F

Fuzzilli

Free#12 of 25 in Fuzz Testing Software

Fuzzilli: A focused open-source fuzzer for finding crashes and coverage in JavaScript engines. Ranked #12 of 25 in Fuzz Testing Software by our editors (7.7/10); pricing: Open source; best for javaScript engine fuzzing.

7.7/10★★★★☆Editor score

Visit Fuzzilli

At a glance

• Editor score
  7.7 / 10
• Pricing
  Open source
• Best for
  JavaScript engine fuzzing
• Paid from
  Free
• Input generation methods
  mutation, generation, hybrid
• Facts checked
  20 Sep 2026

• Where it wins

  • Hybrid generation and mutation broaden FuzzIL program exploration
  • Coverage-guided corpus selection focuses execution on new behavior
  • Distributed fuzzing and crash minimization support larger campaigns

• Where it doesn't

  • Its scope is limited to JavaScript engines and interpreters
  • Execution targets require instrumented engine builds
  • Platform support is limited to macOS and Linux

Our verdict on Fuzzilli

Fuzzilli is an open-source fuzzing framework focused on JavaScript engines and dynamic-language interpreters. It is designed for security researchers and JavaScript engine developers who need to generate, execute, and reduce JavaScript test programs. Fuzzilli creates programs in its FuzzIL intermediate language, translates them to JavaScript, and runs them against instrumented engine builds. Its target profiles support JavaScript engines such as V8, SpiderMonkey, and JavaScriptCore.

Its main technical strength is the combination of generation and mutation. Fuzzilli can mutate FuzzIL programs, generate new code, and use a hybrid approach that combines both methods. Code-coverage feedback guides corpus selection, helping prioritize programs that exercise new behavior. JavaScript lifting connects the intermediate representation to engine targets, while persistent REPRL execution supports repeated program execution. Crash detection and program minimization help reduce interesting or crashing programs into smaller cases that are easier to investigate. Distributed fuzzing extends campaigns across processes and machines, and target profiles adapt the framework to different JavaScript engines.

Fuzzilli fits teams whose primary target is a JavaScript engine or interpreter and whose workflow can provide instrumented builds. It also supports continuous integration workflows and distributed execution across macOS and Linux. The narrow target scope is its defining limitation: it is not intended as a general-purpose fuzzer for unrelated languages, applications, or input formats. Choose Fuzzilli when JavaScript engine coverage, crash triage, and engine-specific profiles are central requirements. Choose another fuzzing tool when broader target types or platforms outside macOS and Linux are more important.

Your product? Our editors can test Fuzzilli in depth and publish a review, labelled as paid · from $149/mo →

Fuzzilli pricing

Fuzzilli fact sheet

Alternatives to Fuzzilli

• MayhemMayhem brings broad hybrid fuzz testing, triage, and regression coverage to CI workflows.9.4
• OSS-FuzzA cloud-based continuous fuzzing service for qualifying open-source projects.9.2
• ClusterFuzzA broad, self-managed fuzzing platform for continuous security and stability testing.8.9

See all Fuzzilli alternatives →

Used Fuzzilli? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Fuzzilli for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Website

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

5 stars★4 stars★3 stars★2 stars★1 star★

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?Prefer not to sayLess than a month1–6 months6–12 months1–2 years2+ years

I've used Fuzzilli myself and this is my honest opinion — nobody paid or asked me to write it.

Send my reviewPosted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update