Best Fuzz Testing Software in 2026
Updated
In short: Mayhem is ranked #1 of 27 as of 4 October 2026, ahead of ClusterFuzz and AFL++. The best-ranked option with a free plan is ClusterFuzz. The lowest first paid tier on this page is Mayhem at $236/mo.
Fuzz testing puts varied or generated inputs to work against software targets. Compare input generation methods, supported languages, and target types, along with execution mode, to understand the approaches covered. Mayhem, ClusterFuzz, and AFL++ are among the options to weigh. Coverage guidance and crash triage describe other parts of the workflow, while CI/CD support indicates another comparison point. Free-plan availability and paid-from pricing add cost context. Use the listed criteria to focus on the targets, language needs, and testing workflow relevant to your development work.
27 fuzz testing software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
27ranked
12free plans on this page
$236/molowest paid tier
4 Oct 2026last checked
Input list Fuzz Testing Software 25 channels on this page · 111 of 200 spec lines stated by the makers
Ch Tool Free planPaid fromInput generation methodsTarget typesCoverage guidanceCrash triageExecution modeSupported languages Spec sheet Score
01 Mayhem Free plannot statedPaid fromnot statedInput generation methodshybridTarget typesLinux binaries; Windows PE binaries; TCP/UDP applications; REST APIs; gRPC APIs; containers; automotive vECUsCoverage guidanceYesCrash triageYesExecution modehybridSupported languagesC/C++; Python; Go; Rust; Java 6/8spec lines stated 7.8
02 ClusterFuzz Free plannot statedPaid fromnot statedInput generation methodsmutation, generation, hybridTarget typesbinary formats, HTML, JavaScript, browser DOM, native programsCoverage guidanceYesCrash triageYesExecution modehybridSupported languagesC, C++, Rust; potentially other LLVM-based languages 6/8spec lines stated 7.6
03 AFL++ Free planYesPaid fromnot statedInput generation methodsmutationTarget typessource-code targets, binary-only targets, file inputs, stdin inputs, Android native libraries, Win32 PE binariesCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesC, C++, Python, Rust 7/8spec lines stated 7.5
04 cargo-fuzz Free plannot statedPaid fromnot statedInput generation methodsmutation, generation, hybridTarget typesraw byte buffers, structured Rust data, libraries, APIs, compiler code, allocator operationsCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesRust 6/8spec lines stated 7.5
05 Accessibility Test Framework for Android Free plannot statedPaid fromnot statedInput generation methodsgeneration, mutationTarget typesoperating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, WindowsCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesC, C++, Rust, and other LLVM-compatible languages 6/8spec lines stated 7.3
06 Jazzer Free planYesPaid fromnot statedInput generation methodsmutation, generationTarget typesJVM applications, Java, Kotlin, Scala, Clojure, JNI/native librariesCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesJava, Kotlin, Scala, Clojure 7/8spec lines stated 7.2
07 Fuzzilli Free plannot statedPaid fromnot statedInput generation methodsmutation, generation, hybridTarget typesJavaScript programs and JavaScript engines/interpretersCoverage guidanceYesCrash triageYesExecution modehybridSupported languagesJavaScript 6/8spec lines stated 7.1
08 Schemathesis Free planYesPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 1/8spec lines stated 7.1
09 Csmith Free planYesPaid fromnot statedInput generation methodsgenerationTarget typesC programs; C++ programs; compilersCoverage guidancenot statedCrash triagenot statedExecution modelocalSupported languagesC; C++ 5/8spec lines stated 6.9
10 OSS-Fuzz Free planYesPaid fromnot statedInput generation methodsmutationTarget typessource-code fuzz targets; untrusted user or network inputs; complex input formatsCoverage guidanceYesCrash triageYesExecution modecloudSupported languagesC/C++, Rust, Go, Python, Java/JVM, JavaScript, Lua 7/8spec lines stated 6.9
11 Roslynator Free plannot statedPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 0/8spec lines stated 6.9
12 Black Duck Coverity Free planNoPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 1/8spec lines stated 6.8
13 boofuzz Free planYesPaid fromnot statedInput generation methodshybridTarget typesnetwork protocols, serial, Ethernet/IP, UDP broadcast, TCP, UDP, SSL, raw socketsCoverage guidancenot statedCrash triageYesExecution modelocalSupported languagesPython 6/8spec lines stated 6.5
14 Honggfuzz Free plannot statedPaid fromnot statedInput generation methodsmutationTarget typesfile inputs, standard input, APIs, binaries, network serversCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesC, C++, Rust, and other LLVM-compatible languages 6/8spec lines stated 6.4
15 syzkaller Free plannot statedPaid fromnot statedInput generation methodsgeneration, mutationTarget typesoperating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, WindowsCoverage guidanceYesCrash triageYesExecution modelocalSupported languagesnot stated 5/8spec lines stated 6.2
16 Onyx Launcher Free planYesPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 1/8spec lines stated 6.1
17 Fortra ZTNA Free plannot statedPaid fromnot statedInput generation methodsgenerationTarget typesnetwork protocols, file formats, hardware, DLLs, APIs, binary applicationsCoverage guidancenot statedCrash triageYesExecution modehybridSupported languagesnot stated 4/8spec lines stated 6.0
18 Scout Suite Free planYesPaid fromnot statedInput generation methodsmutationTarget typesNetwork protocols and services including TCP, UDP, SSL, IPP, LPD, BACnet, Modbus, DHCP, TFTP, Telnet CLI, Netconf, COPS, and raw requestsCoverage guidancenot statedCrash triageYesExecution modelocalSupported languagesPython 3 6/8spec lines stated 6.0
19 FuzzForge Free planYesPaid fromnot statedInput generation methodsgenerationTarget typescodebases, binaries, containers, APIs, GraphQL, protocols, firmware, embedded systemsCoverage guidancenot statedCrash triageYesExecution modehybridSupported languagesnot stated 5/8spec lines stated 5.9
20 Netzob Free planYesPaid fromnot statedInput generation methodsmutation, generationTarget typesnetwork protocols, structured files, text protocols, delimiter-based protocols, fixed-field protocols, variable-length/TLV protocols, IPC, drivers and devicesCoverage guidancenot statedCrash triagenot statedExecution modelocalSupported languagesPython 3 5/8spec lines stated 5.9
21 Wfuzz Free planYesPaid fromnot statedInput generation methodsgenerationTarget typesHTTP URLs, paths, files, query parameters, POST data, cookies, headers, HTTP verbs, authenticationCoverage guidancenot statedCrash triagenot statedExecution modelocalSupported languagesPython 5/8spec lines stated 5.9
22 EvoMaster Free planYesPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 1/8spec lines stated 5.8
23 EvoMaster Free planYesPaid fromnot statedInput generation methodsnot statedTarget typesnot statedCoverage guidancenot statedCrash triagenot statedExecution modenot statedSupported languagesnot stated 1/8spec lines stated 5.8
24 Fuzzinator Free plannot statedPaid fromnot statedInput generation methodsgeneration, mutationTarget typesstdin, command-line, files, HTTP/browserCoverage guidancenot statedCrash triageYesExecution modelocalSupported languagesnot stated 4/8spec lines stated 5.8
25 Fuzzware Free plannot statedPaid fromnot statedInput generation methodsmutationTarget typesARM Cortex-M firmware; Infineon AURIX TriCore firmware; MMIO and interrupt-driven embedded systemsCoverage guidanceYesCrash triagenot statedExecution modelocalSupported languagesnot stated 4/8spec lines stated 5.8
Compare all 25 in a table
| # | Tool | Score | Free plan | From | Free plan | Paid from | Input generation methods | Target types |
|---|---|---|---|---|---|---|---|---|
| 1 | Mayhem | 7.8 | Free plan | $236/mo | — | — | hybrid | Linux binaries; Windows PE binaries; TCP/UDP applications; REST APIs; gRPC APIs; containers; automotive vECUs |
| 2 | ClusterFuzz | 7.6 | Free plan | Free | — | — | mutation, generation, hybrid | binary formats, HTML, JavaScript, browser DOM, native programs |
| 3 | AFL++ | 7.5 | Free plan | €1666.67/mo | Yes | — | mutation | source-code targets, binary-only targets, file inputs, stdin inputs, Android native libraries, Win32 PE binaries |
| 4 | cargo-fuzz | 7.5 | Free plan | Free | — | — | mutation, generation, hybrid | raw byte buffers, structured Rust data, libraries, APIs, compiler code, allocator operations |
| 5 | Accessibility Test Framework for Android | 7.3 | Free plan | Free | — | — | generation, mutation | operating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows |
| 6 | Jazzer | 7.2 | Free plan | Free | Yes | — | mutation, generation | JVM applications, Java, Kotlin, Scala, Clojure, JNI/native libraries |
| 7 | Fuzzilli | 7.1 | Free plan | Free | — | — | mutation, generation, hybrid | JavaScript programs and JavaScript engines/interpreters |
| 8 | Schemathesis | 7.1 | Free plan | Free | Yes | — | — | — |
| 9 | Csmith | 6.9 | Free plan | Free | Yes | — | generation | C programs; C++ programs; compilers |
| 10 | OSS-Fuzz | 6.9 | Free plan | Free | Yes | — | mutation | source-code fuzz targets; untrusted user or network inputs; complex input formats |
| 11 | Roslynator | 6.9 | Free plan | Free | — | — | — | — |
| 12 | Black Duck Coverity | 6.8 | No | — | No | — | — | — |
| 13 | boofuzz | 6.5 | Free plan | Free | Yes | — | hybrid | network protocols, serial, Ethernet/IP, UDP broadcast, TCP, UDP, SSL, raw sockets |
| 14 | Honggfuzz | 6.4 | No | — | — | — | mutation | file inputs, standard input, APIs, binaries, network servers |
| 15 | syzkaller | 6.2 | No | — | — | — | generation, mutation | operating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows |
| 16 | Onyx Launcher | 6.1 | No | — | Yes | — | — | — |
| 17 | Fortra ZTNA | 6.0 | No | — | — | — | generation | network protocols, file formats, hardware, DLLs, APIs, binary applications |
| 18 | Scout Suite | 6.0 | No | — | Yes | — | mutation | Network protocols and services including TCP, UDP, SSL, IPP, LPD, BACnet, Modbus, DHCP, TFTP, Telnet CLI, Netconf, COPS, and raw requests |
| 19 | FuzzForge | 5.9 | No | — | Yes | — | generation | codebases, binaries, containers, APIs, GraphQL, protocols, firmware, embedded systems |
| 20 | Netzob | 5.9 | No | — | Yes | — | mutation, generation | network protocols, structured files, text protocols, delimiter-based protocols, fixed-field protocols, variable-length/TLV protocols, IPC, drivers and devices |
| 21 | Wfuzz | 5.9 | No | — | Yes | — | generation | HTTP URLs, paths, files, query parameters, POST data, cookies, headers, HTTP verbs, authentication |
| 22 | EvoMaster | 5.8 | No | — | Yes | — | — | — |
| 23 | EvoMaster | 5.8 | No | — | Yes | — | — | — |
| 24 | Fuzzinator | 5.8 | No | — | — | — | generation, mutation | stdin, command-line, files, HTTP/browser |
| 25 | Fuzzware | 5.8 | No | — | — | — | mutation | ARM Cortex-M firmware; Infineon AURIX TriCore firmware; MMIO and interrupt-driven embedded systems |
Is your tool on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which fuzz testing software is ranked first on Specifiction?
Mayhem is ranked #1 of 27 with a score of 7.8. ClusterFuzz is second and AFL++ third.
How many of these have a free plan?
12 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Mayhem has the lowest first paid tier we found: $236/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing.
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Software Composition Analysis Software 65Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56