DarkPhish

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal testing and defensive research. It suits teams that want to manage campaigns and security data on their own infrastructure. Its free Community plan is useful for small, focused programs, but one active campaign and 100 managed users are firm ceilings.

Overview

DarkPhish covers the campaign cycle: create or import email templates, choose approved recipients, schedule a simulation, monitor activity, review recipient timelines and export results. Keeping users, campaigns and security data under customer control is a meaningful fit for organizations that want a self-hosted deployment rather than a hosted service.

The emphasis on authorized use is explicit: DarkPhish is for sanctioned security testing and simulations only. That makes it a poor fit for anyone seeking an unrestricted phishing toolkit.

Key features

• Campaign management: Scheduling, activity monitoring and recipient timelines give administrators ways to follow a campaign from launch through review. Exportable results and basic reporting support follow-up, though the Community plan does not promise advanced analytics.
• Security controls: DarkPhish says browser sessions are encrypted and signed, cookies are hardened, and API access relies on scoped, expiring personal access tokens rather than permanent legacy keys. SMTP, IMAP and webhook secrets are write-only in normal API responses. These controls are relevant to teams handling sensitive campaign credentials and data.
• Audit events: Administrative audit events are described as signed, hash-chained records, a useful integrity measure for reviewing administrative activity.
• Database choice: SQLite, MySQL/MariaDB and PostgreSQL support give self-hosters options across simpler and more established database setups.

Pricing

DarkPhish uses a freemium model. The Community plan costs €0 / forever and includes up to 100 managed users, one active campaign, the simulation engine, basic reporting and the core REST API. It is a practical starting point for a small team or a limited program, but the single-campaign cap makes it restrictive for concurrent exercises, while the user cap rules out larger deployments.

Paid plans are described as starting at €249/mo (annual). Professional is in development, with planned support for 250 managed users, unlimited campaigns, human-risk and training workflows, Smart Groups, Entra/Google support, and advanced reporting with AI. Enterprise is also in development; planned capabilities include unlimited users and campaigns, SSO, advanced RBAC, SIEM integrations, multi-organization support, an SLA, and on-premises or air-gapped deployment. These are not current substitutes for Community’s limits. Custom pricing applies where a plan has no published price.

Platforms

DarkPhish supports API, Linux, self-hosted and web use. Its installer supports fresh systemd-based Linux deployments on amd64 and arm64, giving Linux administrators a defined route to deployment. The project directs ordinary bug reports, questions and feature requests to GitHub Issues, while vulnerability reports go through a private reporting channel.

Who it's for

Choose DarkPhish if your organization can host and administer its own platform, needs authorized simulations, and can work within 100 managed users and one active campaign. It is less suitable if you need simultaneous campaigns, a larger user base, or Professional and Enterprise capabilities today; those tiers are still in development.

Pros and cons

• Pros: A free plan includes the simulation engine, core API and basic reporting, so small teams can run a defined program without a subscription.
• Pros: Self-hosting, multiple database options and stated session, credential and audit safeguards suit organizations prioritizing control over infrastructure and security data.
• Cons: Community is capped at 100 users and one active campaign, which limits scale and concurrent work.
• Cons: The more expansive Professional and Enterprise features are still in development, so teams needing those workflows or integrations should not plan around them as present capabilities.

Alternatives

For a broader category comparison, browse Security Awareness Training Software. Choose Wizer if you want web and mobile access plus a free plan with basic annual training, basic user management, limited reporting and automatic learner reminders. Gophish is a free, open-source phishing framework with Linux, macOS and Windows support, making it an alternative for teams seeking that framework across desktop platforms.

SentryMail is another freemium, self-hosted web option. Cofense PhishMe has a free plan as well as a paid enterprise plan. Hackiwi offers free options for individuals and families and for organizations up to 20 users. RansomLeak provides a free exercise library alongside a paid offering and free trial. Hoxhunt uses custom quotes per employee and supports mobile, desktop and web platforms. Infosec IQ is a paid alternative with web and mobile support and an Enterprise option that includes LMS integration and SCORM support.

Verdict

DarkPhish is a strong fit for teams that want to self-host authorized simulations and can stay within Community’s 100-user and one-campaign limits. Its free plan and stated security controls make it a credible starting point for a contained program. Look elsewhere if you need more users, concurrent campaigns or the larger tiers’ capabilities now; those plans remain in development.