DarkPhish vs Hackiwi

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research. Users can prepare or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines and export results. The free Community plan costs nothing and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting and the core REST API. Paid plans start at €249/mo (annual). The platform lists API, Linux, self-hosted and web availability; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. Supported databases include SQLite, MySQL/MariaDB and PostgreSQL. DarkPhish describes encrypted and signed browser sessions, scoped expiring API tokens, secrets hidden from normal API responses, and signed, hash-chained administrative audit records. Professional and Enterprise plans are in development, with further capabilities planned. The project states that the software is for authorized testing and simulations only.

Hackiwi is a security platform for organisational training, phishing simulations, suspicious-message triage and exposure monitoring. Its video and written lessons include interactive knowledge checks; teams can assign learning paths and track completion. The public training library is free to browse without an account, and its content is licensed under CC-BY-4.0. Organisations with up to 20 users can use the full platform free. Phishing campaigns are available only to verified organisations and domains, and track opens, clicks and reports with safety gates and audit logs. Submitted credentials are not retained; only the event is recorded. Staff can forward suspicious messages from desktop or phone mail clients for automated classification and reputation checks. Exposure tools cover scope-locked OSINT, website scanning, dependency CVE tracking, domain monitoring and alerts for newly registered lookalike domains. Hackiwi runs on the web or on an organisation’s own infrastructure under AGPL-3.0. Its simulator is not offered to individuals or families, and organisations above 20 users pay for premium tooling.