applications to capture, modify, drop, and re-inject network p… | 23 | 3305 | stable |
| s0md3v/Smap Smap is a passive port scanner powered by Shodan.io's free API that serves as a drop-in replacement for Nmap, accepting the same command-li… | 83 | 3299 | active |
| goodwithtech/dockle Dockle is a container image linter written in Go that checks Docker images against security best practices and CIS Benchmarks. It runs as a… | 62 | 3298 | active |
| Tornaco/Thanox Thanox is an Android system manager app delivered as an Xposed (LSPosed) module, with Magisk and Shizuku activation options, that hooks int… | 96 | 3296 | active |
| JPCERTCC/LogonTracer LogonTracer is a self-hosted DFIR tool that visualizes Windows Active Directory logon-related event logs as a graph of hosts and accounts t… | 74 | 3290 | active |
| cyu/rack-cors Rack middleware that adds Cross-Origin Resource Sharing (CORS) support to Rack-compatible Ruby web applications, including Rails. It lets y… | 38 | 3290 | active |
| techgaun/github-dorks A Python CLI tool that automates GitHub code searches using a curated list of dorks to find leaked secrets like credentials, private keys, … | 65 | 3287 | active |
| jsha/minica minica is a small Go CLI tool that acts as a minimal certificate authority for generating root and leaf TLS certificates with keys. It is d… | 37 | 3285 | active |
| deltazefiro/Amarok-Hider Amarok is a lightweight Android privacy app that hides private files and apps with a single click by obfuscating file signatures or permiss… | 72 | 3284 | active |
| netnr/kms A public KMS activation service (hosted at skms.netnr.eu.org) plus documentation for activating Windows and Office via slmgr commands. The … | 62 | 3282 | active |
| tuic-protocol/tuic TUIC is a standardized, implementation-agnostic network proxy protocol specification for relaying TCP and UDP traffic over QUIC with 0-RTT … | 29 | 3282 | active |
| dafthack/MailSniper MailSniper is a PowerShell-based penetration testing tool for searching email in Microsoft Exchange environments for sensitive terms like p… | 75 | 3281 | active |
| Legrandin/pycryptodome PyCryptodome is a self-contained Python package of low-level cryptographic primitives, forked from PyCrypto with an almost drop-in compatib… | 100 | 3276 | active |
| open-policy-agent/conftest Conftest is a CLI utility for writing tests against structured configuration data using the Open Policy Agent Rego language. It validates f… | 98 | 3274 | active |
| assetnote/kiterunner Kiterunner is a fast content discovery tool written in Go that bruteforces files, folders, and API routes on web servers. It uses a dataset… | 60 | 3272 | stable |
| Blokada Blokada is an open-source suite of mobile privacy apps for Android and iOS, including an ad blocker, VPN, and parental control app. It offe… | 67 | 3266 | active |
| QiuChenly/CoreInject CoreInject (successor to InjectLib) is a macOS application injection and binary-patching tool by QiuChenly, distributed alongside a communi… | 80 | 3264 | active |
| Checked C Checked C is an extension to the C programming language that adds bounds checking and improved type safety through opt-in annotations, impl… | 23 | 3263 | active |
| homenc/HElib HElib is an open-source C++ library implementing homomorphic encryption, supporting the BGV scheme with bootstrapping and the CKKS approxim… | 23 | 3252 | stable |
| rtcatc/Packer-Fuzzer Packer Fuzzer is a Python-based security scanner that targets websites built with JavaScript module bundlers like Webpack. It automatically… | 23 | 3250 | active |
| Tink Tink is a multi-language, cross-platform open source cryptographic library from Google that provides secure, easy-to-use APIs for encryptio… | 10 | 13538 | maintenance |
| the-tcpdump-group/tcpdump tcpdump is a powerful command-line packet analyzer that captures and dissects network traffic using libpcap, with BPF-based filtering and s… | 77 | 3246 | active |
| Devolutions/IronRDP IronRDP is a modular Rust implementation of the Microsoft Remote Desktop Protocol (RDP), providing PDU codecs, connection/session state mac… | 95 | 3243 | active |
| biggerstar/wedecode Wedecode is a fully automated tool that decompiles WeChat mini-program and mini-game wxapkg packages back into readable source code (JS, WX… | 66 | 3239 | active |