Trending repositories

1.NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework

• software-analysis
• disassembler
• reverse-engineering

2.skylot / jadx

Dex to Java decompiler

• android
• dex
• java
• decompiler

3.iBotPeaches / Apktool

A tool for reverse engineering Android apk files

• apktool
• apk
• android
• reverse-engineering
• arsc
• 9patch

4.mitschud / DirtyFrag

Ephemeral root via the CVE-2026-43284 page-cache exploit

5.opentrap / opentrap

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

• application-security
• appsec
• bug-bounty
• burp-alternative
• http-proxy
• infosec
• +13 more

6.keycloak / keycloak

Open Source Identity and Access Management For Modern Applications and Services

• keycloak
• oidc
• saml

7.microg / GmsCore

Free implementation of Play Services

• java
• android
• microg
• google-cloud-messaging
• maps
• auth
• +8 more

8.emanuele-f / PCAPdroid

No-root network monitor, firewall and PCAP dumper for Android

• pcap
• capture-traffic
• android
• no-root
• traffic-monitor
• pcap-files
• +6 more

9.cryptomator / cryptomator

Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.

• cryptomator
• java
• cloud-storage
• cryptography
• crypto
• security
• +2 more

10.beemdevelopment / Aegis

A free, secure and open source app for Android to manage your 2-step verification tokens.

• otp
• totp
• hotp
• android
• secure
• encryption
• +3 more

11.zaproxy / zaproxy

The ZAP by Checkmarx Core project

• zap
• zap-development
• dast
• appsec
• zaproxy
• security
• +3 more

12.yacy / yacy_search_server

Distributed Peer-to-Peer Web Search Engine and Intranet Search Appliance

• decentralized
• p2p
• p2p-network
• privacy
• privacy-protection
• search-engine
• +7 more

13.Col-E / Recaf

The modern Java bytecode editor

• java
• bytecode
• bytecode-engineering
• reverse-engineering
• jvm-bytecode
• decompile
• +8 more

14.Konloch / bytecode-viewer

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

• java-decompiler
• apk
• java
• procyon
• cfr
• fernflower
• +14 more

15.supertokens / supertokens-core

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

• authentication
• session-management
• login
• supertokens
• java
• signin
• +13 more

16.Peergos / Peergos

A p2p, secure file storage, social network and application protocol

• java
• peer-to-peer
• encryption
• social-network
• ipfs
• storage
• +13 more

17.springdoc / springdoc-openapi

Library for OpenAPI 3 with spring-boot

• openapi3
• spring-boot
• springdoc-openapi
• swagger-ui
• swagger-documentation
• openapi
• +14 more

18.sqlancer / sqlancer

Automated testing to find logic and performance bugs in database systems

• testing
• sql
• dbms
• fuzzing
• dbms-testing
• sqlite
• +5 more

19.gravitee-io / gravitee-api-management

Gravitee.io - OpenSource API Management

• api
• api-management
• gateway
• java
• vertx
• api-gateway
• +1 more

20.justauth / JustAuth

🏆Gitee 最有价值开源项目 🚀:100: 小而全而美的第三方登录开源组件。目前已支持Github、Gitee、微博、钉钉、百度、Coding、腾讯云开发者平台、OSChina、支付宝、QQ、微信、淘宝、Google、Facebook、抖音、领英、小米、微软、今日头条、Teambition、StackOverflow、Pinterest、人人、华为、企业微信、酷家乐、Gitlab、美团、饿了么、推特、飞书、京东、阿里云、喜马拉雅、Amazon、Slack和 Line 等第三方平台的授权登录。 Login, so easy!

• justauth
• oauth2
• qqlogin
• googlelogin
• weixinlogin

21.apereo / cas

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

• sso-authentication
• authentication
• authorization
• java
• websso
• saml2
• +14 more

22.JetBrains / fernflower

Decompiler from Java bytecode to Java, used in IntelliJ IDEA.

• java
• decompiler
• reverse-engineering

23.CarGuo / GSYVideoPlayer

Video players (IJKplayer, ExoPlayer, MediaPlayer), HTTPS, 16k page size, danmaku (bullet chat) support, external subtitles, support for filters, watermarks, and GIF screenshots, pre-roll and mid-roll ads, multiple simultaneous playback, basic seeking/dragging, volume and brightness adjustment, play-while-cache support

• android
• video
• player
• ijkplayer
• ffmpeg
• exoplayer
• +4 more

24.dromara / Sa-Token

✨ 开源、免费、一站式 Java 权限认证框架，让鉴权变得简单、优雅！—— 登录认证、权限认证、分布式 Session 会话、微服务网关鉴权、SSO 单点登录、OAuth2.0 统一认证、jwt 集成、API Key 秘钥授权、API 参数签名

• java
• token
• authorization
• sso
• aouth2
• springcloud

25.google / tsunami-security-scanner

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

26.Hakky54 / certificate-ripper

🔐 A CLI tool to extract server certificates

• certificate
• ssl
• x509
• tls
• java
• macos
• +7 more

27.pac4j / pac4j

Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

• java
• security
• authentication
• authorization
• cas
• oauth
• +14 more

28.OpenIdentityPlatform / OpenAM

OpenAM is an open-source access management solution for identity authentication, authorization, and federation. It provides single sign-on, adaptive authentication, and centralized policy control, enabling secure access to web, mobile, and cloud applications

• openam
• sso
• oauth
• saml
• aaa
• authentication
• +14 more

29.Hakky54 / mutual-tls-ssl

🔐 Tutorial of setting up Security for your API with one way authentication with TLS/SSL and mutual authentication for a java based web server and a client with both Spring Boot. Different clients are provided such as Apache HttpClient, OkHttp, Spring RestTemplate, Spring WebFlux WebClient Jetty and Netty, the old and the new JDK HttpClient, the old and the new Jersey Client, Google HttpClient, Unirest, Retrofit, Feign, Methanol, vertx, Scala client Finagle, Featherbed, Dispatch Reboot, AsyncHttpClient, Sttp, Akka, Requests Scala, Http4s Blaze, Kotlin client Fuel, http4k, Kohttp and ktor. Also other server examples are available such as jersey with grizzly. Also gRPC, WebSocket and ElasticSearch examples are included

• tls
• truststore
• certificate
• keystore
• encryption
• openssl
• +14 more

30.struppigel / PortEx

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

31.OpenAS2 / OpenAs2App

OpenAS2 is a java-based implementation of the EDIINT AS2 standard. It is intended to be used as a server. It is extremely configurable and supports a wide variety of signing and encryption algorithms.

32.CalebFenton / simplify

Android virtual machine and deobfuscator

• deobfuscation
• java
• optimization
• android
• reverse-engineering
• malware-analysis
• +9 more

33.MovingBlocks / Terasology

Terasology - open source voxel world

• java
• game
• voxel
• sandbox
• game-engine
• game-engine-3d
• +3 more

34.Loophole-LLC / Bastillion

Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.

• ssh
• bastion-host
• java
• javascript
• web-app
• web-based
• +8 more

35.ac-pm / Inspeckage

Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

• android-application
• security-analysis
• dynamic-analysis
• xposed

36.google / binnaviArchived

BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.

• reverse-engineering
• java
• binnavi
• yfiles
• analysis

37.find-sec-bugs / find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

• findbugs
• java
• security-audit
• owasp
• taint-analysis
• code-analysis
• +5 more

38.aklivity / zilla

🦎 A lightweight, streaming-native, multi-protocol gateway for AI, APIs, and real-time data. Route LLM requests across providers, govern MCP tools, and connect Kafka, MQTT, and HTTP through one high-performance engine with shared security and observability.

• kafka
• rest
• server-sent-events
• streaming-api
• grpc
• mqtt
• +9 more

39.funkygao / cp-ddd-framework

轻量级DDD正向/逆向业务建模框架，支撑复杂业务系统的架构演化！

• ddd
• extension
• ddd-architecture
• clean-architecture
• framework
• enterprise-architecture
• +5 more

40.membrane / api-gateway

API Gateway bridging modern and legacy APIs with WSDL-to-OpenAPI, SOAP-to-REST, XML, OAuth2, and GraphQL.

• oauth2
• api-gateway
• api
• rest
• openapi
• soap
• +3 more

41.iSECPartners / Introspy-Android

Security profiling for blackbox Android

42.OpenIdentityPlatform / OpenDJ

OpenDJ is an open-source LDAP directory server written in Java. It provides robust, scalable, and secure directory services for identity management, access control, and authentication in enterprise environments. OpenDJ supports LDAPv3 standard, replication, REST APIs, and high-performance

• ldap-server
• ldap
• opendj
• rest
• rest2ldap
• opends
• +6 more

43.Password4j / password4j

Java cryptographic library that supports Argon2, bcrypt, scrypt and PBKDF2 aimed to protect passwords in databases. Easy to use by design, highly customizable, secure and portable. All the implementations follow the standards and have been reviewed to perform better in the JVM.

• pbkdf2
• bcrypt
• scrypt
• argon2
• password
• hashing
• +10 more

44.hourianto / sporeflower

A J2ME-focused reverse-engineering, decompilation and remapping toolkit, aimed at semantically correct, recompilable output.

• cldc
• decompiler
• decompiler-java
• j2me
• java-decompiler
• midp