17 Best Phishing Simulation Tools (2026): Free & Paid

Phishing tools help you expose the human weak points in your defenses before real phishing attacks exploit them. But "best phishing tools" means very different things to different people: an open-source phishing simulation tool for an internal test, a red-team tool for an authorized penetration test, or a full awareness platform that bundles simulation and training for an entire workforce. Those three goals demand completely different tools, and that distinction is exactly what most listicles miss.

This guide sorts the 17 best-known phishing tools into clear categories, verifies the current maintenance status of each one directly against the GitHub API (several once-popular tools are now archived, renamed or no longer maintained), provides a comparison table, and goes deeper than the usual market roundup on the question that matters most in practice: how to choose between do-it-yourself open-source tools and managed platforms, including a note on data residency for EU customers of international vendors.

One distinction up front: a phishing simulation tool is not an analysis tool. Products like PhishTool investigate real, employee-reported phishing emails inside a Security Operations Center (SOC) and belong to incident response, not awareness training. And reverse-proxy tools such as Evilginx2 or Modlishka are sharp red-team weapons that capture real credentials and sessions, not training toys. Confusing these categories leads to both legal and operational trouble.

The three categories of phishing tools

Instead of a flat ranking, we group the tools by what they are actually for. Almost every serious comparison follows this pattern, because the category is what tells you whether a tool fits your plan. It also settles the free-versus-paid question quickly: the first two categories are free and open source but demand self-hosting, while the third is paid and managed but removes almost all of the operational work.

• Open-source frameworks for awareness and red teams. Self-hosted tools like Gophish or the Social-Engineer Toolkit (SET). Free and fully controllable, but you own the hosting, hardening and template upkeep. Ideal for technical teams, pentesters and lab environments.
• Reverse-proxy and MitM tools with session hijacking. Evilginx2 and Modlishka insert themselves as a man-in-the-middle between the victim and the real target site, capturing the authenticated session after a successful login. These are pure red-team tools for authorized engagements only.
• SaaS awareness platforms for organizations. Managed services such as KnowBe4, Proofpoint, Hoxhunt, SoSafe or Hornetsecurity. They bundle delivery, templates, training content, reporting and integrations. Higher cost, but very little operational overhead and board-ready reports.

There is also a fourth, often-overlooked class: analysis and triage tools for the SOC (for example PhishTool). These do not send simulations; they dissect real reported phishing emails. They complement an awareness program but do not replace it.

Categories side by side

The platform pricing figures are a rough industry estimate, not a fixed quote: expect roughly 2 to 9 EUR per user per month depending on vendor and volume, and verify the current price with the vendor. Individual vendors start lower or higher. Always check pricing transparency before booking a demo, as many vendors only disclose prices on request.

The 17 phishing tools in detail

For every tool we checked the current state directly through the GitHub API (as of July 2026). This matters, because several tools celebrated in older lists are now archived, renamed or unmaintained. An archived tool may still run, but it no longer receives security patches.

Status of all 17 tools at a glance

Open-source frameworks for awareness and red teams

Gophish (active, the de facto standard). By far the most widely recommended open-source phishing simulation framework. Web UI, customizable templates, landing pages, campaign scheduling, a JSON API and real-time results. The project is not archived, but activity has clearly slowed: the last official version tag (v0.12.1) is from September 2022 and there has been no substantial push since 2024, so treat it as stable-but-stalling rather than actively developed. Great for small to medium test runs, often too operationally heavy for a continuous enterprise program. Link: github.com/gophish/gophish.

The fastest reproducible setup for a first test is via Docker:

docker run -d --name gophish -p 3333:3333 -p 8080:8080 gophish/gophish

Since v0.12.1, Gophish generates a random admin password on first launch and prints it to the log (it used to ship a hardcoded default). To keep your test emails out of spam, set SPF, DKIM and DMARC correctly for the sending domain.

Social-Engineer Toolkit (SET) (active). The Python-based reference tool for social engineering attacks, maintained by TrustedSec and a fixture in Kali Linux. It covers spear phishing, website attack vectors and mass mailing. Command-line only and expert-level, but still very actively developed. Link: github.com/trustedsec/social-engineer-toolkit.

Simple Phishing Toolkit (SPT) (archived). Historically an early, beginner-friendly campaign editor. The repository has been officially archived since 2018 and receives no further development. Relevant only for historical interest, unsuitable for new projects. Link: github.com/chris-short/sptoolkit.

King Phisher (no longer maintained). Long a popular framework with real-time metrics and its own email and web server. The project moved to CrimsonForge-io/king-phisher (the old rsmusllp/king-phisher link is dead), and the README still carries the note "King Phisher is no longer being maintained." The last official release dates from 2019, followed only by sporadic community commits with no new features or security releases. Current link: github.com/CrimsonForge-io/king-phisher.

Phishing Frenzy (effectively inactive). A Ruby-based framework for managing campaigns with a template editor and metrics. Not officially archived, but without meaningful activity since late 2023 and not beginner-friendly. Link: github.com/pentestgeek/phishing-frenzy.

BlackPhish (renamed and archived). A lightweight toolkit with ready-made templates. The repository moved from iinc0gnit0 to yangr0/BlackPhish and is additionally marked as archived (no push since September 2024). The path linked in older articles leads nowhere. Current link: github.com/yangr0/BlackPhish.

Reverse-proxy and MitM tools with session hijacking

Evilginx2 (very active). A standalone man-in-the-middle framework and one of the most actively developed tools on this list. The technically correct description matters here: Evilginx2 does not "bypass" two-factor authentication in the strict sense. It relays all traffic between the victim and the real target site in real time, capturing both the entered credentials and, crucially, the session cookies set after a successful login (including 2FA). The attacker therefore takes over the already-authenticated session rather than defeating the 2FA check itself. That is session hijacking after authentication. Link: github.com/kgretzky/evilginx2.

Evilginx2 is configured through so-called phishlets, YAML files that turn a legitimate site into a reverse-proxy endpoint. The credentials section defines which POST parameters are captured as credentials:

credentials:
  username:
    key: 'email'
    search: '(.*)'
    type: 'post'
  password:
    key: 'password'
    search: '(.*)'
    type: 'post'
  custom:
    - key: 'token'
      search: '(.*)'
      type: 'post'

Older tutorials using landing_path are outdated; the current format uses a dedicated login section. There is also a commercial Evilginx Pro with an extended phishlet format, while the community version remains open source. A tool like this belongs strictly in authorized red-team engagements with written scope, never in a routine announced awareness campaign.

Modlishka (active). Another reverse-proxy tool that intercepts traffic between the user and the target site to capture credentials and session tokens. The principle is similar to Evilginx2. Contrary to occasional claims that it was discontinued, the project is still active (last activity mid-2026). Modlishka, too, is a pure red-team tool. Link: github.com/drk1wi/Modlishka.

Credential harvesting and social-media cloning tools

Blackeye (active). A widely used toolkit with numerous ready-made phishing pages for popular services and easy setup. The fork is still maintained. Better suited to demos and lab environments than to structured enterprise campaigns. Link: github.com/EricksonAtHome/blackeye.

Zphisher (very popular, but inactive). With the highest star count of all 17 tools, the most popular project on this list, beginner-friendly with around 30 ready templates. Despite a "Maintained: Yes" badge, there has been no new commit since August 2024, so its maintenance state is questionable. Link: github.com/htr-tech/zphisher.

SocialFish (active). A phishing tool aimed at social media platforms, with customizable templates and real-time tracking. It still receives ongoing updates (including dependencies). Link: github.com/UndeadSec/SocialFish.

HiddenEye (largely inactive). A versatile tool with keyloggers, tunneling and geolocation tracking that now only lives on as HiddenEye_Legacy and has had no push since early 2024. Not recommended for new projects. Link: github.com/Morsmalleo/HiddenEye_Legacy.

Specialist and niche tools

Wifiphisher (active, release outdated). Not an email tool but a utility for automated Wi-Fi attacks: it spins up rogue access points to capture credentials or establish man-in-the-middle positions. The repository is active, though the last formal release (v1.4) dates from 2018. Link: github.com/wifiphisher/wifiphisher.

SpearPhisher (frozen). A GUI utility for crafting individual spear-phishing emails. No activity since 2017 and therefore outdated. Link: github.com/kevthehermit/SpearPhisher.

SeeYou / I-See-You (frozen). A tool for geolocating targets via crafted links. Frozen since 2019 and only of historical interest. Link: github.com/Viralmaniar/I-See-You.

SayCheese (last activity 2024). Captures camera snapshots from users who open a phishing page, primarily aimed at mobile devices. Last activity mid-2024. Link: github.com/hangetzzu/saycheese.

QR Code Jacking / QRLJacking (moderately active). An OWASP project focused on session hijacking via fake QR login codes. QR phishing (also called "quishing") is highly relevant in 2026. For training purposes, it is worth looking at modern alternatives: Microsoft Attack Simulation Training, for example, offers dedicated QR phishing modules and learning paths. Link: github.com/OWASP/QRLJacking.

SaaS phishing simulation platforms as an alternative

For a lasting workforce-wide awareness program, open-source tools are often the wrong approach. Managed platforms take over delivery, deliverability, template upkeep, training content and reporting. Relevant vendors from current market roundups:

• KnowBe4 and Proofpoint Security Awareness Training: large, established US vendors with huge template libraries.
• Hoxhunt and Phished: heavily focused on adaptive, AI-driven personalization.
• SoSafe (EU focus) and Hornetsecurity (EU hosting): attractive for European buyers thanks to data residency and Microsoft 365 integration; in our source sample Hornetsecurity starts at roughly 2 EUR per user/month and SoSafe at around 9 EUR.
• Microsoft Attack Simulation Training: included in Microsoft 365 E5 or Defender for Office 365 Plan 2, deeply integrated into the ecosystem, with QR phishing payloads and a Predicted Compromise Rate feature to calibrate difficulty. Note: contrary to some guides, there are currently no PowerShell cmdlets for it.
• Sophos Phish Threat: for existing Sophos customers, included in certain Sophos email licenses since late 2025 (according to Sophos).

A newer trend is AI-native vendors (such as Adaptive Security) that use deepfake audio and video plus generative content for multimodal simulations beyond classic email. Treat all pricing figures as indicative and verify them with the vendor.

How to choose between DIY open-source tools and managed platforms

This is the decision that trips up most teams, so it deserves more than a one-line verdict. At its core, the choice is between building and operating your own system versus subscribing to a managed service. Open source minimizes licensing cost but maximizes internal effort; SaaS shifts the operational load to the vendor in exchange for a fee.

What DIY open source gives you: no licensing cost, full code transparency (you can inspect exactly how data is processed), full control over hosting and therefore over data residency, and a strong learning effect for the security team. What it costs you: you must handle deployment, hardening, deliverability (SPF/DKIM/DMARC) and template upkeep yourself; support is limited; and enterprise features such as SSO, multi-language content, automated reporting, native identity-provider integration and simulated vishing are missing. Just as important, and confirmed by our status check, bug fixes and long-term maintenance are not guaranteed for open-source projects. Several tools on this very list are archived or unmaintained.

What managed platforms give you: professional multi-channel support, managed infrastructure (the vendor handles email delivery and hosting), ready-to-use and regularly updated content, faster deployment, and features built for scale and continuous programs. What they cost you: recurring license fees and less low-level control over the system.

As a rule of thumb:

• Choose open source if you have strong in-house technical skills, need deep customization (typical for pentesters and red teams), run occasional tests rather than a continuous program, or specifically want full control over where data lives.
• Choose a managed platform if you prioritize outcomes over technical control, need reliable delivery at scale, want board-ready compliance reporting, or lack the internal capacity to maintain content and infrastructure.

In short: for a one-off technical test or a red-team engagement, Gophish, SET or Evilginx2 are the right call; for a continuous, organization-wide awareness program, most teams are better served by a managed platform.

A note on data residency for EU customers

If your organization is in the EU or handles EU personal data, where a vendor stores and processes data is not a footnote, it is a selection criterion. Many of the largest awareness platforms (for example KnowBe4 and Proofpoint) are US-based, which means international data transfers must be assessed and typically require additional safeguards such as standard contractual clauses and a transfer impact assessment. Vendors with EU hosting (such as SoSafe or Hornetsecurity), Microsoft Attack Simulation Training stored in an EU region, or a self-hosted open-source tool on your own EU infrastructure all simplify that question considerably. Under the GDPR the employer is usually the data controller and the platform vendor a processor, so a data processing agreement is required either way. For many organizations the NIS2 directive adds a further layer, since it makes documented awareness training part of mandatory cyber risk management. If you operate in Germany specifically, additional labor-law rules apply (works council co-determination and a works agreement), which we cover in detail in the German edition of this guide.

Rollout plan: an awareness program over twelve months

A single test achieves little. Awareness only works as a continuous program. A four-phase model over twelve months has proven effective, described in comparable form by independent industry sources.

1. Baseline (months 1 to 2). A medium-difficulty campaign to all employees to establish the baseline click rate. In higher-risk sectors this often sits at 20 to 35 percent without prior training. Prerequisite: any required governance (in some jurisdictions a works agreement) is in place.
2. Training (months 3 to 4). Just-in-time learning modules right after a click (a short video, a small quiz), without public shaming. Our guide to defending against phishing emails covers the concrete red flags worth teaching here. Goal: measurably lower the click rate.
3. Deepening (months 5 to 8). Differentiate scenarios by job function and raise the difficulty. Goal: click rate per group below 15 percent.
4. Advanced scenarios (months 9 to 12). Demanding vectors such as AI spear phishing, QR phishing and passkey-related fraud. Goal: click rate below 10 percent and a report rate above 30 percent.

Do not measure the click rate alone. Track at least four metrics: click rate, credential-submission rate, report rate and training completion rate. The report rate is especially important, because a team that recognizes and reports phishing is more valuable than one that merely clicks less often. Recommended cadence: four to six simulations per year, roughly every six to eight weeks.

Common mistakes: starting without the required governance in place, sharing individual results with managers (which fuels a blame culture and, in some jurisdictions, breaks the law), broken email authentication (simulations land in spam), or security filters blocking the simulation links (allow-list the simulation infrastructure at the filter).

Frequently asked questions

What is the difference between a simulation tool and an analysis tool like PhishTool?

A simulation tool sends controlled test phishing emails to measure and train awareness. An analysis tool like PhishTool investigates real, employee-reported phishing emails inside the SOC and supports incident response. The two complement each other but are not interchangeable.

What are the best free phishing simulation tools?

The strongest free options are open-source frameworks: Gophish and the Social-Engineer Toolkit (SET) lead the field. They cost nothing but require self-hosting, hardening and correct email authentication (SPF, DKIM, DMARC) to reach the inbox. Check the maintenance status before you commit, as several once-popular free tools on this list are now archived or stalled.

Is open source or a paid platform better?

It depends on the goal. For a one-off technical test or a red-team engagement, free open-source tools like Gophish or SET are enough. For a lasting workforce-wide awareness program, a managed platform is usually more economical because deliverability, content, reporting and support are included.

Do Evilginx2 and Modlishka really bypass two-factor authentication?

Not in the strict sense. They do not defeat the 2FA check itself; they capture the valid session cookie after a normal login (including 2FA) and take over the already-authenticated session. Technically, that is session hijacking. Phishing-resistant multi-factor authentication methods such as FIDO2/passkeys defend against it.

Which tools on this list are still safe to use in 2026?

Actively maintained options include Gophish (though its releases have stalled), the Social-Engineer Toolkit, Evilginx2, Modlishka, Blackeye, SocialFish and Wifiphisher. Several others are archived or unmaintained (SPT, King Phisher, BlackPhish, SpearPhisher, SeeYou) and should be avoided for new work, since they receive no security patches.

What metrics should I measure?

At minimum the click rate, credential-submission rate, report rate and training completion rate. The report rate (the share of employees who actively report a suspicious email) is the most telling leading indicator of a healthy security culture.

How often should I run simulations?

Roughly four to six times per year, or every six to eight weeks, with gradually increasing difficulty. Continuous, spaced repetition outperforms a single annual test by a wide margin.

Conclusion

There is no universal "best" phishing tool, only the right one for your goal. Open-source frameworks like Gophish and SET are strong for technical tests and red-team work, while reverse-proxy tools like Evilginx2 and Modlishka are sharp session-hijacking utilities meant strictly for authorized engagements. For a lasting, organization-wide awareness program, a managed platform is usually the better fit.

Two things set this guide apart from the usual lists: an honest maintenance status (several popular tools are archived or unmaintained, so always verify links and activity yourself) and a practical framework for choosing between DIY and managed, including data residency for EU buyers. Pick the category that matches your goal, verify the tool is still maintained, and structure a program over twelve months rather than running a single test.