Gophish

Gophish is an open-source framework for organizations that want to run and measure their own phishing simulations. It suits pentesters and business security teams prepared to manage a deployment, and its combination of campaign scheduling, recipient timelines and API access comes without a software charge.

Overview

Gophish puts simulation setup, email delivery and results in one toolkit. Teams can shape their own exercises and see how recipients respond, rather than rely on a packaged training program. That control is its central advantage; the trade-off is that the organization must run the framework itself, whether from a downloaded binary or the official Docker container.

The Community Edition is covered by the MIT License, which permits use, copying, modification, distribution and sale subject to its terms. The project directs users to file issues for bugs, feature requests and missing documentation, so support is centered on project issues rather than a stated service channel.

Key features

Templates and campaign delivery

Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send email in the background and can be scheduled, giving teams a way to organize repeatable exercises around their own scenarios. This flexibility favors people comfortable building simulations; it is less suited to buyers seeking a ready-made training program.

Recipient tracking and reporting

Recipient timelines show email opens, link clicks and submitted credentials. Campaign results arrive near real time and can be exported for reports, making the framework useful for reviewing individual responses as well as summarizing an exercise. Attachment tracking is narrower: the supported formats are docx, docm, pptx, xlsx, xlsm, txt, html and ics. Teams whose simulations depend on other attachment formats should look elsewhere.

API and deployment

A REST API and Python client give teams options for connecting Gophish to their own workflows. Deployment can start from a downloaded binary or the official Docker container. Version 0.12.1 added configurable trusted origins to the CSRF handler for deployments where TLS terminates at an upstream load balancer, a targeted option for that hosting arrangement.

Pricing

Gophish costs nothing, billed for free. The Gophish plan is an open-source phishing framework, with phishing simulations included. There is no separate paid plan or stated seat or campaign quota in this offer; the practical cost is operating the deployment and building the exercises yourself.

Platforms

Gophish supports API use and is available for Linux, macOS and Windows, with self-hosted deployment. The binary and Docker options give teams deployment choices, while the self-hosted model means it is not a managed service.

Who it's for

Gophish is a strong fit for pentesters and business teams conducting real-world phishing simulations who want control over templates, scheduling and recipient-level results without a software fee. Its API and Python client also suit teams that want to integrate campaign work into their own processes. Organizations that need managed support, a packaged awareness-training experience or attachment tracking outside the supported formats should consider another approach.

Pros and cons

• Free, open-source framework: the Community Edition's MIT License permits use and modification, with distribution and sale allowed subject to its terms.
• Useful campaign visibility: near-real-time reporting and recipient timelines expose opens, clicks and credential submissions, with export for reports.
• Flexible operations: scheduled background campaigns, editable templates, API access and binary or Docker deployment support teams building their own exercises.
• Self-management required: teams must operate the deployment and shape the simulations rather than receive a managed training service.
• Attachment tracking has defined format coverage: teams relying on other file types may not be able to track the scenarios they need.
• Issue-based project support: users are directed to file project issues, which may not suit organizations needing a service support channel.

Alternatives

CanIPhish is worth comparing for teams seeking a freemium alternative: its free plan covers up to 10 employees, while its Professional plan is priced at $0, billed monthly, for a minimum of 11 employees. SMARTFENSE Simulation Tools is another paid option for readers looking for simulation tools across a broader set of platforms, including mobile and web.

Hoxhunt is a paid option with custom quotes based on employee count and required capabilities. Trellix Data Loss Prevention is the better direction when the need is enterprise data protection across endpoints, email, web, networks and storage, with on-premises or SaaS management. Infosec IQ may suit buyers seeking an enterprise offering with LMS integration and SCORM support.

Shirudo is another paid alternative. Check Point MDR/MPR is aimed at readers comparing paid managed detection and response options. Keepnet Phishing Simulator is worth considering for organizations that want a standalone simulator with pricing based on employee count and selected products, including one-time PAYG simulations for consulting companies.

For broader category comparisons, see Phishing Simulation Software and Security Awareness Training Software.

Verdict

Choose Gophish if your team wants a free, self-hosted framework to design phishing exercises and track recipient actions with API access. Its strongest case is control without a software fee; look elsewhere if you need managed support or attachment tracking beyond its supported formats.