Skip to content
SPECIFICTION
Get listed

DarkPhish

darkphish.sk

Free plan Open source WebLinuxAPISelf-hosted
Visit darkphish.sk
Spec score 8.8 #1 of 30 in Security Awareness Training Software

What it is

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research. Users can prepare or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines and export results. The free Community plan costs nothing and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting and the core REST API. Paid plans start at €249/mo (annual). The platform lists API, Linux, self-hosted and web availability; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. Supported databases include SQLite, MySQL/MariaDB and PostgreSQL. DarkPhish describes encrypted and signed browser sessions, scoped expiring API tokens, secrets hidden from normal API responses, and signed, hash-chained administrative audit records. Professional and Enterprise plans are in development, with further capabilities planned. The project states that the software is for authorized testing and simulations only.

Spec sheet

What it does
DarkPhish is a free platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research.Read 15 Oct 2026 · darkphish.sk
Purpose
DarkPhish is a free platform for authorized phishing simulations, security-awareness training, internal security testing, and defensive research.Read 8 Oct 2026 · darkphish.sk
Support
Bug reports, questions and feature requests are directed to GitHub Issues, while vulnerabilities use a private reporting channel.Read 15 Oct 2026 · github.com
Maker
The website credits DarkArmy and fsociety as DarkPhish developers.Read 15 Oct 2026 · darkphish.sk
API credentials
API access uses scoped, expiring personal access tokens instead of permanent legacy API keys.Read 15 Oct 2026 · darkphish.sk
API maturity
The changelog says the public API and schema remain pre-1.0 and follow Semantic Versioning.Read 15 Oct 2026 · raw.githubusercontent.com
API rate limits
Release 0.22.3 limits administrative API requests to 100 per minute per browser user or personal token.Read 15 Oct 2026 · raw.githubusercontent.com
Audit cryptography
Audit records use SHA-256 hash chaining, rotating Ed25519-signed checkpoints and verifiable JSON export manifests.Read 15 Oct 2026 · raw.githubusercontent.com
Audit trail
Administrative events are recorded in a tamper-evident audit trail.Read 15 Oct 2026 · darkphish.sk
Authorized use
DarkPhish states that it is for authorized security testing and simulations only.Read 8 Oct 2026 · darkphish.sk
Browser security
The site says browser sessions are encrypted and signed, with hardened cookie settings.Read 8 Oct 2026 · darkphish.sk
Campaign delivery
Campaigns can launch immediately or be scheduled for later delivery.Read 15 Oct 2026 · darkphish.sk
Campaign monitoring
The product shows campaign activity near real time, recipient timelines and exportable results.Read 15 Oct 2026 · darkphish.sk
Campaign setup
Users can create or import phishing templates, define approved recipients and edit campaign content in a browser.Read 15 Oct 2026 · darkphish.sk
Campaign workflow
Users can create or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines, and export results.Read 8 Oct 2026 · darkphish.sk
Credential protection
The changelog documents AES-256-GCM secret envelopes, scoped expiring revocable tokens and Argon2id password hashing.Read 15 Oct 2026 · raw.githubusercontent.com
Database support
The software supports SQLite, MySQL or MariaDB, and PostgreSQL.Read 15 Oct 2026 · github.com
Default access
The administration interface listens on localhost at HTTPS port 3333 by default, with SSH tunneling documented for remote access.Read 15 Oct 2026 · github.com
Documentation
The project links installation, deployment, native-update, development, architecture, security-policy and changelog documentation.Read 15 Oct 2026 · github.com
Email templates
The platform supports email-template creation and landing-page building.Read 15 Oct 2026 · github.com
Enterprise plan
Enterprise is in development; planned capabilities include unlimited managed users and campaigns, SSO, advanced RBAC, SIEM integrations, multi-organization support, SLA, and on-premises or air-gapped deployment.Read 8 Oct 2026 · darkphish.sk
Installation
The installer detects Linux distribution and CPU architecture, installs dependencies and creates a hardened systemd service.Read 15 Oct 2026 · github.com
Latest notable release
Version 0.26.0 was released on 2026-10-04 with an accessible animated theme switch and webpack 5.111.1 updates.Read 15 Oct 2026 · github.com
Licence
DarkPhish is distributed under the MIT License and derives from Gophish with original notices preserved.Read 15 Oct 2026 · github.com
Limit: active campaigns
The free Community plan permits only one active campaign.Read 15 Oct 2026 · darkphish.sk
Limit: deployment scope
The documented installer deliberately refuses to overwrite an existing or partial installation.Read 15 Oct 2026 · github.com
Limit: old API keys
Permanent legacy API keys were disabled during the migration to scoped personal access tokens.Read 15 Oct 2026 · raw.githubusercontent.com
Limit: paid availability
Professional and Enterprise editions are described as still in development rather than generally available.Read 15 Oct 2026 · darkphish.sk
Linux installation
The installer supports fresh systemd-based Linux deployments on amd64 and arm64.Read 8 Oct 2026 · github.com
Professional plan
Professional is in development; planned capabilities include 250 managed users, unlimited campaigns, human-risk and training workflows, Smart Groups, Entra/Google support, and advanced reporting with AI.Read 8 Oct 2026 · darkphish.sk
Release security
GitHub releases provide native binaries, SHA-256 checksums and SPDX software bills of materials.Read 15 Oct 2026 · github.com
Reporting mailbox
DarkPhish can process reporting mailboxes through IMAP.Read 15 Oct 2026 · github.com
Repository activity
The public GitHub repository reports 1,018 commits, zero stars and zero forks on the opened repository page.Read 15 Oct 2026 · github.com
Secret handling
SMTP, IMAP and webhook secrets are write-only in normal API responses.Read 15 Oct 2026 · darkphish.sk
Self-hosting
DarkPhish describes itself as self-hosted by design, with users, campaigns, and security data under the customer's control.Read 8 Oct 2026 · darkphish.sk
Sending profiles
Campaign delivery uses configurable sending profiles.Read 15 Oct 2026 · github.com
Session security
The vendor describes browser sessions as encrypted and signed with hardened cookie settings.Read 15 Oct 2026 · darkphish.sk
System requirements
Documented fresh installations require systemd-based Linux on amd64 or arm64.Read 15 Oct 2026 · github.com
Token limits
Release 0.22.3 limits personal-token creation to five requests per minute per user and 100 active tokens.Read 15 Oct 2026 · raw.githubusercontent.com
User management
The administration interface manages users and groups.Read 15 Oct 2026 · github.com

Plans and prices

Community Free €0 / forever Managed users up to 100 · 1 active campaign · simulation engine · basic reporting · core REST API Read 15 Oct 2026 · darkphish.sk
Enterprise Priced on request Coming soon; currently in development Unlimited managed users and campaigns · SSO and advanced RBAC · SIEM integrations · multi-organization · SLA · on-premises / air-gapped deployment Read 15 Oct 2026 · darkphish.sk
Professional Priced on request Coming soon; currently in development 250 managed users included · unlimited campaigns · human risk and training · Smart Groups · Entra / Google · advanced reporting and AI Read 15 Oct 2026 · darkphish.sk

Every DarkPhish plan and price →

Strong points and limits

Strong points

  • Self-hosted campaign and security data
  • Free plan includes up to 100 managed users
  • Supports SQLite, MySQL/MariaDB and PostgreSQL
  • Provides campaign timelines and result exports
  • API access uses scoped, expiring tokens

Limits

  • Community allows one active campaign
  • Professional and Enterprise plans are in development
  • Linux installer targets systemd-based amd64 and arm64 deployments

Who it suits

DarkPhish suits security teams conducting authorized simulations, internal testing or defensive research. Its self-hosted approach may fit organizations that want users, campaigns and security data under their control.

Verdict

DarkPhish provides a self-hosted workflow for authorized phishing campaigns, with a free Community plan and a stated paid starting rate. Note the one-campaign Community limit and that higher-tier plans are still in development.

Where Specifiction places it

Alternatives to DarkPhishAll alternatives →