Gophish review
A focused, free phishing-simulation framework for developers running self-hosted campaigns.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Gophish is a self-hosted, open-source phishing framework for businesses and penetration testers. It is designed for teams that need to create simulated phishing emails and landing pages, organize recipients into groups, schedule campaigns, and monitor recipient activity. Developers can run it on Windows, macOS, or Linux, while the REST API and official Python client support programmatic workflows. Its strongest fit is an organization running basic, internally managed phishing simulations rather than a broad employee-training program.
Campaign creation is the product's standout area. Gophish supports creating or importing HTML email templates, creating and customizing landing pages, and capturing submitted credentials in those pages. Campaign tracking includes email opens, link clicks, submitted data, and device information. Results can be reviewed through the dashboard or exported as CSV, giving teams a direct way to examine campaign activity. Scheduling, recipient groups, role-based user accounts, and API access add useful operational controls for developers and penetration testers managing recurring simulations.
The tradeoff is a narrow focus. Gophish covers phishing simulation and campaign operations, but the published feature set does not include automated training, risk scoring, SSO, a supported mail-client reporting button, or advertised course languages. Teams seeking a wider security-awareness program should choose a product with training delivery and broader employee-risk management. Gophish is the better choice for developers who value open-source software, self-hosting, campaign customization, and direct data export, especially when phishing exercises are the primary requirement.
Gophish pros and cons
- Where it wins
- Free and open source with Windows, macOS, and Linux binaries
- Creates, schedules, and tracks phishing campaigns
- REST API, Python client, CSV export, and role-based accounts
- Where it doesn't
- Focused on phishing operations rather than broader awareness training
- No verified automated training or risk-scoring features
- No verified SSO, reporting button, or advertised course languages
Gophish fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update