AFL++

Overview

AFL++ is a coverage-guided fuzzer for developers and security teams probing software they can build or run, from source-available programs to binary targets. Its breadth is compelling for teams prepared to manage local execution, resource use and AGPL obligations; organizations that cannot accept AGPL terms have a separately priced commercial option.

Key features

Instrumentation and mutation

The central afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. AFL++ also offers collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. That range gives practitioners several instrumentation and mutation approaches, while coverage guidance and crash triage support a workflow from exploring execution paths to examining failures. CI/CD support can bring fuzzing into development pipelines, though the execution model remains local rather than managed.

Target flexibility

Documentation covers source-available programs, binary-only targets, network services and GUI programs. Build targets can focus on source-only fuzzing, binary-only fuzzing, or combine both in a distribution build. This is useful for teams with varied targets, but the options do not remove the need to configure and run suitable builds for each target.

Builds and operational cost

The Docker image supports x86_64 and arm64, and its example mounts target source at /src. On Linux, installation guidance recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS builds are documented for x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there, a material restriction for teams relying on those modes. Fuzzing can strain hardware, consume substantial memory or disk, and generate heavy filesystem I/O; sustained runs therefore need deliberate capacity planning.

Pricing

The AGPL-3.0-or-later plan costs nothing. It permits use, study, modification and distribution under AGPL terms, making it the natural choice for users able to meet those obligations. The combined afl-fuzz program is AGPL as a whole; modified versions offered as network services must provide users the corresponding source. Individual source files marked Apache-2.0 may be reused under that license, while bundled third-party components keep their own licenses.

The Commercial license costs €20,000 a year, billed as a donation to EFF or CCC. It lasts one year and can be renewed by donating again; proof of donation must be emailed. It is aimed at organizations unable or unwilling to comply with AGPL. That is a substantial annual commitment, but the stated terms provide a distinct route for those organizations.

Platforms

AFL++ supports Android, Linux, macOS, self-hosted environments and Windows. Local execution and the Docker image's x86_64 and arm64 support offer deployment flexibility, while the macOS mode exclusions make platform choice consequential. Supported languages are C, C++, Python and Rust.

Who it's for

AFL++ fits developers and security teams that want coverage-guided mutation, need to handle different target types, and can operate their own fuzzing runs. It is less suitable for teams that need a managed service, cannot provision for potentially heavy memory, disk and I/O demands, or require the macOS modes that do not work. Users should also settle the licensing question before distributing or offering modified versions as a service.

Pros and cons

Pros: Multiple instrumentation modes and mutation features give teams options for guiding exploration across varied targets.

Pros: Source-only, binary-only and combined build targets, plus documented network-service and GUI fuzzing, suit mixed testing needs.

Pros: A free AGPL plan and a commercial-license route address different organizational licensing needs.

Cons: AGPL source-offer obligations for modified network services may be incompatible with some deployments.

Cons: Resource-intensive runs can put meaningful pressure on hardware, memory, storage and filesystem activity.

Cons: Three documented modes do not work on macOS, narrowing options for teams on that platform.

Alternatives

For a paid API-focused option with a free tier, Mayhem offers up to 50 scans per month on its free plan and a paid plan at $236 a month; consider it when that API plan structure better fits your needs. ClusterFuzz is another free option under Apache-2.0, though production deployment depends on Google Cloud services. Choose cargo-fuzz when its MIT and Apache License (Version 2.0) terms are preferable. Accessibility Test Framework for Android is another free option for readers comparing software in this area. Fortra ZTNA is a paid alternative with quote-based pricing. Fuzzinator is free, with no paid plans or usage limits stated. Jazzer is free and provides coverage-guided, in-process fuzzing for the JVM, making it the more targeted choice for JVM work. boofuzz is a free Python library for building fuzzer scripts under GPL-2.0.

Browse Fuzz Testing Software for more options; the directory also includes Stream Processing Software and Game Mod Managers.

Verdict

Choose AFL++ if you need a flexible, locally run fuzzer for varied targets and can budget for its resource demands and meet AGPL terms. Its instrumentation and target options are the strongest reasons to adopt it; seek another tool if macOS mode limitations, operational burden or licensing make that flexibility a poor fit.