Open Source Security & Privacy Tools

PayloadsAllTheThings ★ 82K

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Puter ★ 44K

A full desktop environment that runs in your browser

Mattermost ★ 40K

Secure collaboration platform for mission-critical work

Tailscale ★ 38K

Zero-config VPN with WireGuard for secure networking

Keycloak ★ 38K

Secure authentication and access control made simple

HashiCorp Vault ★ 36K

Secure storage and access control for secrets and sensitive data

Anthropic-Cybersecurity-Skills ★ 35K

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud

pentagi ★ 33K

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

ProjectDiscovery ★ 33K

Advanced vulnerability detection and management platform

JumpServer ★ 32K

Secure access management for modern IT infrastructure

Better Auth ★ 31K

Framework-agnostic authentication for TypeScript applications

Netbird ★ 31K

Zero Trust networking with WireGuard-based secure connectivity

Infisical ★ 30K

Secure secret management for modern development teams

Ente ★ 30K

Secure, private photo storage and sharing solution

Signal ★ 30K

Private messaging with end-to-end encryption

authelia ★ 29K

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

Authentik ★ 26K

Take control of your identity with a secure, flexible solution

Pangolin ★ 23K

Zero trust network access that's better than VPN

casbin ★ 20K

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

Sa-Token ★ 19K

✨ 开源、免费、一站式 Java 权限认证框架，让鉴权变得简单、优雅！—— 登录认证、权限认证、分布式 Session 会话、微服务网关鉴权、SSO 单点登录、OAuth2.0 统一认证、jwt 集成、API Key 秘钥授权、API 参数签名

openGym ★ 19K

Self-hosted gym & body-weight tracker — plan routines, log workouts (supersets, warm-ups, cardio), see which muscles are trained, fatigued or detrained, import

hydra ★ 18K

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user ca

PentestGPT ★ 16K

Automated Penetration Testing Agentic Framework Powered by Large Language Models

ecapture ★ 16K

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

Zitadel ★ 15K

Secure, customizable identity infrastructure for developers

crowdsec ★ 15K

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

Osintgram ★ 15K

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

SuperTokens ★ 15K

Secure, customizable authentication for your applications

oauth2-proxy ★ 15K

A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

Logto ★ 15K

Secure, seamless authentication for modern applications

casdoor ★ 15K

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML

Ory ★ 14K

A certified and battle-tested identity solution

Unleash ★ 14K

Feature flags for rapid, risk-free software deployment

Element ★ 14K

Secure, decentralized messaging for teams and individuals

thc-hydra ★ 12K

hydra

vuls ★ 12K

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

cas ★ 11K

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

osv-scanner ★ 11K

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

dex ★ 11K

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

Fluxer ★ 11K

Open source messaging with privacy and community focus

django-allauth ★ 10K

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirro

pocket-id ★ 9.9K

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

FireZone ★ 9.2K

Fast, flexible VPN replacement with zero-trust security

certificates ★ 9.0K

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

rengine ★ 8.9K

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data corr

GrowthBook ★ 8.6K

Open-source A/B testing and feature flagging platform

tinyauth ★ 8.5K

The tiniest OpenID Certified™ authorization and authentication server you have ever seen.

reconftw ★ 8.3K

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Cap ★ 8.2K

Privacy-first CAPTCHA alternative with proof-of-work

cve ★ 8.2K

Gather and update all available and newest CVEs with their PoC.

Tuta ★ 8.1K

Secure email, calendar and contacts with end-to-end encryption

KeePassDX ★ 7.6K

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure

WhatWeb ★ 7.0K

Next generation web scanner

Hexclave ★ 6.9K

Modular auth, payments, emails, and analytics for your product

suricata ★ 6.8K

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata comm

Flagsmith ★ 6.6K

Feature flags and remote config for rapid deployment

AllHackingTools ★ 6.4K

All-in-One Hacking Tools For Hackers! And more hacking tools! For termux.

PhoneSploit-Pro ★ 6.4K

An all-in-one hacking tool to remotely take over Android devices.

keepass2android ★ 6.4K

Password manager app for Android

lesspass ★ 6.1K

:key: stateless open source password manager

Infosec_Reference ★ 6.0K

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

Permify ★ 6.0K

Build scalable authorization in minutes, not months

Nettacker ★ 5.7K

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

UnKey ★ 5.5K

Secure, scalable API key management for developers

pacu ★ 5.4K

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

cameradar ★ 5.3K

Cameradar hacks its way into RTSP videosurveillance cameras

Flipt ★ 4.9K

Git-native feature management for developers

GDA-android-reversing-Tool ★ 4.9K

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports mali

airgorah ★ 4.9K

A WiFi security auditing software

Cerbos ★ 4.6K

Secure, policy-based access control for modern applications

malicious-pdf ★ 4.5K

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and w

afrog ★ 4.4K

A Security Tool for Bug Bounty, Pentest and Red Teaming.

Zen ★ 4.3K

System-wide ad-blocking and privacy protection, no extensions needed

knockpy ★ 4.2K

Knock Subdomain Scan

Raccoon ★ 4.1K

A high performance offensive security tool for reconnaissance and vulnerability scanning

Cinny ★ 4.0K

Secure and elegant Matrix client for seamless conversations

Tracecat ★ 3.9K

Open source security automation platform for builders

oauth2-client ★ 3.8K

Easy integration with OAuth 2.0 service providers.

emba ★ 3.7K

EMBA - The firmware security analyzer

Certipy ★ 3.7K

Tool for Active Directory Certificate Services enumeration and abuse

Stoat ★ 3.4K

Group chat for friends and communities, without the baggage

dockle ★ 3.3K

Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

vouch-proxy ★ 3.3K

an SSO and OAuth / OIDC login solution for Nginx using the auth_request module

Opengrep ★ 3.3K

Open-source code security engine for developers

redamon ★ 3.3K

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approv

Pentest-Swarm-AI ★ 3.1K

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — su

voidauth ★ 2.9K

Single Sign-On for Your Self-Hosted Universe

Defguard ★ 2.9K

Zero-Trust VPN with built-in 2FA/MFA and SSO capabilities

ALTCHA ★ 2.9K

Next-Gen CAPTCHA and Spam Protection, GDPR compliant

authpass ★ 2.8K

AuthPass - Password Manager based on Flutter for all platforms. Keepass 2.x (KDBX 3 and KDBX 4) compatible.

bundler-audit ★ 2.8K

Patch-level verification for Bundler

Quiet ★ 2.7K

Serverless team chat over Tor, no phone number needed

sn0int ★ 2.6K

Semi-automatic OSINT framework and package manager

Wire ★ 2.6K

Secure collaboration platform with end-to-end encryption

brutespray ★ 2.6K

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

Peergos ★ 2.5K

Secure, private, and decentralized file storage

pac4j ★ 2.5K

Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

mCaptcha ★ 2.5K

Privacy-first proof-of-work CAPTCHA without user friction

artex-global ★ 2.5K

ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

certstrap ★ 2.5K

Tools to bootstrap CAs, certificate requests, and signed certificates.

find-sec-bugs ★ 2.5K

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

nfcgate ★ 2.4K

An NFC research toolkit application for Android

gokey ★ 2.4K

A simple vaultless password manager in Go

ezXSS ★ 2.4K

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

smart-sso ★ 2.3K

SpringBoot single sign-on authentication and authorization, implemented with OAuth 2.0, supporting cross-domain and distributed deployment.

caddy-security ★ 2.3K

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Git

polis ★ 2.3K

Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On

AutomatedLab ★ 2.2K

AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Wind

linWinPwn ★ 2.2K

linWinPwn is a bash script that streamlines the use of a number of Active Directory tools

Authgear ★ 2.1K

Managed identity and access management for any app

helm-secrets ★ 2.0K

A helm plugin that help manage secrets with Git workflow and store them anywhere

evillimiter ★ 2.0K

Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access

xxl-sso ★ 2.0K

A distributed single-sign-on framework.（单点登录框架XXL-SSO）

AngryOxide ★ 2.0K

802.11 Attack Tool

DSInternals ★ 2.0K

Directory Services Internals (DSInternals) PowerShell Module and Framework

FeatBit ★ 2.0K

Open-source feature flag management for seamless deployments

cset ★ 1.9K

Cybersecurity Evaluation Tool

nomore403 ★ 1.9K

403/401 bypass tool: finds HTTP access-control bypasses via path, method, header and raw-request mutations. Baseline diff, auto-calibration, replayable curl evi

linkedin2username ★ 1.9K

OSINT Tool: Generate username lists for companies on LinkedIn

chatgpt-web ★ 1.9K

A third-party ChatGPT Web UI page built with Express and Vue3, through the official OpenAI completion API. / 用 Express 和 Vue3 搭建的第三方 ChatGPT 前端页面, 基于 OpenAI 官方

fsociety ★ 1.9K

A Modular Penetration Testing Framework

inql ★ 1.8K

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Bu

npq ★ 1.8K

safely install npm packages by auditing them pre-install stage

One-Lin3r ★ 1.8K

Gives you one-liners that aids in penetration testing operations, privilege escalation and more

privacyidea ★ 1.8K

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP, FIDO Server)

SSTImap ★ 1.7K

Automatic SSTI detection tool with interactive interface

graudit ★ 1.7K

grep rough audit - source code auditing tool

enum4linux-ng ★ 1.7K

A next generation version of enum4linux (a Windows/Samba enumeration tool) with additional features like JSON/YAML export. Aimed for security professionals and

passforios ★ 1.6K

Pass for iOS - an iOS client compatible with Pass command line application.

slink ★ 1.6K

Self-hosted image hosting and sharing platform with private links, collections, S3/SMB storage, OIDC SSO and ShareX support.

GooFuzz ★ 1.6K

GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the

crlfuzz ★ 1.6K

A fast tool to scan CRLF vulnerability written in Go

pwd.sh ★ 1.6K

Manage secrets with Bash and GnuPG symmetric encryption

Tirreno ★ 1.6K

Security framework that protects from within your product

Tongsuo ★ 1.6K

铜锁/Tongsuo is a Modern Cryptographic Primitives and Protocols Library

clairvoyance ★ 1.6K

Obtain GraphQL API schema even if the introspection is disabled

mutillidae ★ 1.5K

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hac

rememory ★ 1.5K

a digital safe with multiple keys, held by people you trust

ssh-mitm ★ 1.5K

SSH-MITM - ssh audits made simple

Strongbox ★ 1.5K

A KeePass/Password Safe Client for iOS and OS X

fido2-net-lib ★ 1.5K

Passkeys, FIDO2 and WebAuthn .NET library.

rauthy ★ 1.4K

Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM

cwe_checker ★ 1.4K

cwe_checker finds vulnerable patterns in binary executables

scilla ★ 1.3K

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Artemis ★ 1.3K

A modular vulnerability scanner with automatic report generation capabilities.

artifact-keeper ★ 1.2K

Open-source universal artifact registry. Drop-in Artifactory/Nexus alternative with 40+ package formats, security scanning, WASM plugins, and edge replication.

docker-nginx-certbot ★ 1.2K

Automatically create and renew website certificates for free using the Let's Encrypt certificate authority.

Monica ★ 1.2K

Monica Pass，Password Management, 2FA Generator

certspotter ★ 1.2K

Lightweight Certificate Transparency Log Monitor

QtPass ★ 1.2K

QtPass is a multi-platform GUI for pass, the standard unix password manager.

helicalinsight ★ 1.1K

Free, open source BI platform with AI conversational analytics (BYO-LLM), pixel-perfect paginated reports, interactive dashboards, SSO, embedding, multi-tenancy

mod_auth_openidc ★ 1.1K

OpenID Certified™ OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd

FileRise ★ 1.0K

🗂️ FileRise – lightweight, self-hosted file manager & storage hub with granular ACLs, resumable uploads, encrypted folders, WebDAV & SSO. Fully Docker / Unraid

KubeHound ★ 1.0K

Tool for building Kubernetes attack paths

sysPass ★ 994

Systems Password Manager

pojia-next ★ 987

十五个 AI 客户端的内置提示词一键替换：双击即用、可自证、改前备份、一键还原。v8.26：一键破甲全程托管（自动结束进程+注入+自动拉起）、注入步骤实时提示、写后自检回滚、托盘常驻。免装 Python 单文件 exe，完全免费开源。

ejbca-ce ★ 967

EJBCA® – Open-source public key infrastructure (PKI) and certificate authority (CA) software.

rowel ★ 961

🔑 Free Offline-first Password Manager

Phase ★ 942

Secure, deploy, and manage application secrets effortlessly

pass-import ★ 916

A pass extension for importing data from most existing password managers

product-is ★ 888

Welcome to the WSO2 Identity Server source code! For info on working with the WSO2 Identity Server repository and contributing code, click the link below.

passman ★ 829

🔐 Open source password manager with Nextcloud integration

HydraSoft-DLL-Hijack-Scanner ★ 821

HydraSoft: dependency-free Windows DLL hijack scanner with centralized remote management — HydraAgent, PHP API, and a web console for endpoint security checks a

android-pass ★ 815

Android code for the Proton Pass application

Featurevisor ★ 814

Feature management with GitOps for developers

phpCAS ★ 800

Apereo PHP CAS Client

os ★ 794

Enables organizations to create and deploy customizable AI agents with support for multiple LLM providers, real-time chat, voice, document training, analytics,

KeyPass ★ 787

KeyPass: Open Source Project & An Offline Password Manager. Store, manage, and take control securely.

cve-lite-cli ★ 781

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output,

webauthn-ruby ★ 777

WebAuthn ruby server library ― Make your Ruby/Rails web server become a conformant WebAuthn Relying Party

opentrap ★ 773

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWA

tenzir ★ 769

Tenzir is the data pipeline engine for security teams.

passwall-server ★ 768

Passwall Server is the core backend infrastructure for Passwall platform

Keyshade ★ 768

Secure secret management with public key encryption

RedTiger-Tools ★ 763

RedTiger-Tools is a multifunction automation tool dedicated to pentesting and OSINT. The project is open source and designed to be fully configurable according

TheIdServer ★ 756

OpenID/Connect, OAuth2, WS-Federation and SAML 2.0 server based on Duende IdentityServer and ITFoxtec Identity SAML 2.0 with its admin UI

keypaste ★ 752

A KeePass-compatible password and secrets manager for people who work with AI agents.

WireGuard ★ 735

Fast, minimal VPN built on modern cryptography

Powershellisfun ★ 728

Repository with the scripts that I have used in my blogs on https://powershellisfun.com. If you like these, please sponsor this project using the Sponsor button

Snitch ★ 685

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteu

samlify ★ 663

Node.js library for SAML SSO

pika ★ 656

Lightweight probe monitoring — Go + VictoriaMetrics + PostgreSQL/SQLite | Real-time metrics, service checks, tamper protection & security audit

jans ★ 656

The Janssen Project is a home for open source IAM components, featuring Auth Server (OAuth/OpenID), Agama low-code identity orchestration, and the Cedarling pol

melody-auth ★ 650

A turnkey OAuth & authentication system, designed for both Cloudflare Workers and Node.js

eraser ★ 626

🧹 Cleaning up images from Kubernetes nodes

Marble ★ 618

Real-time fraud detection and AML compliance engine

webauthn ★ 617

Webauthn / passkeys helper library to make your life easier. Client side, server side and demo included.

Purse ★ 616

Manage secrets with Bash and GnuPG asymmetric encryption (YubiKey)

webauthn4j ★ 599

A portable Java library for WebAuthn(Passkeys) server side verification

routinator ★ 579

An RPKI Validator and RTR server written in Rust

openvpn-auth-oauth2 ★ 527

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows

rustinel ★ 526

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

pki ★ 514

The Dogtag Certificate System is an enterprise-class Certificate Authority (CA) which supports all aspects of certificate lifecycle management, including key ar

pykeepass ★ 510

Python library to interact with keepass databases (supports KDBX3 and KDBX4)

Zen-Ai-Pentest ★ 500

🛡⚔️AI-Powered Penetration Testing Framework with automated vulnerability scanning, multi-agent system, and compliance reporting🛡⚔️

Procaptcha ★ 303

Decentralized CAPTCHA for enhanced web security

Private Captcha ★ 199

GDPR-compliant bot protection without user friction

Werbot ★ 169

Secure, scalable server access management for DevOps

Abby ★ 167

Type-safe feature flags and remote config for developers

SAMA ★ 161

Secure, scalable chat server for modern applications

Friendly Captcha ★ 37

Invisible bot protection that respects user privacy