Skip to content
SPECIFICTION
Get listed

Gophish

getgophish.com

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit getgophish.com
Spec score 8.1 #4 of 31 in Phishing Simulation Software

What it is

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Spec sheet

Purpose
Gophish is an open-source framework for testing an organization's exposure to phishing.Read 8 Oct 2026 · getgophish.com
Audience
The user guide describes Gophish as a toolkit for pentesters and businesses conducting real-world phishing simulations.Read 8 Oct 2026 · docs.getgophish.com
Platforms
The project provides binary releases for Windows, Mac, and Linux.Read 8 Oct 2026 · github.com
Deployment
Gophish can be run from a downloaded binary or through the official Docker container.Read 8 Oct 2026 · github.com
API
Gophish provides a REST API and a Python client.Read 8 Oct 2026 · getgophish.com
Support
The project asks users to file an issue for bugs, feature requests, or missing documentation.Read 8 Oct 2026 · github.com
License
The repository includes the MIT License for Gophish Community Edition, which permits use, copying, modification, distribution, and sale subject to the license terms.Read 8 Oct 2026 · github.com
Campaigns
Campaigns send phishing emails in the background and can be scheduled.Read 8 Oct 2026 · getgophish.com
Notable limit
The release notes list attachment tracking support for docx, docm, pptx, xlsx, xlsm, txt, html, and ics files.Read 8 Oct 2026 · github.com
Reporting
Campaign results are delivered near real time and can be exported for reports.Read 8 Oct 2026 · getgophish.com
Security feature
Version 0.12.1 added configurable trusted origins to the CSRF handler for setups where TLS terminates at an upstream load balancer.Read 8 Oct 2026 · github.com
Templates
Users can create or import phishing templates and customize them in a browser-based HTML editor.Read 8 Oct 2026 · getgophish.com
Tracking
The interface shows recipient timelines with email opens, link clicks, and submitted credentials.Read 8 Oct 2026 · getgophish.com

Plans and prices

Gophish Free For free. Open-source phishing framework Read 8 Oct 2026 · getgophish.com

Every Gophish plan and price →

Strong points and limits

Strong points

  • Free open-source Community Edition.
  • Campaigns can be scheduled and run in the background.
  • Results include recipient timelines and report exports.
  • Provides a REST API and Python client.

Limits

  • Attachment tracking is listed for specific file formats only.
  • The project asks users to file issues for bugs or missing documentation.

Who it suits

Gophish suits penetration testers and businesses conducting phishing simulations. Its API, Python client, and exportable campaign results may also suit teams that want programmatic access or reporting.

Verdict

Gophish provides campaign creation, tracking, and export tools for phishing simulations at no charge. Review its listed attachment formats and license terms when deciding whether it fits your setup.

Where Specifiction places it

Alternatives to GophishAll alternatives →