Security Go Libraries Ranking
Libraries that are used to help make your application more secure.
64 repositories, updated daily.
- A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
- Pure Go ACME client library and CLI tool (for use with Let's Encrypt).
- Mature, robust, and powerful ACME client integration for fully-managed TLS certificate issuance and renewal.
- Tool and library to remotely hack RTSP streams from surveillance cameras.
- Enterprise-ready, modsecurity and OWASP CRS compatible WAF library.
- A pure Go library for handling sensitive values in memory.
- HTTP middleware for Go that facilitates some quick security wins.
- A secure low code honeypot framework, leveraging AI for System Virtualization.
- high-level cryptographic library for solving typical data security tasks (secure data storage, secure messaging, zero-knowledge proof authentication), available for 14 languages, best fit for multi-platform apps.
- Network encryption proxy to protect database-based applications from data leaks: strong selective encryption, SQL injections prevention, intrusion detection system.
- A simple, semantic and developer-friendly golang package for encoding&decoding and encryption&decryption.
- Web Application Firewall middleware for the Caddy server, with a regex rule engine, anomaly scoring, IP/DNS/ASN/country blacklists and rate limiting.
- Fast initramfs generator with full-disk encryption support.
- Password validator based on raw cryptographic entropy values.
- teler-waf is a Go HTTP middleware that provide teler IDS functionality to protect against web-based attacks and improve the security of Go-based web applications. It is highly configurable and easy to integrate into existing Go applications.
- A rest application to dynamically update firewalld rules on a linux server.
- In-memory, application-driven jailer built in the spirit of fail2ban.
- A software library for creating secure and anonymous decentralized systems.
- Scrypt package with a simple, obvious API and automatic cost calibration built-in.
calpa/urusai
- Urusai ("noisy" in Japanese) is a Go implementation of a random HTTP/DNS traffic noise generator that helps protect privacy by creating digital smokescreens while browsing.
- Zero-code log sanitization sidecar for Kubernetes that redacts PII from logs.
plusvic/yara
, the "pattern matching swiss knife for malware researchers (and everyone else)".
djadmin/fort
- Audits macOS security settings across 16 checks, reports a score, and fixes issues where it safely can. Single binary, installable via Homebrew.
- Provides a unified implementation between different password hashing algorithms
- A probably paranoid package for securely hashing and encrypting passwords.
- Solve ACME http-01 challenge without opening port 80 to the internet, obtain certs from an external certificate authority.
- Password generator that can be used on the cli or as a library.
- Deterministic, format-preserving removal of personally identifiable information from text and structured data.
- An opinionated tool for generating tls certificates.
- Process-scoped runtime investigator using eBPF to trace process lifecycle, file activity, and network connections.
- Prevent your secrets from leaking into logs, std\* etc.
- An keyexchanging+authenticating+encrypting wrapper and multiplexer for `io.ReadWriteCloser` based on XChaCha20-poly1305, ECDH and ED25519.
kanywst/y509
- TUI for X.509 certificate chains that reports whether a chain verifies and, separately, whether a server served it correctly.
- SSL certificates made easy with a high level wrapper around acme/autocert.
- Zero-dependency pre-commit secret scanner using Aho-Corasick for high-performance credentials leak detection.
- light wrapper around Go's argon2 package that closely mirrors with Go's standard library Bcrypt and simple-scrypt package.
- CLI to scan, validate and audit .env files for leaked secrets and environment drift.
- Argon2 password hash and verification designed to be compatible with existing Python and PHP implementations.
- Client for the ANU Quantum Numbers (AQN) API, providing quantum-mechanically secure random data.
- Static analysis tool to detect accidental logging of sensitive struct fields, preventing data leaks in logs.
- An n-out-of-N keys encryption/decryption framework based on Shamir's Secret Sharing algorithm.
- CSPRNG-backed credential generator with a versioned JSON schema for passwords, passphrases, secrets, API keys, and PINs.
- A Deterministic Random Bit Generator based on AES in Counter mode (AES-CTR-DRBG) as specified in NIST SP 800-90A.
- Minimal, stateless authorization engine with a pluggable evaluation model.
getveil/veil
- Local HTTPS proxy that hides API credentials from AI coding agents. OS keychain integration, format-aware placeholders, SQLite audit log.
- Entropy Password Generator with extensive command line arguments to generate random strings securely including digits, passwords, and passwords built using obscure dictionary words mixed with symbols and digits.
- Rule-based data generator for fuzzing and penetration testing.
- Encrypted .env vault manager with interactive TUI for managing secrets across multiple environments and profiles.
- Go library for Russian GOST cryptographic standards (digital signatures, Streebog hash, Kuznechik cipher, MGM AEAD) backed by OpenSSL gost-engine.
- Unix-style password manager written in Go to save your data with OpenPGP encryption.
- Security scanner for MCP servers with prompt injection detection, tool shadowing, and SARIF output.
alesr/redact
- Redact sensitive information from slog-based logs using a configurable pipeline.
- Asymmetric-key audio steganography library that hides encrypted messages inside compressed audio using X25519 and ChaCha20-Poly1305.
ijin82/grim
- Fast and secure CLI tool for managing encrypted Markdown note vaults in volatile memory.
- Forensic goroutine-to-syscall inspector for live Go processes.