GitHub stars · StarDay

1keepassxreboot / keepassxcCross-platform password manager derived from the KeePass ecosystem.C++License not declared29,811

2hashcat / hashcatAuthor description: World's fastest and most advanced password recovery utilityCLicense not declared27,277

3supertokens / supertokens-coreOpen source alternative to Auth0 / Firebase Auth / AWS CognitoJavaLicense not declared15,343

4logto-io / logto🧑‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.TypeScriptMPL-2.0 · Share derivative source14,852

5openwall / johnJohn the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAsCLicense not declared13,876

6keeweb / keewebFree cross-platform password manager compatible with KeePassHTMLLicense not declared13,035

7berzerk0 / Probable-WordlistsVersion 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your passwords aren't popular!CC-BY-SA-4.0 · Share derivative source9,387

8TheKingOfDuck / fuzzDictsYou Know, For WEB Fuzzing !PythonLicense not declared8,443

9robinmoisson / staticryptPassword protect a static HTML page, decrypted in-browser in JS with no dependency. No server logic needed.HTMLMIT · Permissive8,069

10MacPass / MacPassA native macOS KeePass clientObjective-CLicense not declared6,898

11Mebus / cuppCommon User Passwords Profiler (CUPP)PythonGPL-3.0 · Share derivative source6,615

12k8gege / K8toolsK8 tool collection (intranet penetration/privilege escalation tool/remote overflow/vulnerability exploitation/scanning tool/password cracking/anti-virus tool/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)PowerShellMIT · Permissive6,243

13passbolt / passbolt_apiThe JSON API service for Passbolt Community Edition, a team password manager.PHPAGPL-3.0 · Share derivative source6,212

14lesspass / lesspass:key: stateless open source password managerTypeScriptGPL-3.0 · Share derivative source6,080

15khast3x / h8mailEmail OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related emailPythonLicense not declared5,367

16k8gege / LadonLadon large-scale intranet penetration scanner, PowerShell, Cobalt Strike plug-in, memory loading, fileless scanning. It includes port scanning, service identification, network asset detection, password auditing, high-risk vulnerability detection, vulnerability exploitation, password reading and one-click GetShell. It supports batch A/B/C and cross-network segment scanning, and supports URL, host, domain name list scanning, etc. Network asset detection 32 protocols (ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP) or methods to quickly obtain target network surviving host IP, computer name, workgroup, shared resources, network card address, operating system version, website, subdomain name, middleware, open services, routers, switches, databases, printers, etc., a large number of high-risk vulnerability detection modules MS17010, Zimbra, ExchangeC#MIT · Permissive5,342

17shuaiplus / nodewardenBitwarden-compatible server running on Cloudflare WorkersTypeScriptLicense not declared4,120

18deepfence / SecretScanner:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:GoMIT · Permissive3,396

19pglombardo / PasswordPusher🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.RubyApache-2.0 · Permissive3,245

20ranisalt / node-argon2Node.js bindings for Argon2 hashing algorithmJavaScriptMIT · Permissive2,193