Open-source Security & privacy projects

106 MIT-licensed security & privacy projects, most-starred first — free to use, modify and ship commercially. Each page covers what it is, who it suits, how to install and run it, and how it compares.

1. 1REALets AI agents reverse engineer apps, JavaScript/Electron code, .NET, and native binaries, with evidence.★ 421k
2. 2SherlockCommand-line tool that checks many social networks for a given username.★ 95.4k
3. 3Bitcoin CoreSoftware that runs a full Bitcoin node: it downloads and checks the whole Bitcoin network's history itself.★ 90.6k
4. 4PayloadsAllTheThingsA community-maintained collection of web security attack payloads and filter bypass examples, organized by vul★ 82.3k
5. 5HackingToolAn interactive console bundling 219 security testing tools, with an AI layer that suggests tools and commands.★ 81.6k
6. 6SecListsA large collection of security testing word lists, such as usernames, passwords, and attack payloads, in one r★ 74.5k
7. 7Win11DebloatA PowerShell script that removes preinstalled Windows apps and turns off telemetry and other clutter.★ 61.5k
8. 8face_recognitionA Python library and command-line tool for finding and recognizing faces in photos.★ 56.9k
9. 9security-auditAn agent skill that guides a coding agent through a multi-phase security audit of a codebase.★ 56.8k
10. 10Big List of Naughty StringsA text file of tricky strings that often break software, used to test how apps handle bad input.★ 47.7k
11. 11V2RayProxy network tools for bypassing restrictions; this repo says it has moved to v2fly.★ 46.9k
12. 12mitmproxyInteractive proxy that lets you inspect and modify HTTP and HTTPS traffic from your machine.★ 46.6k
13. 13MaigretSearches for a username across thousands of websites to gather public account info.★ 39.6k
14. 14FrigateSelf-hosted camera recorder that spots people, cars and animals locally using AI.★ 37.1k
15. 15Web CheckOpen-source tool that runs many checks on a website, such as DNS, headers, and SSL details.★ 35.3k
16. 16V2RayA network toolkit for building your own proxies that secure connections and protect privacy.★ 34.7k
17. 17AnomaReference implementation of the Anoma protocol, written in Elixir, for running a node.★ 33.6k
18. 18CloakBrowserA Chromium browser modified for stealth, meant to be a drop-in swap for Playwright.★ 32.7k
19. 19NucleiA template-driven vulnerability scanner that checks apps, APIs, networks, DNS and cloud setups for known issue★ 32.5k
20. 20hostsA combined blocklist of hosts-file entries that blocks ads, malware, and optional categories system-wide.★ 31.4k
21. 21NanoClawA small, container-isolated AI assistant that connects to chat apps and runs on Anthropic's Agent SDK.★ 31.1k
22. 22GitleaksOpen-source command-line tool that scans git repos and files for leaked passwords, API keys, and tokens.★ 30.6k
23. 23Better AuthA TypeScript authentication and authorization framework with built-in features and plugins.★ 30.6k
24. 24h4ckerA large curated collection of cybersecurity links, scripts, labs and training notes.★ 30k
25. 25ActualA free, open-source budgeting app that keeps your data local and syncs across devices.★ 29.9k
26. 26FingerprintJSA free browser library that creates a visitor ID from browser traits, lasting across private mode.★ 28.7k
27. 27OpenZeppelin ContractsA tested library of reusable smart contract code for Ethereum-style blockchains.★ 27.3k
28. 28watermarks-removerStrips AI provenance watermarks from text and files you own, via an agent skill and a local Python service.★ 25.9k
29. 29DeviseReady-made user sign-up, login, and password reset for Rails apps, built on Warden.★ 24.4k
30. 30SpiderFootOpen-source tool that automatically gathers public information about a target to map its internet exposure.★ 24.2k
31. 31AnubisA web firewall that challenges incoming requests to block AI scraper bots from your site.★ 23.9k
32. 32deepfacePython library for face verification, face search, and estimating age, gender, emotion and race from photos.★ 23.6k
33. 33PassportExpress-compatible authentication middleware for Node.js that uses pluggable strategies.★ 23.5k
34. 34API Security ChecklistA checklist of security measures to consider when designing, testing, and releasing an API.★ 23.3k
35. 35HysteriaA proxy tool that tunnels internet traffic over a QUIC-based protocol, built to work on lossy networks.★ 22.8k
36. 36macOS Security and Privacy GuideA community guide with step-by-step techniques for hardening and improving privacy on Apple silicon Macs.★ 22.6k
37. 37JavaScript CookieA small JavaScript library for reading, writing and deleting browser cookies.★ 22.6k
38. 38chezmoiManages your config dotfiles across multiple machines, with secrets kept safe.★ 22.1k
39. 39CipheyPaste encoded or encrypted text and it works out the layers and shows the plaintext, no key needed.★ 21.7k
40. 40VulhubA collection of ready-made vulnerable software environments you can start with Docker Compose.★ 21.4k
41. 4190DaysOfCyberSecurityA free 90-day self-study plan linking to courses and resources for learning cybersecurity from scratch.★ 20.8k
42. 42openvpn-installA script that sets up your own OpenVPN server on a Linux machine in about a minute.★ 20.7k
43. 43Windows10DebloaterPowerShell scripts that remove preinstalled Windows 10 apps and disable some telemetry.★ 18.8k
44. 44GOSTA command-line proxy and tunnel tool that forwards traffic over many protocols, written in Go.★ 18.3k
45. 45jsonwebtokenA Node.js library for creating and checking JSON Web Tokens (JWTs).★ 18.2k
46. 46katanaA command-line web crawler that visits pages and collects URLs, for security testing and automation.★ 17.8k
47. 47awesome-hackingA curated list of links to hacking tutorials, tools and learning resources.★ 17.4k
48. 48ffufA fast command-line tool that guesses hidden web paths, parameters and hostnames by trying many inputs.★ 17k
49. 49MHDDoSPython script with 60 traffic-flood methods, presented as a DDoS testing toolkit for authorized use.★ 16.9k
50. 50ChiselA tool that tunnels TCP and UDP traffic over HTTP, encrypted with SSH, for getting past firewalls.★ 16.7k
51. 51TwintPython tool that scrapes tweets, followers and profiles without Twitter's API. Archived in 2023.★ 16.4k
52. 52System InformerA free Windows tool for watching system resources, finding what locks files, and checking suspicious programs.★ 16.4k
53. 53vphone-cliRuns a virtual iPhone on an Apple Silicon Mac, for security research and debugging.★ 16.4k
54. 54OpenVPNA script that sets up your own OpenVPN server on common Linux distributions and manages client profiles.★ 16.2k
55. 55zxcvbnA library that estimates how strong a password is by checking common patterns.★ 16.1k
56. 56GluetunA Docker container that routes your traffic through a VPN from many providers, with built-in proxies.★ 16k
57. 57whistleA local proxy that captures and edits web traffic (HTTP, HTTPS, WebSocket) for debugging.★ 15.8k
58. 58InferA static analyzer that scans Java, C, C++, and Objective-C code for bugs without running it.★ 15.7k
59. 59Hacker roadmapA curated, now-archived list of pen-testing tools, resources and references for learning ethical hacking.★ 15.7k
60. 60CrowdSecOpen-source security engine that detects attacks from logs and HTTP traffic and blocks bad IPs, using a shared★ 15.4k
61. 61clashctlA Linux shell tool that installs and manages the mihomo/Clash proxy core from the terminal.★ 15.1k
62. 62Awesome SecurityA curated, community-maintained list of security tools, books, and resources, organized by topic.★ 15.1k
63. 63ddddocrPython library that reads text from common captchas offline, using pre-trained models.★ 14.9k
64. 64blind-watermarkPython library that hides a watermark inside an image and reads it back without the original image.★ 14.8k
65. 65fscanCLI scanner for internal networks: hosts, ports, services and known weaknesses.★ 14.7k
66. 66subfinderCommand-line tool that finds subdomains of a website using passive online sources.★ 14.7k
67. 67HackBrowserDataCommand-line tool that extracts and decrypts saved data from Chromium, Firefox and Safari browsers.★ 14.7k
68. 68BinwalkFinds and extracts files hidden inside other files, mainly for analyzing firmware.★ 14.6k
69. 69FaceNetA TensorFlow implementation of the FaceNet face recognition model, with pretrained weights.★ 14.4k
70. 70Nginx Admin's HandbookA long set of notes on running NGINX well: performance, security, and common gotchas.★ 14.3k
71. 71Juice ShopA deliberately insecure web shop for practicing finding and exploiting security flaws.★ 14.3k
72. 72PHPStanA PHP static analysis tool that finds bugs in code without running it.★ 14.1k
73. 73Remove Windows AIPowerShell script that disables and removes Copilot, Recall and other AI features in Windows 11.★ 13.6k
74. 74HexStrike AILets AI agents drive about 150 security testing tools through an MCP server, for authorized pentesting.★ 13.3k
75. 75IDA Pro MCPLets AI assistants like Claude or Cursor control IDA Pro for reverse engineering through MCP.★ 13.3k
76. 76YubiKey GuideA community guide for storing GnuPG keys on a YubiKey so private keys stay on the hardware.★ 13.1k
77. 77laravel-permissionA Laravel package for assigning roles and permissions to users, stored in your database.★ 13k
78. 78arkenfox user.jsA template user.js file that tightens Firefox privacy, security and anti-tracking settings.★ 13k
79. 79Self-hosted LiveSyncSync your Obsidian notes across devices using a server you run yourself (CouchDB or object storage), or direct★ 12.9k
80. 80Atomic Red TeamA library of portable security detection tests mapped to MITRE ATT&CK techniques.★ 12.8k
81. 81Wi-Fi CrackingA written tutorial showing how to crack weak WPA/WPA2 Wi-Fi passwords using aircrack-ng tools and hashcat.★ 12.7k
82. 82NSFW Data ScraperScripts that gather tens of thousands of labeled images for training an NSFW image classifier.★ 12.6k
83. 83HettyA free, open-source web proxy for inspecting and testing HTTP traffic in security work.★ 12.5k
84. 84OSINT FrameworkA web directory of free open-source intelligence (OSINT) tools and resources, organized as a menu.★ 12.4k
85. 85fsocietyA Python 2 bundle of penetration testing scripts, many themed on Mr. Robot.★ 12.4k
86. 86Detect-It-EasyIdentifies what kind of file you have and whether it is packed, protected or obfuscated.★ 11.8k
87. 87PresidioOpen-source Python framework to find and anonymize personal data in text, images and structured data.★ 11.6k
88. 88WhoogleA self-hosted Google search proxy that strips ads, JavaScript and tracking; no longer returns results.★ 11.6k
89. 89jwt-authJSON Web Token authentication package for Laravel and Lumen PHP apps.★ 11.5k
90. 90Awesome Hacker Search EnginesA curated list of websites for searching security, vulnerability, and internet-device data.★ 11.5k
91. 91WireGuard installerA bash script that sets up a WireGuard VPN server on a Linux machine with minimal questions.★ 11.4k
92. 92TwitchAdSolutionsBrowser scripts and extensions that try to block ads on Twitch streams. The project is archived.★ 11.3k
93. 93pwndbgA plug-in for GDB and LLDB that makes low-level debugging easier for reverse engineering and exploit work.★ 11.1k
94. 94NopeCHABrowser extension that automatically solves many CAPTCHA types for automated browsing tools.★ 11.1k
95. 95gpt-instructPrompt files and test scripts that try to change Codex's behavior for GPT models, with a jailbreak focus.★ 11.1k
96. 96FirefoxA user.js file of Firefox about:config settings aimed at more privacy and speed.★ 11k
97. 97shadowsocksA Rust implementation of the shadowsocks proxy tool, with client and server binaries.★ 11k
98. 98anti-ADA merged, deduplicated ad and tracker domain blocklist for Chinese-language sites, usable with many DNS and pr★ 10.9k
99. 99tg-ws-proxyA local proxy that helps Telegram load when it is partly blocked.★ 10.9k
100. 100HelmetExpress middleware that sets secure HTTP response headers with one line of code.★ 10.7k
101. 101jwt-goGo library for creating, signing, and verifying JSON Web Tokens. Archived; use golang-jwt/jwt instead.★ 10.7k
102. 102httpxA command-line tool that quickly checks many web hosts and reports details about each one.★ 10.6k
103. 103LuciaA simple, clean authentication library for TypeScript projects.★ 10.5k
104. 104django-allauthDjango apps for signup, login, account management and social/OAuth sign-in.★ 10.4k
105. 105SeekerHosts a fake page that asks visitors for location permission, then reports their coordinates and device detail★ 10.2k
106. 106termsharkA terminal interface for tshark, the command-line version of Wireshark, for reading and filtering packet captu★ 10.1k