Free Security Tools Worth Installing

How to use it. Pick the section that matches your problem, install one tool, and learn it properly before adding another. A small kit you understand beats a big one you don't.

1. Check your own computer and phone

Start here. Most people never look at what their own devices are already telling them.

• Wireshark: the standard free tool for seeing the network traffic on your own computer, packet by packet. It looks overwhelming at first, so start with our guided first capture: Your first Wireshark capture.
• Mobile Verification Toolkit (MVT): an open-source toolkit from Amnesty International's Security Lab for checking iPhone and Android backups for signs of known spyware. It is built for investigators and people at higher risk, such as journalists and activists, and it runs from the command line.
• androidqf: Android Quick Forensics: a small command-line tool that quickly collects logs, installed apps and other evidence from an Android phone so it can be checked for compromise, often alongside MVT.
• Pulse: a read-only Windows diagnostics tool that explains the Event Log and blue screens in plain language, and works offline. It is a small, new open-source project, so read its page before you run it.

Nova: Read-only tools are the safest place to start. They show you what is happening without changing anything, so the worst outcome is learning something.

2. Catch an intruder early

• Canarytokens: free tripwires from Thinkst. You create a fake file, link, document or password, leave it somewhere an intruder would look, and get an email the moment someone opens it. No software to install, and one of the best early warnings a small team can set up in ten minutes.
• TruffleHog: an open-source scanner from Truffle Security that searches code, git history and storage for leaked passwords, API keys and tokens, and checks whether the ones it finds still work. Run it on your own repositories before someone else does.

Canarytokens is the only trap I respect. You never know which file is the bait. — Nyx

3. Check your cloud and accounts

• ScubaGear (Microsoft 365): a free tool from CISA, the US Cybersecurity and Infrastructure Security Agency, that checks a Microsoft 365 tenant's settings against CISA's secure baselines and produces a report of what to fix.
• ScubaGoggles (Google Workspace): the same idea from CISA for Google Workspace: it compares your settings with a secure baseline and lists the gaps.

Both are read-only assessments, but they need an admin account to run, so check with whoever owns the tenant first.

4. Look things up

For when a ticket says "is this site safe?" or "who owns this address?". These are websites, so there's nothing to install.

• ViewDNS.info: free DNS and IP lookups: WHOIS, DNS records, reverse IP, and more. Most tools work without signing up.
• DNSlytics: domain, IP and hosting lookups with historical data, handy when you need to know what used to live at an address.
• What CMS?: tells you which website platform a site runs on, useful when you are checking whether a security alert even applies to you.
• CrowdSec Live Exploit Tracker: a crowd-sourced view of which vulnerabilities are being exploited right now, based on CrowdSec's sensor network. Good for deciding which patch goes first.

Nova: Only look up addresses and domains you have a reason to check, such as one in a phishing email or your own site. Never use these tools to dig into a private person.

5. Build a practice lab

The tools above protect what you have. These are for learning how attacks actually work, safely, on machines you own.

• Kali Linux: the best-known free Linux system for security testing, with hundreds of tools preinstalled. See what the newest version added in our Kali 2026.3 lab.
• Parrot OS: a lighter alternative to Kali with privacy tools included. Not sure which to pick? Read Parrot OS vs Kali.
• Splunk SIEM home lab: a free, guided setup for running Splunk in a home lab the way a SOC analyst would: collecting logs, writing alerts and building dashboards.
• GOAD (Game of Active Directory): a deliberately vulnerable Windows domain you build on your own computer to practise how Active Directory attacks and defences work. It needs a lot of memory, so plan for it.

New to labs? Start with Lab 00: set up your lab, then follow the Network+ roadmap, which puts every hands-on lesson in order.

Everything in section 5 runs on machines you own. Pointing it anywhere else isn't learning, it's a crime. Even I follow that one. — Nyx

Keep these open while you work

• Nmap cheat sheet
• Free practice labs: vulnerable-by-design labs sorted by skill.
• Common ports cheat sheet
• Networking glossary

How we pick

A tool makes this page if it is free, does one job well, comes from a known project or organization, and is useful to beginners, help desk staff or small IT teams. We leave out tools that are mainly for attacking other people's systems, tools that track individuals, and anything with a history of bundling junk. Lab tools are tested in our own lab before we write about them. We review the page as tools change. If something here stops being free or stops being maintained, it comes off.

Nova and Nyx are StashGrid's AI hosts. This page was written with AI help and reviewed before publishing. Tool descriptions are based on each project's own documentation, so check the official page before you install anything.