OSS-Fuzz

Web

Visit site Alternatives

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

OSS-Fuzz is ranked #12 of 27 in fuzz testing software on Freedom251. It runs on Web. There is a free plan.

OSS-Fuzz plans and pricing

All plans

OSS-Fuzz Free The official site describes it as a free service. For open-source projects · acceptance requires a significant user base and/or criticality to global IT infrastructure google.github.io · 30 Sept 2026

Compared on fuzz testing software

Free plan: Yes
Input generation methods: mutation
Target types: source-code fuzz targets; untrusted user or network inputs; complex input formats
Coverage guidance: Yes
Crash triage: Yes
Execution mode: cloud
Supported languages: C/C++, Rust, Go, Python, Java/JVM, JavaScript, Lua
CI/CD support: Yes

Best OSS-Fuzz alternatives

See all 20

Two bars ClusterFuzz Free tier No. 1Free6.7 Two bars Accessibility Test Framework for Android Free tier No. 2Free6.6 Two bars AFL++ Free tier No. 3€1666.67/mo6.6 Two bars cargo-fuzz Free tier No. 4Free6.6 Two bars Mayhem Free tier No. 5$236/mo6.6 One bar boofuzz Free tier No. 6Free6.5

The record

Purpose: OSS-Fuzz runs fuzzers for open-source projects and privately alerts developers to bugs it detects.
Testing approach: It combines modern fuzzing techniques with scalable, distributed execution to improve open-source software security and stability.
Fuzzing engines: The documentation lists libFuzzer, AFL++, Honggfuzz and Centipede, with Centipede identified as experimental in the FAQ.
Sanitizers: OSS-Fuzz runs fuzzing engines in combination with sanitizers; AddressSanitizer and UndefinedBehaviorSanitizer are the default supported sanitizers described in the setup guide.
Languages: The site lists C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua as supported languages.
Architectures: OSS-Fuzz supports fuzzing x86_64 and i386 builds, with i386 not enabled by default.
Build setup: Projects provide a Dockerfile and build.sh script to define the build environment and produce fuzz targets.
Issue reporting: By default, issues are filed in the OSS-Fuzz tracker; projects can opt to mirror them on GitHub.
Access requirement: Project contacts need a Google account for full access to ClusterFuzz, including crash reports and fuzzer statistics.
Eligibility: A project seeking acceptance must be open source and have a significant user base and/or be critical to global IT infrastructure.
Build limit: The setup guide says OSS-Fuzz allows up to four builds per day and builds once per day by default.
Resource limit: The guide states that builders have 250 GB of disk space, including the operating system, and builds must stay below that peak usage.
Alternative deployment: Projects that do not qualify for OSS-Fuzz, including closed-source projects, can run their own ClusterFuzz or ClusterFuzzLite instances.
Maker history and location: Google says it was officially born in August 1998 and that its current headquarters, the Googleplex, is in Mountain View, California.
Price from: Free

Where it ranks on Freedom251

Best Fuzz Testing Software in 2026#12 of 27

Is OSS-Fuzz yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSS-Fuzz

Sources

google.github.io/oss-fuzz/· checked 30 Sept 2026
google.github.io/oss-fuzz/faq/· checked 30 Sept 2026
google.github.io/oss-fuzz/getting-started/new-project-gu· checked 30 Sept 2026
google.github.io/oss-fuzz/getting-started/accepting-new-· checked 30 Sept 2026
about.google/company-info/our-story/· checked 30 Sept 2026