Gophish vs Hackiwi

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Hackiwi is a security platform for organisational training, phishing simulations, suspicious-message triage and exposure monitoring. Its video and written lessons include interactive knowledge checks; teams can assign learning paths and track completion. The public training library is free to browse without an account, and its content is licensed under CC-BY-4.0. Organisations with up to 20 users can use the full platform free. Phishing campaigns are available only to verified organisations and domains, and track opens, clicks and reports with safety gates and audit logs. Submitted credentials are not retained; only the event is recorded. Staff can forward suspicious messages from desktop or phone mail clients for automated classification and reputation checks. Exposure tools cover scope-locked OSINT, website scanning, dependency CVE tracking, domain monitoring and alerts for newly registered lookalike domains. Hackiwi runs on the web or on an organisation’s own infrastructure under AGPL-3.0. Its simulator is not offered to individuals or families, and organisations above 20 users pay for premium tooling.