Gophish vs SentryMail
Gophish
getgophish.com
SentryMail
sentrymail.deSide by side
| Figure | Gophish | SentryMail |
|---|---|---|
| Price from | Free | €0.83/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 12 |
| Spec score · Security Awareness Training Software | 8.1 (#7) | 8.8 (#2) |
| API | Gophish provides a REST API and a Python client. | The documentation exposes API routes including an evidence-package endpoint at GET /audit-events/evidence-package. |
| Campaigns | Campaigns send phishing emails in the background and can be scheduled. | Campaigns support scheduling, HTML or Markdown templates, .eml import, landing pages, and per-recipient tracking of opens, clicks, and form submissions. |
| Deployment | Gophish can be run from a downloaded binary or through the official Docker container. | The official installation guide describes a Docker Compose stack and lists Linux with Docker Engine as its operating-system requirement. |
| Purpose | Gophish is an open-source framework for testing an organization's exposure to phishing. | SentryMail is a self-hosted open-core platform for phishing awareness that lets teams plan, send, and evaluate simulated campaigns per recipient. |
| Reporting | Campaign results are delivered near real time and can be exported for reports. | The platform provides campaign reporting and analytics, including a dashboard risk score and CSV export of campaign results. |
| Support | The project asks users to file an issue for bugs, feature requests, or missing documentation. | Community users are directed to GitHub support, while Business includes email support. |
| Tracking | The interface shows recipient timelines with email opens, link clicks, and submitted credentials. | The system records opens, clicks and form submissions with session history and engagement context. |
Plans
SentryMail
- CommunityFree
- Business (2,501+ employees)€10 a year
- Business (1,001–2,500 employees)€11 a year
- Business (501–1,000 employees)€13 a year
- Enterprise (2,501+ employees)€14 a year
- Business (301–500 employees)€15 a year
- Business (151–300 employees)€18 a year
- Business (51–150 employees)€21 a year
- Business (25–50 employees)€25 a year
- Enterprise (25–50 employees)€35 a year
In their own words
Gophish
Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.
SentryMail
SentryMail is a self-hosted phishing-awareness platform for planning simulated campaigns and reviewing recipient-level responses. Teams can schedule campaigns, build them from HTML or Markdown templates, import .eml files, create landing pages, and track opens, clicks, and form submissions for each recipient. Reports include campaign analytics, a dashboard risk score, and CSV export. The Enterprise LMS adds self-hosted mandatory video training, automatic course assignments for low awareness scores, quizzes, and certificates. Listed integrations include LDAP, Microsoft Graph, SCIM 2.0, OIDC/SSO providers, and SMTP services. Enterprise adds SAML SSO, SIEM exports, and LMS xAPI export. Security measures listed include Argon2id passwords, encrypted secrets, two-factor authentication, audit logs, hardened containers, and hash-chained audit entries with an exportable evidence package. Community is free forever and self-hosted. Paid plans require at least 25 employees; Business and Enterprise license purchases are marked as coming soon. Installation documentation calls for Docker Compose and Linux with Docker Engine.