- Home
- Phishing Simulation Software
- Gophish
Gophish
What it is
Gophish is an open-source framework for phishing simulations, intended for penetration testers and businesses assessing an organization’s exposure. Users can create or import email templates and edit them in a browser-based HTML editor. Campaigns send messages in the background and can be scheduled. Results arrive near real time, with recipient timelines showing email opens, link clicks, and submitted credentials; campaign data can also be exported for reports. Gophish offers a REST API and a Python client, and can run from a downloaded binary or the official Docker container. It supports API, Linux, macOS, self-hosted, and Windows deployments. The Community Edition repository includes an MIT License, subject to its terms. The free plan is listed as free. Attachment tracking is listed for docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins for setups where TLS ends at an upstream load balancer.
For and against
For
- Free plan listed as free
- Scheduled email campaigns run in the background
- Near-real-time results and recipient timelines
- Campaign results can be exported for reports
- Available for Linux, macOS, and Windows
Against
- Attachment tracking is listed for specified file types only
The verdict
Gophish combines campaign creation, recipient-level tracking, and reporting in a free open-source framework. Its listed attachment-tracking formats are limited to the specified file types.
Who it suits
Gophish suits penetration testers and businesses that want to conduct phishing simulations. Its API and Python client may also suit teams working with campaigns programmatically.
Plans and prices
Gophish
Open-source phishing framework
Read 8 Oct 2026 · getgophish.com
On the record
- API
- Gophish provides a REST API and a Python client.getgophish.com · read 8 Oct 2026
- Audience
- The user guide describes Gophish as a toolkit for pentesters and businesses conducting real-world phishing simulations.docs.getgophish.com · read 8 Oct 2026
- Campaigns
- Campaigns send phishing emails in the background and can be scheduled.getgophish.com · read 8 Oct 2026
- Deployment
- Gophish can be run from a downloaded binary or through the official Docker container.github.com · read 8 Oct 2026
- License
- The repository includes the MIT License for Gophish Community Edition, which permits use, copying, modification, distribution, and sale subject to the license terms.github.com · read 8 Oct 2026
- Notable limit
- The release notes list attachment tracking support for docx, docm, pptx, xlsx, xlsm, txt, html, and ics files.github.com · read 8 Oct 2026
- Purpose
- Gophish is an open-source framework for testing an organization's exposure to phishing.getgophish.com · read 8 Oct 2026
- Reporting
- Campaign results are delivered near real time and can be exported for reports.getgophish.com · read 8 Oct 2026
- Security feature
- Version 0.12.1 added configurable trusted origins to the CSRF handler for setups where TLS terminates at an upstream load balancer.github.com · read 8 Oct 2026
- Support
- The project asks users to file an issue for bugs, feature requests, or missing documentation.github.com · read 8 Oct 2026
- Templates
- Users can create or import phishing templates and customize them in a browser-based HTML editor.getgophish.com · read 8 Oct 2026
- Tracking
- The interface shows recipient timelines with email opens, link clicks, and submitted credentials.getgophish.com · read 8 Oct 2026
