This page's audience our own tag's counts — open to see them

Period

–Visits

–Page views

–Clicks to vendors

–Time on page

–Reading now

Clicks to vendors, by tool

Top countries

Devices

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

WuppieFuzz

Free#25 of 27 in API Security Testing Software

WuppieFuzz: A focused open-source fuzzer for exploring REST API behavior from OpenAPI or Swagger specifications. Ranked #25 of 27 in API Security Testing Software by our editors (6.7/10); pricing: Open source; best for coverage-guided REST API fuzzing.

6.7/10Editor score

Visit WuppieFuzz

WuppieFuzz6.7 Visit WuppieFuzz

At a glance

Editor score
6.7 / 10
Pricing
Open source
Best for
Coverage-guided REST API fuzzing
Paid from
Free
Facts checked
20 Sep 2026

Where it wins
- Coverage-guided request generation and mutation for REST APIs
- Supports black-box, grey-box, and white-box testing
- Reports endpoint, JaCoCo, and LCOV code coverage
Where it doesn't
- Does not provide API discovery
- Does not test authorization controls
- Does not cover business-logic testing

Our verdict on WuppieFuzz

WuppieFuzz is an open-source REST API fuzzer developed by TNO Software & System Security. It is designed for security and robustness testing teams that want to generate and mutate API requests, then use coverage and response feedback to explore service behavior. The tool accepts OpenAPI or Swagger specifications in JSON or YAML and runs as a standalone command-line application on Windows, macOS, and Linux. Docker-based execution is also supported.

Its strongest capability is coverage-guided fuzzing. WuppieFuzz combines automatic request generation and mutation with black-box, grey-box, and white-box testing modes. Authentication options include bearer, custom, cookie, OAuth, and WFC authentication. For analysis, it provides endpoint coverage reporting, JaCoCo and LCOV code-coverage reporting, and Grafana-based visualization of fuzzing results. Its ecosystem fit is focused rather than broad, with integrations or supported inputs including LibAFL, OpenAPI, Swagger, Grafana, JaCoCo, and LCOV. The self-hosted deployment model gives technical teams control over execution environments and CI-oriented workflows.

WuppieFuzz is a suitable choice when the primary goal is coverage-guided testing of REST APIs represented by OpenAPI or Swagger definitions. It is less suitable for teams looking for a wider API security platform: it does not provide API discovery, authorization testing, or business-logic testing. Those requirements call for a product with dedicated coverage in those areas. Teams that already maintain API specifications and want configurable authentication, multiple fuzzing modes, coverage reporting, and Docker execution will find its scope aligned with focused fuzzing work.

Your product? Our editors can test WuppieFuzz in depth and publish a review, labelled as paid · from $149/mo →

WuppieFuzz pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.

See plans on github.com

WuppieFuzz fact sheet

Free plan	Not verified
Paid from	Free
API discovery	No
Authentication testing	Yes
Authorization testing	Not verified
Input-validation testing	Yes
Business-logic testing	Not verified
Deployment	Self-hosted
API formats	OpenAPI/Swagger in JSON or YAML
Deployment	Desktop, Self-hosted
Platforms	Windows, macOS, Linux
Support	Docs
Built for	Solo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations	6 integrations: LibAFL, OpenAPI, Swagger, Grafana, JaCoCo, LCOV
Pricing	Open source
Website	github.com
Facts checked	20 Sep 2026

WuppieFuzz integrations

WuppieFuzz lists 6 integrations on its own site.

LibAFL
OpenAPI
Swagger
Grafana
JaCoCo
LCOV

Alternatives to WuppieFuzz

See all WuppieFuzz alternatives →

Used WuppieFuzz? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used WuppieFuzz for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used WuppieFuzz myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

WuppieFuzz is listed in our API Security Testing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/wuppiefuzz/"><img src="https://www.itechguides.com/best/badge/wuppiefuzz.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update