Open Source Android Security Apps
Sort By:
Security Apps for Android
View 870 business solutionsBrowse free open source Security apps and projects for Android below. Use the toggles on the left to filter open source Security apps by OS, license, language, programming language, and project status.
-
Go from Code to Production URL in SecondsSkip the Kubernetes configs. Cloud Run handles HTTPS, scaling, and infrastructure automatically. Two million requests free per month.
-
Endpoint Management with Remote Control Built InSave 50% on your first year when you switch from your existing RMM to Splashtop AEM. Automate patching, track inventory, and jump directly into 1-click unattended remote sessions without switching tools.
-
1
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases. -
2
X-osint
Open source OSINT tool for gathering data on emails, phones, and IPs
X-osint is an open source intelligence framework designed to collect and analyze publicly available information from multiple sources. It focuses on gathering useful and credible data about entities such as phone numbers, email addresses, and IP addresses using a range of automated OSINT techniques. It provides investigators and researchers with a centralized interface for running information-gathering tasks that would normally require multiple separate tools. X-osint can also perform domain-related reconnaissance activities such as subdomain enumeration, DNS lookups, and host discovery to help identify infrastructure associated with a target. In addition to network and domain intelligence, it includes features for extracting metadata from files or images and analyzing text content to uncover hidden details. X-osint is written primarily in Python and is designed to run in terminal environments, particularly on Linux systems and Termux setups. -
3
Lantern
Tool to access videos, messaging, and other popular apps
Can't access your favorite apps? Download Lantern to easily access videos, messaging, and other popular apps while at school or work. Lantern is an application that allows you to bypass firewalls to use your favorite applications and access your favorite websites. Lantern does not cooperate with any law enforcement in any country. Lantern encrypts all of your traffic to blocked sites and services to protect your data and privacy. Lantern passed multiple third party white box security audits to ensure security of our code. Lantern is easy to use, just download and install to start streaming, browsing and using apps, no configuration required. No installation, no registration, no registration, no configuration, just click and go! All you have to do is install it and hit the POWER button! Don't wait forever for your applications to load or the website to appear in your browser. Connect with Lantern and get there fast! -
4
Flipper Android App
Android Mobile app to rule all Flipper's family
Flipper Android App is the official Android-based companion application that provides full control and management capabilities for the Flipper Zero device through a modular and scalable mobile architecture. Built primarily in Kotlin, the app is structured into multiple components that separate core logic, communication layers, and feature modules, enabling maintainability and extensibility for future development. It establishes a communication bridge between Android devices and Flipper Zero, allowing users to interact with hardware features such as infrared remotes, RFID/NFC tools, and Sub-GHz radio functionalities directly from their smartphone. The app supports file browsing, data transfer, and device configuration, making it a comprehensive control center for managing the Flipper ecosystem. Its modular design allows developers to introduce new features independently without disrupting the overall application structure. -
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
5
OpenH264
Open Source H.264 Codec
Cisco has taken their H.264 implementation and open-sourced it under BSD license terms. Development and maintenance will be overseen by a board from the industry and the open-source community. Furthermore, we have provided a binary form suitable for inclusion in applications across a number of different operating systems and made this binary module available for download from the Internet. We will not pass on our MPEG-LA licensing costs for this module, and based on the current licensing environment, this will effectively make H.264 free for use on supported platforms. OpenH264 is a codec library which supports H.264 encoding and decoding. It is suitable for use in real-time applications such as WebRTC. Constrained Baseline Profile up to Level 5.2 (Max frame size is 36864 macro-blocks). Arbitrary resolution, not constrained to multiples of 16x16. Rate control with adaptive quantization, or constant quantization. -
6
SoftEther VPN
Cross-platform multi-protocol VPN software
An open-source free cross-platform multi-protocol VPN program, as an academic project from University of Tsukuba, under the Apache License 2.0. The API Suite allows you to easily develop your original SoftEther VPN Server management application to control the VPN Server (e.g. creating users, adding Virtual Hubs, disconnecting a specified VPN sessions) from JavaScript, TypeScript, C# or other languages. SoftEther VPN ("SoftEther" means "Software Ethernet") is one of the world's most powerful and easy-to-use multi-protocol VPN software. It runs on Windows, Linux, Mac, FreeBSD and Solaris. SoftEther VPN is an optimum alternative to OpenVPN and Microsoft's VPN servers. SoftEther VPN has a clone-function of OpenVPN Server. You can integrate from OpenVPN to SoftEther VPN smoothly. SoftEther VPN is faster than OpenVPN. SoftEther VPN also supports Microsoft SSTP VPN for Windows Vista / 7 / 8. No more need to pay expensive charges for Windows Server license for Remote-Access VPN function. -
7
Blokada Apps
Repo for Blokada apps
Blokada is the popular ad blocker and privacy app for Android and iOS. It's being supported and actively developed by the amazing open-source community. Our modern solution for mobile content blocking. Protect multiple devices from ads and tracking, and manage your preferences in one place. Enjoy zero battery drain, no noticeable slowdowns, and highly reliable adblocking. If you want to efficiently block ads, trackers, malware, save on your data plan, speed up your device and protect your privacy with just one application, then Blokada is for you. It is free, secure and open source. For ultimate privacy protection, upgrade to Blokada Plus and connect through our VPN. Available in both Blokada 6 and Blokada 5. We use WireGuard®, the most advanced VPN protocol, to encrypt your network activity and hide your IP address. -
8
IGHack
Hack Instagram From Termux With Help of Tor
IGHack is a Bash-based Termux security tool built around password-strength testing for Instagram accounts through automated guessing. It uses password lists to attempt authentication and includes both predefined and user-selected list modes. The project incorporates Tor to route network traffic during its testing workflow. It is designed to run on rooted and non-rooted Android devices through Termux. A menu-driven interface provides attack modes, project information, updates, and exit controls. Because the software performs credential-guessing attacks against online accounts, legitimate use should be limited to accounts the tester owns or has explicit authorization to assess. -
9
DAR - Disk ARchive
For full, incremental, compressed and encrypted backups or archives
DAR is a command-line backup and archiving tool that uses selective compression (not compressing already compressed files), strong encryption, may split an archive in different files of given size and provides on-fly hashing, supports differential backup with or without binary delta, ftp and sftp protocols to remote cloud storage Archive internal's catalog, allows very quick restoration even a single file from a huge, eventually sliced, compressed, encrypted archive eventually located on a remote cloud storage, by only reading/fetching the necessary data to perform the operation. Dar saves *all* UNIX inode types, takes care of hard links, sparse files as well as Extended Attributes (MacOS X file forks, Linux ACL, SELinux tags, user attributes) and some Filesystem Specific Attributes (Linux ext2/3/4, Mac OS X HFS+) more details at: http://dar.linux.free.fr/doc/Features.html -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
10
Mobile Verification Toolkit
Helps with conducting forensics of mobile devices
Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices. It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus project along with a technical forensic methodology and forensic evidence. MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance. Compare extracted records to a provided list of malicious indicators in STIX2 format. Generate JSON logs of extracted records, and separate JSON logs of all detected malicious traces. -
11
Mullvad VPN desktop and mobile app
The Mullvad VPN client app for desktop and mobile
In a society that is increasingly determined to weaken that right, a fast, reliable and easy-to-use VPN connection is a good first step towards achieving this. By connecting to the Internet with Mullvad, we ensure that traffic to and from your device is encrypted to the highest standards, even when using public Wi-Fi in a coffee shop or hotel. We do not keep activity logs or ask for personal information, and we even encourage anonymous payments using cash or any of the accepted cryptocurrencies. Your IP address will be replaced with one of ours, ensuring that device activity and location are not linked to your user. Using Mullvad is quick and easy - just download and install the app. Don't spend time on complicated setup and multi-step registration processes. We designed Mullvad to be easy to use. Privacy is essential in a well-functioning society, as it allows norms, ethics and laws to be safely debated and challenged. Without privacy, a free and open society cannot flourish or exist. -
12
Google Authenticator Android
Open source fork of the Google Authenticator Android app
Google Authenticator for Android is the open-source two-factor authentication app that generates time-based (TOTP) and counter-based (HOTP) one-time codes entirely on the device. It’s designed to be simple, offline, and standards-compliant, so any service that supports OATH OTP can interoperate with it. The app streamlines enrollment via QR codes or manual key entry, then displays rotating numeric codes with clear account labels to reduce mistakes during login. Because secrets are stored on the device and codes are computed locally, it works even without a data connection and avoids server-side dependencies. The UI focuses on clarity and safety cues—timers, account naming, and basic management—to make 2FA adoption accessible to non-experts. For developers, the project doubles as a reference implementation of OTP enrollment, storage, and code generation on Android. -
13
AdAway
Ad-blocking for your Android
Tired of seeing ads pop up on your Android device? You can take them all away with AdAway! AdAway is an open source ad blocker for Android that uses the hosts file and local vpn. It effectively keeps pesky ads at bay so you can continue using your Android device uninterrupted by constant ads. AdAway gives you the option to add custom sources of host files. It also lets you add custom rules for your whitelist, blocklist and rules for redirects, so your ad blocking is not just generic, but tailored specifically how you want it. AdAway is currently being used by dozens of Android users worldwide. -
14
InjuredAndroid
Vulnerable Android application that shows examples of vulnerabilities
A vulnerable Android application with ctf examples based on bug bounty findings, exploitation concepts, and pure creativity. -
15
OWASP MASTG
Manual for mobile app security testing and reverse engineering
OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data storage, cryptography, authentication, network communication, platform interactions, and reverse engineering. The guide aligns with the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Weakness Enumeration (MASWE), helping organizations evaluate applications against established security requirements. Security professionals can use its detailed testing techniques, tool recommendations, practical examples, and hands-on exercises. -
16
Ente
End-to-end encrypted cloud for photos, videos and 2FA secrets
Ente is a fully open-source, end‑to‑end encrypted cloud platform designed for securely storing and managing your photos, videos, and 2FA secrets — without needing to trust the service provider. It includes cross‑platform clients and a CLI for self‑hosting needs. Ente is a service that provides a fully open source, end-to-end encrypted platform for you to store your data in the cloud without needing to trust the service provider. On top of this platform, we have built two apps so far: Ente Photos (an alternative to Apple and Google Photos) and Ente Auth (a 2FA alternative to the deprecated Authy). This monorepo contains all our source code - the client apps (iOS / Android / F-Droid / Web / Linux / macOS / Windows) for both the products (and more planned future ones!), and the server that powers them. -
17
mhrv-rs
Rust port of @masterking32's MasterHttpRelayVPN
mhrv-rs is a Rust implementation of the MasterHttpRelayVPN project designed to bypass DPI-based internet censorship and access blocked websites through HTTP relay techniques. The software works by routing traffic through a user-deployed Google Apps Script relay, allowing requests to evade filtering systems while remaining lightweight and inexpensive to operate. The project emphasizes portability and efficiency by rewriting the original implementation in Rust, improving performance and cross-platform deployment possibilities. It supports desktop and Android environments while providing configurable relay behavior through JSON-based settings and deployment scripts. The architecture is intentionally simple, enabling users to self-host relay infrastructure without relying on centralized VPN services. Overall, MasterHttpRelayVPN-RUST serves as a lightweight censorship circumvention and privacy-focused networking tool. -
18
Cuckoo Sandbox
Cuckoo Sandbox is for automated analysis of malware
Cuckoo Sandbox uses components to monitor the behavior of malware in a Sandbox environment; isolated from the rest of the system. It offers automated analysis of any malicious file on Windows, Linux, macOS, and Android. -
19
VeneraNext
Cross-platform comic reader that supports local comics
VeneraNext is a free, open-source comic and manga reader developed with Flutter for mobile and desktop devices. It supports locally stored comics, WebDAV libraries, and user-configured online comic sources. Readers can import image folders, compressed comic archives, PDFs, and image-based EPUB files. Its extension system uses JavaScript to connect with compatible online comic services. Multiple reading modes include continuous scrolling, page-by-page navigation, and automatic transitions between chapters. Users can download chapters, organize favorites, and track ongoing series. WebDAV integration supports backups, remote library access, and synchronization of reading progress. Available for Android, Android TV, iOS, Windows, macOS, and Linux, VeneraNext offers extensive reading customization. -
20
Aster Mail
Cross-platform encrypted email client for Aster
Aster Mail is an open-source, privacy-focused email service with cross-platform desktop and web clients. It protects messages, subject lines, and attachments between Aster users through local end-to-end encryption. Its cryptographic system combines ML-KEM-768 and P-256 ECDH with X3DH and Double Ratchet protocols for post-quantum protection. Messages sent to external recipients can use OpenPGP encryption when their public keys are available. Users retain control of their encryption keys and can export them to compatible applications. Optional key publishing enables encrypted communication with external contacts. Its zero-access architecture prevents the service from reading protected message contents. Accounts can be created without providing a phone number or recovery email. -
21
Hypatia
A realtime malware scanner
Hypatia is a free and open-source malware scanner for Android that aims to provide on-device, real-time scanning with minimal battery and resource impact using signature-based detection inspired by ClamAV style databases. Designed as an Android app, it scans user filesystems and installed applications either on demand or in real time when files are written or renamed, operating completely offline aside from occasional signature database downloads. The project is offered under an AGPL-3.0 license and is archived in its original repository, reflecting a historical effort to create a community-reviewable FOSS security tool for Android devices. Hypatia’s design targets performance and efficiency, keeping memory usage modest and enabling users to control which signature sets are active. Its real-time file observation uses multi-threaded scanning to leverage device CPU resources while striving for a negligible user experience impact. -
22
Tamper Dev
Extension that allows you to intercept and edit HTTP/HTTPS requests
If you are a developer, you can use Tamper Dev to debug your websites, or if you are a pentester, you can use it to search for security vulnerabilities by inspecting the HTTP traffic from your browser. Unlike most other extensions, Tamper Dev allows you to intercept, inspect and modify the requests before they are sent to the server. This extension provides functionality similar to Burp Proxy, MITM Proxy, OWASP ZAP, Tamper Data, and Postman Proxy, but without the need of additional software, with full support of HTTPS connections, and trivial to set-up (just install). -
23
Polarity Browser
A fast, secure, stable web browser powered by Chromium and Trident.
Polarity is a dual engine browser powered by both Chromium and Trident that focuses on system efficiency by bringing low RAM and low CPU usage. This browser was also programmed to be optimized for Windows with an Android version available. Browse the web with an uncomplicated UI that is highly customizable with themes, apps, and extensions from the Polarity Store, GreasyFork, OpenUserJS, and UserStyles. Polarity also comes with a built in password manager which safely encrypts all data to prevent theft. Polarity also comes with a built in adblocker and privacy tools such as proxy/VPN support and header masking to prevent further tracking online. If you appreciate all the hard work that we put into creating and developing Polarity, please consider giving a small donation at: https://polaritybrowser.netlify.com/donate -
24
Block This
Free DNS based Ad Blocker for Android
Block This 3.1 is a free and open source ad blocker for Android that works in all apps and browsers! It provides the additional benefits of malware protection, increased browsing speed and reduction of mobile data traffic. Block all in-app and browser advertisements, including video and audio ads, popup ads, banners, tracking cookies. Block This takes care about your security with its antivirus features! We've included a large list of common malware distributors to keep you safe from viruses. According to our average estimates, by blocking all of the ads on your Android phone, you can save up to 35% of your data plan. Bypass your internet provider censorship and access parts of the web that were previously inaccessible for you. Block This is also Open source, which means that anyone can look at, read and suggest improvements to the code base. If you are a developer you can contribute by creating a pull request to our GitHub repository. -
25
Mrphish
All In One Social Accounts Phishing With Otp Bypass In Termux
Mrphish is a Bash-based phishing toolkit for Termux that packages many imitation login pages into one interface. The repository advertises more than 60 templates across several service categories and is intended to collect account information entered into those pages. It also claims support for workflows involving one-time passwords and remote exposure of phishing pages through a tunneling option. Saved capture data can be revisited through a dumps function, while the toolkit includes update and project-information commands. The project is designed for Android environments running Termux and emphasizes ease of use for beginners. Because its central capability is credential harvesting, it should be treated as a controlled security-awareness or research artifact and never used against accounts or users without explicit permission.
