gophish/gophish

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

14152 stars · 2946 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Gophish is an open-source phishing framework for running phishing simulations and security awareness training. It provides a web UI and REST API for creating email templates, launching campaigns, and tracking opens, clicks, and credential submissions in real time.

Use cases

• run a phishing awareness campaign against employees
• test how many users click phishing links
• simulate credential-harvesting pages for security training
• track email opens and clicks for a red team engagement
• automate phishing campaigns via the REST API
• import existing websites and emails as phishing templates

When to choose

• you need authorized phishing simulations or security awareness training
• you want a self-hosted tool with a web UI and REST API
• you need cross-platform binaries or a Docker deployment
• you want real-time tracking of opens, clicks, and submissions

When to avoid

• you intend to phish people without authorization - this is illegal
• you need a full penetration testing suite beyond email phishing
• you require commercial support or enterprise compliance features

Facets

application · maturity stable

security email web-framework api-framework http-server developer-tools security penetration-testing self-hosted web-development windows self-hosted go cross-platform phishing phishing-simulation security-awareness-training social-engineering red-team email-tracking rest-api linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="gophish/gophish")