Best Open Source Security & Privacy Software

Ente

AGPL-3.0

117,895 stars

End-to-end encrypted cloud storage for photos and videos, offering privacy, security, and seamless cross-device syncing.

ProjectDiscovery

MIT

77,615 stars

Monitor infrastructure for exploitable vulnerabilities with real-time detection, automated workflows, and zero false positives.

Peergos

AGPL-3.0

44,047 stars

A peer-to-peer encrypted filesystem for secure file storage, sharing, and collaboration with end-to-end encryption and user-controlled data.

SAMA

GPL-3.0

39,499 stars

Open source chat server with end-to-end encryption, clustering support, and comprehensive messaging features for building real-time communication apps

Puter

AGPL-3.0

39,366 stars

Puter is a cloud-based desktop OS you run in the browser, with built-in apps, file storage, and support for hosting web apps and sites.

Hanko

AGPL-3.0

37,633 stars

Open source authentication platform supporting passkeys, 2FA, SSO, and social login. Self-host or use Hanko Cloud, with full control over your data and no…

Cerbos

Apache-2.0

37,633 stars

A scalable authorization layer that provides fine-grained access control through externalized policies, enabling secure and flexible permissions management.

Permify

AGPL-3.0

37,633 stars

Open-source authorization service for implementing fine-grained access controls. Centralized, scalable solution supporting RBAC, ABAC and ReBAC with Google…

Infisical

MIT

36,455 stars

End-to-end encrypted secret management platform for seamless integration and enhanced security in development workflows.

Keyshade

MIT

36,455 stars

Secure secret management platform with public key encryption, automated rotation, versioning, and real-time collaboration tools for development teams.

Phase

MIT

36,455 stars

Open source platform for engineering teams to manage secrets and environment variables from development to production, with powerful integrations.

Tracecat

AGPL-3.0

32,523 stars

Tracecat is a scalable, self-hostable platform for automating security workflows and playbooks without limits.

JumpServer

GPL-3.0

32,000 stars

Open-source privileged access management solution offering secure, browser-based access to SSH, RDP, Kubernetes, databases and remote applications.

HashiCorp Vault

Open Source

30,198 stars

Manages tokens, passwords, certificates, and encryption keys through a UI, CLI, or HTTP API, with dynamic credentials and encryption-as-a-service built in.

UnKey

AGPL-3.0

17,282 stars

Streamline API authentication with UnKey's powerful, developer-friendly platform for creating, revoking, and monitoring API keys.

CrowdSec

MIT

15,426 stars

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.. Collaborative IPS able to analyze visitor behavior and to provide an adapted response to all kinds of attacks.

GrowthBook

MIT

13,923 stars

Powerful, developer-friendly experimentation tool for data-driven product decisions. Seamless integration, real-time insights, and flexible deployment.

Flagsmith

BSD-3-Clause

13,923 stars

Powerful feature management platform for seamless software releases, A/B testing, and personalized user experiences.

Abby

AGPL-3.0

13,923 stars

Abby offers open-source, fully typed feature flagging and remote configuration for React and Next.js, with multi-environment testing and debugging tools.

FeatBit

MIT

13,923 stars

FeatBit is a fast, scalable feature flag service that enables risk mitigation and fosters business growth through controlled feature releases.

Featurevisor

MIT

13,923 stars

Featurevisor is an open-source tool for managing feature flags, experiments, and remote configuration directly from your Git repository.

Flipt

GPL-3.0

13,923 stars

A feature flag platform that integrates with Git workflows, enabling developers to manage features directly in their codebase.

Gravitl

Open Source

11,854 stars

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.. WireGuard virtual networking platform (VPN)

Authentik

MIT

9,053 stars

authentik is an open-source identity provider that offers self-hosted authentication, authorization, and user management for businesses of all sizes.

Authgear

Apache-2.0

9,053 stars

Authgear is a managed IAM platform handling authentication, SSO, and user management for B2C and B2B apps, with biometrics, MFA, and zero-trust support.

Better Auth

MIT

9,053 stars

A comprehensive authentication framework offering email/password, social sign-on, two-factor auth, and multi-tenant support with full TypeScript integration.

Hexclave

Open Source

9,053 stars

Self-hostable platform combining user auth, payments, email, and analytics into modular building blocks that fit around your existing product.

Keycloak

Apache-2.0

9,053 stars

Comprehensive open source identity management solution offering single sign-on, social login, and fine-grained authorization for applications and services.

Logto

MPL-2.0

9,053 stars

An open-source identity solution offering customizable login experiences, multi-tenant support, and comprehensive user management.

Ory

Apache-2.0

9,053 stars

Ory is a certified and battle-tested identity solution backed by a large open source community and trusted by Fortune 500 companies.

Pocket ID

BSD-2-Clause

9,053 stars

Self-hostable OpenID Connect and OAuth 2.0 provider that lets users sign in to any OIDC-compatible app using passkeys instead of passwords.

SuperTokens

Open Source

9,053 stars

Open-source authentication solution offering flexible, self-hosted user management with advanced features and easy integration.

Zitadel

AGPL-3.0

9,053 stars

ZITADEL provides a comprehensive identity management solution with easy APIs, customizable workflows, and serverless deployment options.

Unleash

AGPL-3.0

8,555 stars

A powerful feature management platform enabling gradual rollouts, A/B testing, and seamless integration for continuous delivery.

Tuta

GPL-3.0

8,100 stars

Tuta offers encrypted email, calendar and contacts with quantum-resistant security, protecting your privacy without ads or tracking.

Faraday

GPL-3.0

6,839 stars

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.. Open Source Vulnerability Management and Orchestration Platform

OPAL (Permit.io)

Apache-2.0

5,523 stars

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...). Authorization administration framework (Open Policy)

Deepfence ThreatMapper

Apache-2.0

5,327 stars

Open Source Cloud Native Application Protection Platform (CNAPP). Apache v2, powerful runtime vulnerability and compliance scanner for kubernetes, virtual machines, cloud and serverless.

Signal

AGPL-3.0

3,958 stars

Secure messaging app with state-of-the-art encryption, voice/video calls, group chats, and file sharing. No ads, trackers, or data collection.

Oso

Apache-2.0

3,484 stars

Legacy Oso open source library (archived). Authorization building framework

Cinny

AGPL-3.0

3,435 stars

Cinny offers a simple, elegant, and secure interface for Matrix-based conversations, protected by end-to-end encryption.

Element

AGPL-3.0

3,435 stars

Open-source platform for encrypted communication, file sharing, and collaboration based on the Matrix protocol.

Fluxer

AGPL-3.0

3,435 stars

Free, open-source instant messaging and VoIP platform with full Markdown support, voice/video calls, moderation tools, and self-hosting options for communities.

Mattermost

Open Source

3,435 stars

Mattermost provides a flexible, open-source platform for secure team collaboration, designed for organizations with strict security and privacy requirements.

Quiet

GPL-3.0

3,435 stars

Quiet is a peer-to-peer messaging app that syncs messages directly between devices over Tor, with no central server, no phone number required, and no metadata…

Wire

GPL-3.0

3,435 stars

A comprehensive collaboration platform offering end-to-end encrypted messaging, file sharing, and video calls with enterprise-grade security and compliance…

Stoat

Open Source

3,400 stars

Self-hostable group chat with servers, channels, voice, and moderation tools. No ads, no data mining, built under EU privacy law.

Opengrep

LGPL-2.1

3,300 stars

Opengrep is a community-driven fork of SemgrepCE, providing accessible static code analysis and security scanning for developers.

Defguard

Open Source

2,900 stars

Enterprise-grade open source VPN solution combining WireGuard with mandatory 2FA/MFA and integrated OpenID Connect SSO for secure remote access

ALTCHA

MIT

2,900 stars

ALTCHA offers cutting-edge spam and abuse protection for websites and apps, with privacy-friendly CAPTCHA alternatives designed for GDPR compliance.

Cap

Apache-2.0

2,867 stars

Lightweight open-source CAPTCHA solution using SHA-256 proof-of-work. 250x smaller than hCaptcha, fully customizable, and privacy-focused with zero telemetry.

Cryptomator

GPL-3.0

2,546 stars

Encrypts files and filenames locally before they reach Dropbox, Google Drive, OneDrive, or any other cloud, so only you hold the key.

mCaptcha

AGPL-3.0

2,500 stars

Privacy-focused proof-of-work CAPTCHA system that silently protects websites without tracking users or requiring image solving. Drop-in replacement for…

BoxyHQ

Apache-2.0

2,269 stars

Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On, it also supports Directory Sync via the SCIM 2.0 protocol for automatic user and group provisioning/de-provisioning.. Enterprise Readiness made simple

Matano

Apache-2.0

1,707 stars

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS. Open source cloud-native security lake platform (SIEM alternative) for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Tirreno

AGPL-3.0

1,600 stars

Open-source security framework for threat detection, fraud prevention, and abuse monitoring. Self-hosted solution with built-in dashboard and risk scoring.

OmniEdge

Open Source

1,500 stars

No-code P2P layer-2 mesh VPN for enterprise with zero config

LunaTrace

Open Source

1,473 stars

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/ . Dependency Vulnerability Scanner and SBOM Inventory

Warrant

Apache-2.0

1,341 stars

Warrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.. Authorization and access control as a service

Marble

Elastic-2.0

618 stars

An open-source platform that enables fintech companies to monitor transactions and user activity, detect suspicious behaviors, and automate fraud prevention…

Procaptcha

Apache-2.0

303 stars

A blockchain-based CAPTCHA solution offering improved security, user experience, and resistance to bot attacks for web applications.

FusionAuth

Open Source

240 stars

Container definitions for docker, kubernetes, helm, and whatever containers come next!. User authentication and session management framework

Private Captcha

Open Source

199 stars

Privacy-first CAPTCHA service that blocks bots while keeping forms accessible. No puzzles, no tracking, no cookies - just invisible cryptographic protection.

Werbot

BUSL-1.1

169 stars

Centralized platform for managing SSH access, enhancing security, and streamlining server administration for DevOps teams.

Friendly Captcha

MPL-2.0

37 stars

Privacy-compliant CAPTCHA alternative using proof-of-work technology. Protects websites from bots and spam without user interaction or data tracking.

OneHuman

BUSL-1.1

21 stars

Detects AI agents using customer credentials, masks private fields, holds risky actions for passkey approval, and signs every decision on your own server.