- Home
- Security Awareness Training Software
- DarkPhish
DarkPhish
What it is
DarkPhish is a platform for authorized phishing simulations, security-awareness training, internal security testing, and defensive research. Users can prepare or import email templates, set approved recipients, schedule campaigns, monitor activity, review recipient timelines, and export results. The Community plan is free forever and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting, and the core REST API. DarkPhish is self-hosted by design, keeping users, campaigns, and security data under the customer's control. It lists API, Linux, self-hosted, and web platforms; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. The project lists SQLite, MySQL/MariaDB, and PostgreSQL support. Security measures described include encrypted and signed browser sessions, scoped and expiring API tokens, write-only SMTP, IMAP, and webhook secrets in ordinary API responses, and signed, hash-chained administrative audit events. Paid plans start at €249/mo (annual). Professional and Enterprise are in development, with planned capabilities including additional user and campaign capacity, integrations, reporting, and deployment options. DarkPhish states that it is for authorized testing and simulations only.
For and against
For
- Community is free forever.
- Core REST API is included in Community.
- Self-hosted design keeps campaign data under customer control.
- Supports three listed database options.
- Linux installer supports amd64 and arm64.
Against
- Community allows one active campaign.
- Professional and Enterprise plans are still in development.
- Paid plans start at €249/mo (annual).
The verdict
DarkPhish offers a free Community tier and a self-hosted workflow for authorized simulations. Its Community limit is one active campaign, while expanded plan capabilities remain in development.
Who it suits
DarkPhish suits organizations conducting authorized internal security simulations and awareness training. Its self-hosted design may appeal to teams that want control over campaign and security data.
Plans and prices
Community
Managed users up to 100 · 1 active campaign · simulation engine · basic reporting
Read 15 Oct 2026 · darkphish.sk
Enterprise
Unlimited managed users and campaigns · SSO and advanced RBAC · SIEM integrations · multi-organization
Read 15 Oct 2026 · darkphish.sk
Professional
250 managed users included · unlimited campaigns · human risk and training · Smart Groups
Read 15 Oct 2026 · darkphish.sk
On the record
- API credentials
- API access uses scoped, expiring personal access tokens instead of permanent legacy API keys.darkphish.sk · read 15 Oct 2026
- API maturity
- The changelog says the public API and schema remain pre-1.0 and follow Semantic Versioning.raw.githubusercontent.com · read 15 Oct 2026
- API rate limits
- Release 0.22.3 limits administrative API requests to 100 per minute per browser user or personal token.raw.githubusercontent.com · read 15 Oct 2026
- Audit cryptography
- Audit records use SHA-256 hash chaining, rotating Ed25519-signed checkpoints and verifiable JSON export manifests.raw.githubusercontent.com · read 15 Oct 2026
- Audit trail
- Administrative events are recorded in a tamper-evident audit trail.darkphish.sk · read 15 Oct 2026
- Authorized use
- DarkPhish states that it is for authorized security testing and simulations only.darkphish.sk · read 8 Oct 2026
- Browser security
- The site says browser sessions are encrypted and signed, with hardened cookie settings.darkphish.sk · read 8 Oct 2026
- Campaign delivery
- Campaigns can launch immediately or be scheduled for later delivery.darkphish.sk · read 15 Oct 2026
- Campaign monitoring
- The product shows campaign activity near real time, recipient timelines and exportable results.darkphish.sk · read 15 Oct 2026
- Campaign setup
- Users can create or import phishing templates, define approved recipients and edit campaign content in a browser.darkphish.sk · read 15 Oct 2026
- Campaign workflow
- Users can create or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines, and export results.darkphish.sk · read 8 Oct 2026
- Credential protection
- The changelog documents AES-256-GCM secret envelopes, scoped expiring revocable tokens and Argon2id password hashing.raw.githubusercontent.com · read 15 Oct 2026
- Database support
- The software supports SQLite, MySQL or MariaDB, and PostgreSQL.github.com · read 15 Oct 2026
- Default access
- The administration interface listens on localhost at HTTPS port 3333 by default, with SSH tunneling documented for remote access.github.com · read 15 Oct 2026
- Documentation
- The project links installation, deployment, native-update, development, architecture, security-policy and changelog documentation.github.com · read 15 Oct 2026
- Email templates
- The platform supports email-template creation and landing-page building.github.com · read 15 Oct 2026
- Enterprise plan
- Enterprise is in development; planned capabilities include unlimited managed users and campaigns, SSO, advanced RBAC, SIEM integrations, multi-organization support, SLA, and on-premises or air-gapped deployment.darkphish.sk · read 8 Oct 2026
- Installation
- The installer detects Linux distribution and CPU architecture, installs dependencies and creates a hardened systemd service.github.com · read 15 Oct 2026
