Free open-source security tools
Tools we trust and recommend, all free and open source. Download only from the official links below; fake "cracked" versions are a common way malware spreads.
Passwords & accountsEveryone
BitwardenPassword manager that syncs across phone and PC. Free plan is enough for most people.github.com/bitwardenKeePassXCOffline password manager. Your password file never leaves your device.github.com/keepassxreboot/keepassxcAegis AuthenticatorOpen-source 2-step verification codes for Android, with encrypted backups.github.com/beemdevelopment/AegisEnte Auth2-step verification codes for Android and iPhone with end-to-end encrypted sync.github.com/ente-io/ente
Antivirus & malwarePCs and servers
ClamAVOpen-source antivirus engine for Windows, Linux and mail servers (Cisco Talos).github.com/Cisco-Talos/clamavYARAPattern-matching rules used by malware researchers to identify malware families.github.com/VirusTotal/yaraSysinternals Autoruns (free)See every program that starts with Windows. Great for spotting persistence after an infection.learn.microsoft.com/sysinternals/downloads/autorunsWazuhFree security monitoring (SIEM/XDR) for small offices: alerts, file integrity, vulnerabilities.github.com/wazuh/wazuh
Private browsing & messagingEveryone
uBlock OriginBlocks malicious ads and many scam pages in the browser.github.com/gorhill/uBlockSignalEnd-to-end encrypted messaging and calls.github.com/signalappTor BrowserAnonymous browsing for journalists and people at risk.gitlab.torproject.org/tpo/applications/tor-browserPi-holeNetwork-wide ad and tracker blocking for your home Wi-Fi.github.com/pi-hole/pi-hole
OSINT: check your own exposureIndividuals & businesses
WhatsMyNameFind where a username exists online (powers our Username footprint).github.com/WebBreacher/WhatsMyNameSherlockCommand-line username search across hundreds of sites.github.com/sherlock-project/sherlocktheHarvesterCollects public emails, hostnames and subdomains for your own domain.github.com/laramies/theHarvesterSpiderFootAutomated OSINT reports for your organization's footprint.github.com/smicallef/spiderfootdnstwistFinds look-alike / typosquat domains impersonating yours (powers our Look-alike domains checker).github.com/elceef/dnstwistHoleheCheck which sites an email address is registered on, from the email alone.github.com/megadose/holeheAmassIn-depth attack-surface mapping and subdomain discovery for your own assets.github.com/owasp-amass/amass
Network & Wi-FiHome & small office
NmapMap which devices and services are on your own network.github.com/nmap/nmapWiresharkInspect network traffic to understand what a device is sending.github.com/wireshark/wiresharkWireGuardFast, modern open-source VPN for secure remote access.github.com/WireGuardOpenWrtSecure, up-to-date open-source firmware for many home routers.github.com/openwrt/openwrt
Encryption & secure backupEveryone
VeraCryptEncrypt a USB drive, folder or whole disk so lost devices stay private.github.com/veracrypt/VeraCryptCryptomatorClient-side encryption for files you keep in Google Drive, Dropbox or OneDrive.github.com/cryptomator/cryptomatorageSimple, modern file encryption from the command line.github.com/FiloSottile/ageresticFast, encrypted, de-duplicated backups to local or cloud storage.github.com/restic/restic
Incident response & forensicsAfter an attack
VelociraptorCollect evidence and hunt for intruders across your machines.github.com/Velocidex/velociraptorGRR Rapid ResponseRemote live forensics for a fleet of computers.github.com/google/grrVolatility 3Analyse a computer's memory to find malware and what it did.github.com/volatilityfoundation/volatility3TheHiveOpen-source case management for handling security incidents.github.com/TheHive-Project/TheHive
Website & server securitySite owners (only test sites you own)
OWASP ZAPFind common web vulnerabilities in your own website.github.com/zaproxy/zaproxyNucleiTemplate-based checks for known vulnerabilities on your own servers.github.com/projectdiscovery/nucleiWordfence (free)Firewall and malware scanner for WordPress sites.github.com/wordfenceLet's Encrypt / CertbotFree HTTPS certificates with automatic renewal.github.com/certbot/certbot
Threat intelligence we useBuilt into Drofsecurity
CISA KEVCatalog of vulnerabilities exploited in the wild, behind our zero-day alerts.github.com/cisagov/kev-dataURLhaus (abuse.ch)Live malware-distribution URLs, checked by our link checker.urlhaus.abuse.chOpenPhishLive phishing URLs, checked by our link checker.openphish.comHave I Been PwnedBreach catalogue and k-anonymity password check.haveibeenpwned.com
Drofsecurity isn't affiliated with these projects. Accessing or scanning systems without permission is an offence under PECA 2016. Test only what you own or have written permission to test.