# google/honggfuzz

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

Repository: https://github.com/google/honggfuzz
Canonical: https://ross.abutalabs.com/products/honggfuzz
Homepage: https://honggfuzz.dev
Language: C
License: Apache-2.0
License Family: permissive
Topics: fuzzing, security, c
Last push: 2026-06-19T13:47:59+00:00

## Health v2 (maintenance only)
Score: 62/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 88, release rhythm 8, longevity 100
- inputs: {"age_days": 4136, "days_push": 75, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3376, forks 535 (observed 2026-08-28T04:07:58.510077+00:00)

## What it is
Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in binaries. It is multi-process and multi-threaded, supports persistent in-process fuzzing at up to 1M iterations/sec, and runs on Linux, macOS, Android, NetBSD, FreeBSD, and Windows (Cygwin).

## Use cases
- fuzz a C/C++ binary to find memory corruption bugs
- find security vulnerabilities in a parser or file format library
- run coverage-guided fuzzing with hardware tracing on Intel CPUs
- fuzz an API in persistent mode for maximum throughput
- build a corpus automatically from an empty input directory
- detect hidden crashes and hijacked signals in a target process
- fuzz OpenSSL, Apache, or other open-source servers for CVEs

## When to choose
- you need a fast, multi-core coverage-guided fuzzer for C/C++ targets
- you want hardware-based feedback via Intel BTS/PT
- you need persistent-mode fuzzing with very high iteration rates
- you want a fuzzer that can start from an empty corpus
- you need broad OS support including BSD and Android

## When to avoid
- you fuzz JavaScript or managed-language code without a native harness
- you prefer a fuzzer with a rich web dashboard or cloud orchestration
- you need Windows support beyond Cygwin
- you want a fuzzer with extensive structured-input grammar support out of the box

## Facets
- artifact type: cli-tool
- maturity: active
- function: fuzzing, security, vulnerability-scanning, testing
- domain: security, developer-tools, testing, penetration-testing
- platform: windows, cli, cpp, c
- tags: coverage-guided-fuzzing, persistent-fuzzing, evolutionary-fuzzing, ptrace, intel-pt, security-testing, c, linux, macos, android

## Member repositories
- google/honggfuzz (main) score 62

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:58.510077+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:39:43.577458+00:00, confidence not recorded.
  - readme: https://github.com/google/honggfuzz (fetched 2026-08-28T04:07:58.510077+00:00, sha c5f2c5e9d4b6)
  - homepage: https://honggfuzz.dev (fetched 2026-08-29T09:33:30.394888+00:00, sha 03016750d613)
- Data as of 2026-08-30T08:39:29.467469+00:00.