Best open source security and privacy tools
140 tools ranked by GitHub stars
Password managers, VPNs, ad blockers, identity servers and security testing tools.
Sherlock96.5k
sherlock-project/sherlock
Finds social media accounts by username across hundreds of networks.
HackingTool81.7k
Z4nzu/hackingtool
Menu-driven collection of penetration testing tools that installs and launches many hacking utilities from one place.
Strix73.9k
usestrix/strix
Open source AI penetration testing tool that finds vulnerabilities in your app.
Vaultwarden70.3k
dani-garcia/vaultwarden
Lightweight Bitwarden compatible password manager server for self hosting.
Alternative to: Bitwarden, 1Password
uBlock Origin69.1k
gorhill/uBlock
Efficient open source ad and tracker blocker browser extension.
Alternative to: AdBlock Plus
Pi-hole61.7k
pi-hole/pi-hole
Network-wide ad blocker that works at the DNS level and can run on a Raspberry Pi.
Alternative to: AdGuard
JADX51.6k
skylot/jadx
Decompiles Android Dex and APK files back to readable Java source code, with a graphical interface.
mitmproxy46.7k
Interactive intercepting HTTP and HTTPS proxy for inspecting traffic.
Maigret39.7k
Collects a profile of a person by username across thousands of sites.
Metasploit Framework39.3k
Widely used modular framework for penetration testing and exploit development.
Trivy39k
Scanner for vulnerabilities, misconfigurations and secrets in containers and code.
sqlmap38.9k
Automatic SQL injection detection and database takeover tool used in penetration testing.
AdGuard Home38.2k
Network-wide ad and tracker blocking DNS server that you run on your own network.
Keycloak37.7k
Open source identity and access management with single sign-on for modern apps and services.
Frigate37.3k
NVR with real-time local object detection for IP cameras, built to work with Home Assistant.
Vault36.5k
Securely stores and controls access to secrets, tokens, keys and certificates.
CyberChef36.3k
Browser-based toolbox for encryption, encoding, compression and data analysis operations.
Web Check35.4k
All-in-one OSINT tool that reports DNS, SSL, headers and security details of any website.
PentAGI33.4k
Fully autonomous AI agent system that runs complex penetration tests.
Nuclei32.6k
Fast, customizable vulnerability scanner driven by YAML templates from a global security community.
JumpServer31.9k
Open source privileged access management and bastion host platform.
Gitleaks30.7k
Scans git repositories for leaked passwords, keys and other secrets.
Infisical30.3k
Open source platform for managing secrets, certificates and access.
KeePassXC29.8k
Cross-platform password manager that stores credentials in a local encrypted database.
Authelia29.6k
Single sign-on and multi-factor authentication portal for web apps.
Setup IPsec VPN29k
Sets up your own IPsec VPN server in minutes with scripts or Docker.
TruffleHog28.9k
Scans code repositories, cloud storage and other sources for leaked credentials, then verifies whether the secrets still work.
ungoogled-chromium28.2k
Chromium web browser with Google integration removed for privacy.
hashcat27.3k
World's fastest and most advanced password recovery utility.
Apktool27k
Tool for reverse engineering and rebuilding Android APK files.
authentik26.2k
Identity provider and SSO server for authentication and user management.
masscan26.1k
Asynchronous TCP port scanner fast enough to scan the entire Internet in minutes by sending SYN packets.
radare225.3k
UNIX-like reverse engineering framework and command line toolset.
SkillSpector24.5k
Scans AI agent skills for vulnerabilities and malicious patterns.
Social Analyzer24.5k
OSINT tool that finds a person's profiles across 1000+ social sites.
SpiderFoot24.4k
Automates OSINT collection for threat intelligence and attack surface mapping.
age24.2k
Simple, modern command line tool for encrypting files with small explicit keys.
Brave24.1k
Privacy-focused web browser that blocks ads and trackers by default.
Anubis24k
Reverse proxy that filters out AI crawlers and bots by challenging incoming HTTP requests.
osquery23.7k
Tool that exposes the operating system as a database you can query with SQL.
SOPS23.6k
Simple and flexible tool for managing and encrypting secrets in files.
SafeLine23.2k
Self-hosted web application firewall and reverse proxy that protects sites from attacks.
Frida22.7k
Dynamic instrumentation toolkit for injecting code into running apps and inspecting them.
Helium22.4k
Privacy-focused web browser based on ungoogled Chromium that aims to be fast and honest.
MobSF22.1k
Automated all-in-one security analysis platform for Android and iOS apps.
mimikatz22k
Tool for exploring Windows credentials and security weaknesses.
Ciphey21.7k
Automatically decrypts and decodes text without knowing the key or cipher.
Vulhub21.4k
Pre-built vulnerable environments based on Docker Compose for security practice.
Teleport21.1k
Platform for secure access to servers, databases and Kubernetes clusters.
PEASS-ng20.8k
Script suite that scans systems for privilege escalation paths during security testing.
RustScan20.7k
Modern, fast port scanner that checks all ports in seconds and can pass the results to Nmap.
Bitwarden Server20.6k
Backend of the Bitwarden password manager, including the API, identity service and database, deployed with Docker.
Bettercap20.2k
Swiss Army knife for reconnaissance and attacks on Wi-Fi, BLE and IP networks.
Cutter20.2k
Free and open source reverse engineering platform powered by Rizin.
Sandboxie19.9k
Windows sandbox tool that runs programs in an isolated environment.
Fail2Ban19k
Daemon that bans hosts causing repeated authentication errors.
PhoneInfoga18.4k
OSINT tool that gathers information about phone numbers, such as country, carrier and line type.
theHarvester18.2k
OSINT tool that gathers emails, subdomains, hosts and employee names from public sources for penetration tests.
Katana17.8k
Next-generation web crawling framework used in security testing to quickly map sites and JavaScript endpoints.
Ory Hydra17.6k
OpenID Certified OAuth 2.1 and OpenID Connect provider server.
Wazuh17.6k
Unified XDR and SIEM security platform for endpoints and cloud workloads.
Semgrep17.5k
Lightweight static analysis tool that finds bugs and security issues across many languages.
ffuf17k
Fast web fuzzer written in Go that brute-forces directories, parameters and virtual hosts.
Lantern16.7k
Open-source VPN for speed, privacy and circumventing censorship.
Lynis16.6k
Security auditing tool for Linux, macOS and UNIX systems that reports hardening suggestions.
Cryptomator16.5k
Client-side encryption for your cloud files on Windows, macOS and Linux.
openvpn-install (angristan)16.2k
Script that sets up your own OpenVPN server on Debian, Ubuntu, Fedora and similar Linux systems in minutes.
ZAP16.1k
Free, open-source web application security scanner and intercepting proxy used for penetration testing.
AmneziaVPN15.8k
VPN client that sets up and connects to your own self-hosted server.
MVT15.8k
Forensic toolkit for finding traces of spyware on mobile devices.
Bytecode Viewer15.7k
Reverse engineering suite for Java JAR and Android APK files, with decompiler, editor and debugger.
eCapture15.5k
Captures SSL/TLS traffic as plaintext using eBPF, with no MITM proxy or custom CA needed.
ZITADEL15.5k
Identity infrastructure for authentication and access management.
CrowdSec15.5k
Community-driven IDS/IPS and WAF that detects malicious IPs from logs and blocks them.
OWASP Amass15.5k
OWASP project that maps an organization's attack surface and discovers external assets such as subdomains.
Osintgram15.4k
OSINT tool for Instagram with an interactive shell for analyzing public account data.
Social-Engineer Toolkit15.4k
Toolkit that simulates social engineering attacks such as phishing for penetration testing.
SuperTokens15.3k
Open-source authentication alternative to Auth0 and Firebase Auth.
OAuth2 Proxy15.3k
Reverse proxy that adds OAuth2 authentication with Google, Azure and others.
Prowler15.2k
Cloud security tool that audits AWS, Azure, GCP and Kubernetes and checks them against compliance frameworks.
dirsearch15k
Command line web path scanner that uses wordlists to find hidden directories and files on web servers.
Wifiphisher14.9k
Rogue access point framework for Wi-Fi security testing and phishing awareness exercises.
Logto14.8k
Authentication and authorization infrastructure for SaaS and AI apps, with sign-in, SSO and role-based access.
OpenVPN14.8k
Open-source VPN daemon that builds secure point-to-point and site-to-site tunnels.
Casdoor14.8k
Open-source identity and access management platform with SSO, OAuth and OIDC support, including agent access.
Subfinder14.7k
Passive reconnaissance tool that quickly finds valid subdomains of a domain by querying public sources.
Binwalk14.6k
Firmware analysis tool that scans images and extracts the files and data embedded in them.
OWASP Juice Shop14.4k
OWASP web application full of deliberate security flaws, used to learn and practice hacking and security testing.
Gobuster14.3k
Go tool that brute-forces hidden directories, files, DNS subdomains and virtual host names.
OpenSnitch14.3k
GNU/Linux application firewall that asks you whether each program may make a network connection.
Bitwarden14.2k
Web, browser extension, desktop and CLI clients for the Bitwarden password manager
Portmaster14k
Application firewall and DNS blocker that stops tracking and mass surveillance on your device
DVWA14k
Deliberately vulnerable PHP web app for practicing security testing and penetration skills
Ory Kratos13.9k
Headless, cloud-native authentication and identity management server
Nmap13.9k
Widely used network scanner that discovers hosts and open ports for security auditing
John the Ripper13.9k
Offline password cracker that supports hundreds of hash and cipher types
LuLu13.5k
Free open-source macOS firewall that controls outgoing network connections
Aegis Authenticator13.5k
Free, secure and open-source Android app for managing 2FA tokens
git-secrets13.4k
Tool that prevents you from committing secrets and credentials into git repositories
HexStrike AI13.4k
MCP server that lets AI agents drive a large set of penetration testing tools
IDA Pro MCP13.4k
AI-powered reverse engineering assistant that bridges IDA Pro with language models
Photon13.3k
Fast Python web crawler for OSINT that collects links, emails, files and other data from a site.
RouterSploit13.3k
Exploitation framework for testing embedded devices and routers for vulnerabilities
Grype13.2k
Scans container images and filesystems for known vulnerabilities, including OS and language packages
KeeWeb13k
Free cross-platform password manager compatible with KeePass databases
ESP32 Marauder13k
Firmware with WiFi and Bluetooth offensive and defensive tools for the ESP32
Scapy12.7k
Interactive packet manipulation tool for crafting and analyzing network packets
Hetty12.5k
HTTP toolkit and intercepting proxy for security researchers, with a built-in web interface
THC Hydra12.5k
Fast network login cracker that supports many protocols for password testing
Open Policy Agent12.4k
General-purpose policy engine for authorization and compliance in cloud-native systems
fsociety12.4k
Collection of penetration testing tools gathered in one framework and installed with a single script
Vuls12.3k
Agent-less vulnerability scanner for Linux, containers and WordPress
Sliver12.2k
Command and control framework for adversary emulation and red team operations
VeraCrypt12.1k
Free disk encryption software that protects drives and volumes with strong cryptography.
Detect It Easy11.9k
Program for determining file types and detecting packers and compilers
Kubescape11.8k
Kubernetes security platform for IDEs, CI/CD pipelines and clusters
Pi-hole Docker11.7k
Official Docker image of Pi-hole, which blocks ads and trackers network wide via DNS.
Osiris11.5k
Real-time OSINT dashboard that gathers global intelligence data in one place.
Sn1per11.5k
Automated penetration testing and attack surface management platform.
OSV-Scanner11.4k
Vulnerability scanner that checks dependencies against the OSV database.
Sigma11.4k
Generic signature format and rules for detecting threats in log events.
Apereo CAS11.4k
Enterprise identity and single sign on server supporting CAS, OAuth, OpenID Connect and SAML
Dex11.2k
OpenID Connect and OAuth 2.0 identity provider with pluggable connectors.
BunkerWeb11.2k
Open source, cloud native web application firewall that runs as a reverse proxy in front of your sites
pwndbg11.2k
GDB and LLDB plugin for exploit development and reverse engineering.
NopeCHA11.1k
Browser extension that solves CAPTCHAs automatically and also works with Selenium and Puppeteer
BeEF11.1k
Penetration testing tool focused on exploiting web browsers.
LaZagne11.1k
Tool that recovers stored passwords and credentials from a computer.
BBOT11k
Recursive internet scanner for reconnaissance of domains and infrastructure.
Nikto10.8k
Web server scanner that checks for known vulnerabilities, outdated software and misconfigurations
BloodHound Legacy10.6k
Maps Active Directory relationships with graph theory to find attack paths to domain admin
httpx10.6k
Fast multi-purpose HTTP toolkit for probing web servers in bulk and collecting their details
check-if-email-exists10.4k
Checks if an email address exists without sending any email.
OpenCTI10.3k
Open platform for managing and sharing cyber threat intelligence.
OneForAll10.1k
Powerful subdomain collection and discovery tool that merges results from many sources
Flowsint10.1k
Visual graph based investigation and OSINT platform that maps links between entities
Pocket ID10k
User friendly OIDC identity provider that signs you in with passkeys instead of passwords
No tools match these filters.