Gophish
Gophish: A focused, free phishing-simulation framework for developers running self-hosted campaigns. Ranked #22 of 30 in Security Awareness Training Software by our editors (7.2/10); pricing: Free plan; best for developers running basic self-hosted simulations.
At a glance
- Editor score7.2 / 10
- PricingFree plan
- Best forDevelopers running basic self-hosted simulations
- Free planYes
- Paid fromFree
- Phishing simulationsYes
- Facts checked20 Sep 2026
Where it wins
- Free and open source with Windows, macOS, and Linux binaries
- Creates, schedules, and tracks phishing campaigns
- REST API, Python client, CSV export, and role-based accounts
Where it doesn't
- Focused on phishing operations rather than broader awareness training
- No verified automated training or risk-scoring features
- No verified SSO, reporting button, or advertised course languages
Our verdict on Gophish
Gophish is a self-hosted, open-source phishing framework for businesses and penetration testers. It is designed for teams that need to create simulated phishing emails and landing pages, organize recipients into groups, schedule campaigns, and monitor recipient activity. Developers can run it on Windows, macOS, or Linux, while the REST API and official Python client support programmatic workflows. Its strongest fit is an organization running basic, internally managed phishing simulations rather than a broad employee-training program.
Campaign creation is the product's standout area. Gophish supports creating or importing HTML email templates, creating and customizing landing pages, and capturing submitted credentials in those pages. Campaign tracking includes email opens, link clicks, submitted data, and device information. Results can be reviewed through the dashboard or exported as CSV, giving teams a direct way to examine campaign activity. Scheduling, recipient groups, role-based user accounts, and API access add useful operational controls for developers and penetration testers managing recurring simulations.
The tradeoff is a narrow focus. Gophish covers phishing simulation and campaign operations, but the published feature set does not include automated training, risk scoring, SSO, a supported mail-client reporting button, or advertised course languages. Teams seeking a wider security-awareness program should choose a product with training delivery and broader employee-risk management. Gophish is the better choice for developers who value open-source software, self-hosting, campaign customization, and direct data export, especially when phishing exercises are the primary requirement.
Your product? Our editors can test Gophish in depth and publish a review, labelled as paid · from $149/mo →
Gophish pricing
Gophish fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Phishing simulations | Yes |
| Phish reporting button | Not verified |
| Automated training | Not verified |
| Risk scoring | Not verified |
| SSO support | Not verified |
| Course languages | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Docs |
| Built for | Solo, Small business, Mid-market (editorial estimate) |
| Pricing | Free plan |
| Website | getgophish.com |
| Facts checked | 20 Sep 2026 |
Alternatives to Gophish
- KnowBe4A broad security awareness platform with phishing tests, automated training, and risk scoring.9.4
- HoxhuntA multilingual, multichannel training platform with adaptive phishing simulations and automated learning.9.3
- Infosec IQA mature, highly configurable platform for enterprise security awareness programs.9.2
See all Gophish alternatives →
Also Ranked In
Gophish is ranked in 2 of our directories.
Used Gophish? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Gophish for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Gophish is listed in our Security Awareness Training Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/gophish/"><img src="https://www.itechguides.com/best/badge/gophish.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update