Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Head-to-head · OSINT Tools

OWASP Amass vs theHarvester

  • Updated Oct 2026
  • Both researched from official sources
  • 6 checks side by side
Higher score OWASP Amass #2 in OSINT Tools 8.8/10 Free plan Free plan✓ 1 of 6 features Visit OWASP Amass
theHarvester #8 in OSINT Tools 7.5/10 Free plan Free plan✓ 4 of 6 features Visit theHarvester

OWASP Amass leads on 0 checks, theHarvester on 0, and 6 are even. Who comes out ahead on the 6 yes/no, price and count checks where we have data for both products. The editor score weighs everything else too.

Our verdict

  • Highest scoreOWASP Amass · 8.8/10
  • Free planboth
  • Most featurestheHarvester · 4 of 6

OWASP Amass scores higher on our rubric for osint tools: 8.8 against 7.5 out of 10; our editors rank them #2 and #8.

OWASP Amass is the better fit for free, self-hosted external asset reconnaissance. theHarvester is the better fit for free domain and organization reconnaissance.

  • OWASP Amass fits best

    Free, self-hosted external asset reconnaissance

  • theHarvester fits best

    Free domain and organization reconnaissance

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature OWASP Amass 8.8/10 Visit ↗ theHarvester 7.5/10 Visit ↗
At a glance
Editor score 8.8 7.5
Ranking #2 in OSINT Tools #8 in OSINT Tools
Best for Free, self-hosted external asset reconnaissance Free domain and organization reconnaissance
Pricing model Free Free
Starting price Free plan Free plan
Free plan ✓ ✓
Free trial — —
Deployment Self-hosted Self-hosted, Cloud
Platforms Windows, macOS, Linux Linux, Web
Support Email, Community, Docs Community, Docs
Built for Solo, Small business, Mid-market, Enterprise Solo, Small business, Mid-market, Enterprise
Features OWASP Amass 1/6 · theHarvester 4/6
Social source search Not checked yet —
Domain & IP lookup Not checked yet ✓ (best)
Monitoring & alerts Not checked yet ✓ (best)
Link analysis Not checked yet Not checked yet
API access ✓ ✓
Data export Not checked yet ✓ (best)
Our review
Pros
  • External asset discovery with active reconnaissance and attack-surface mapping
  • Open Asset Model and asset database organize findings and relationships
  • Cross-platform deployment with Docker, Docker Compose, and a REST API
  • Collects intelligence across search, certificate, DNS, code, and threat sources
  • Normalizes findings and lets users review evidence and hostname changes
  • Offers scheduling, a local REST API, and JSONL or SQLite exports
Cons
  • Command-line workflow may require technical security expertise
  • Self-hosted deployment leaves operations to your team
  • Focuses on external assets rather than broader investigations
  • Its verified focus is domain and organization intelligence, not social sources
  • Setup and interfaces can vary as the project is rapidly updated
  • Its documentation supports Linux installation; broader OS support is unverified
Our verdict

OWASP Amass is an open-source framework for security teams, penetration testers, and organizations assessing internet-facing infrastructure. It combines open-source intelligence collection, active reconnaissance, external asset discovery,…

Read the review →

For early-stage reconnaissance in an authorized security assessment, theHarvester collects public-source intelligence about a domain or organization. It draws from categories including search engines, certificate transparency logs, DNS…

Read the review →
  1. OWASP AmassOSINT Tools 8.8Free plan
  2. theHarvesterOSINT Tools 7.5Free plan

Strengths and trade-offs

  • OWASP Amass — where it wins

    • External asset discovery with active reconnaissance and attack-surface mapping
    • Open Asset Model and asset database organize findings and relationships
    • Cross-platform deployment with Docker, Docker Compose, and a REST API

    Where it doesn't

    • Command-line workflow may require technical security expertise
    • Self-hosted deployment leaves operations to your team
    • Focuses on external assets rather than broader investigations

  • theHarvester — where it wins

    • Collects intelligence across search, certificate, DNS, code, and threat sources
    • Normalizes findings and lets users review evidence and hostname changes
    • Offers scheduling, a local REST API, and JSONL or SQLite exports

    Where it doesn't

    • Its verified focus is domain and organization intelligence, not social sources
    • Setup and interfaces can vary as the project is rapidly updated
    • Its documentation supports Linux installation; broader OS support is unverified

More comparisons

All OSINT tools comparisons → · Full ranking →

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Last updated · How we research and update