Gophish vs uPhish
Gophish
getgophish.comuPhish
usecure.ioSide by side
| Figure | Gophish | uPhish |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Phishing Simulation Software | 8.1 (#4) | 6.9 (#18) |
| Spec score · Security Awareness Training Software | 8.1 (#7) | 6.9 (#22) |
| Audience | The user guide describes Gophish as a toolkit for pentesters and businesses conducting real-world phishing simulations. | The maker describes usecure as serving MSPs and IT teams, and says uPhish scales from hundreds of users to hundreds of clients. |
| Campaigns | Campaigns send phishing emails in the background and can be scheduled. | Users can build targeted templates and simulate spear-phishing or internal spoofing attacks using domain spoofing. |
| Purpose | Gophish is an open-source framework for testing an organization's exposure to phishing. | uPhish automates phishing simulations and provides follow-up training for users who click. |
| Support | The project asks users to file an issue for bugs, feature requests, or missing documentation. | The pricing page lists in-app live chat and a knowledge base/help centre; its FAQ says plans include support team access, onboarding resources, and product documentation. |
| Templates | Users can create or import phishing templates and customize them in a browser-based HTML editor. | The product page lists more than 400 phishing templates, including brand impersonations based on current attack trends. |
| Tracking | The interface shows recipient timelines with email opens, link clicks, and submitted credentials. | uPhish tracks opens, clicks, and compromises and provides real-time comparisons across users, teams, or the organisation. |
Plans
In their own words
Gophish
Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.