Best Fuzz Testing Software in 2026
Updated
In short: ClusterFuzz is ranked #1 of 27 as of 5 October 2026, ahead of Accessibility Test Framework for Android and AFL++. The best-ranked option with a free plan is Accessibility Test Framework for Android. The lowest first paid tier on this page is Mayhem at $236/mo.
Fuzz testing software explores program behavior using generated or varied inputs, with the aim of surfacing faults. Compared on input generation methods, supported languages, and target types, these entries can be weighed against the software you need to test. Execution mode, coverage guidance, and crash triage offer further criteria for understanding each testing approach. CI/CD support may be relevant to your workflow, while free-plan availability and paid-from pricing add access and cost details. ClusterFuzz, Accessibility Test Framework for Android, and AFL++ are among the options shown, along with cargo-fuzz and Mayhem. Compare the listed capabilities with your testing needs.
27 fuzz testing software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
12 of the 25 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | ClusterFuzzWeb · Windows · Mac · Linux · Self-hosted | Three bars | — | 4 of 6 | Free | 6.7 | |
| 2 | Accessibility Test Framework for AndroidWindows · Mac · Linux · Android | Three bars | — | 4 of 6 | Free | 6.6 | |
| 3 | AFL++Windows · Mac · Linux · Android · Self-hosted | Three bars | — | 4 of 6 | €1666.67/mo | 6.6 | |
| 4 | cargo-fuzzWindows · Mac · Linux | Three bars | — | 3 of 6 | Free | 6.6 | |
| 5 | MayhemWeb · Windows · Mac · Linux · Self-hosted · API | Three bars | — | 4 of 6 | $236/mo | 6.6 | |
| 6 | boofuzzWindows · Linux · Self-hosted · API | Two bars | — | 2 of 6 | Free | 6.5 | |
| 7 | FuzzilliMac · Linux · Self-hosted | Two bars | — | 2 of 6 | Free | 6.5 | |
| 8 | JazzerWindows · Mac · Linux | Three bars | — | 3 of 6 | Free | 6.5 | |
| 9 | RoslynatorWindows · Mac · Linux · Extension | Three bars | — | 3 of 6 | Free | 6.5 | |
| 10 | SchemathesisWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 11 | CsmithWindows · Linux | Two bars | — | 2 of 6 | Free | 6.4 | |
| 12 | OSS-FuzzWeb | Two bars | — | 1 of 6 | Free | 6.4 | |
| 13 | Black Duck CoverityWeb · Windows · Mac · Linux · Self-hosted | Two bars | — | — | 4 of 6 | — | 5.6 |
| 14 | HonggfuzzWindows · Mac · Linux · Android | One bar | — | — | 4 of 6 | — | 5.5 |
| 15 | FuzzForgeWeb · Self-hosted | One bar | — | — | 1 of 6 | — | 5.4 |
| 16 | syzkallerWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.4 |
| 17 | NetzobWindows · Linux | No signal | — | — | 2 of 6 | — | 5.3 |
| 18 | Onyx LauncherWindows · Linux | One bar | — | — | 2 of 6 | — | 5.3 |
| 19 | Scout SuiteMac · Linux | No signal | — | — | 2 of 6 | — | 5.3 |
| 20 | WfuzzWindows · Mac | No signal | — | — | 2 of 6 | — | 5.3 |
| 21 | EvoMasterWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.2 |
| 22 | EvoMasterWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.2 |
| 23 | FuzzinatorMac · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 24 | FuzzwareLinux | No signal | — | — | 1 of 6 | — | 5.2 |
| 25 | MetalwareWeb | No signal | — | — | 1 of 6 | — | 5.2 |
Compare all 25 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Input generation methods | Target types |
|---|---|---|---|---|---|---|---|---|
| 1 | ClusterFuzz | 6.7 | Free plan | Free | — | — | mutation, generation, hybrid | binary formats, HTML, JavaScript, browser DOM, native programs |
| 2 | Accessibility Test Framework for Android | 6.6 | Free plan | Free | — | — | generation, mutation | operating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows |
| 3 | AFL++ | 6.6 | Free plan | €1666.67/mo | Yes | — | mutation | source-code targets, binary-only targets, file inputs, stdin inputs, Android native libraries, Win32 PE binaries |
| 4 | cargo-fuzz | 6.6 | Free plan | Free | — | — | mutation, generation, hybrid | raw byte buffers, structured Rust data, libraries, APIs, compiler code, allocator operations |
| 5 | Mayhem | 6.6 | Free plan | $236/mo | — | — | hybrid | Linux binaries; Windows PE binaries; TCP/UDP applications; REST APIs; gRPC APIs; containers; automotive vECUs |
| 6 | boofuzz | 6.5 | Free plan | Free | Yes | — | hybrid | network protocols, serial, Ethernet/IP, UDP broadcast, TCP, UDP, SSL, raw sockets |
| 7 | Fuzzilli | 6.5 | Free plan | Free | — | — | mutation, generation, hybrid | JavaScript programs and JavaScript engines/interpreters |
| 8 | Jazzer | 6.5 | Free plan | Free | Yes | — | mutation, generation | JVM applications, Java, Kotlin, Scala, Clojure, JNI/native libraries |
| 9 | Roslynator | 6.5 | Free plan | Free | — | — | — | — |
| 10 | Schemathesis | 6.5 | Free plan | Free | Yes | — | — | — |
| 11 | Csmith | 6.4 | Free plan | Free | Yes | — | generation | C programs; C++ programs; compilers |
| 12 | OSS-Fuzz | 6.4 | Free plan | Free | Yes | — | mutation | source-code fuzz targets; untrusted user or network inputs; complex input formats |
| 13 | Black Duck Coverity | 5.6 | No | — | No | — | — | — |
| 14 | Honggfuzz | 5.5 | No | — | — | — | mutation | file inputs, standard input, APIs, binaries, network servers |
| 15 | FuzzForge | 5.4 | No | — | Yes | — | generation | codebases, binaries, containers, APIs, GraphQL, protocols, firmware, embedded systems |
| 16 | syzkaller | 5.4 | No | — | — | — | generation, mutation | operating-system kernels and syscall interfaces: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows |
| 17 | Netzob | 5.3 | No | — | Yes | — | mutation, generation | network protocols, structured files, text protocols, delimiter-based protocols, fixed-field protocols, variable-length/TLV protocols, IPC, drivers and devices |
| 18 | Onyx Launcher | 5.3 | No | — | Yes | — | — | — |
| 19 | Scout Suite | 5.3 | No | — | Yes | — | mutation | Network protocols and services including TCP, UDP, SSL, IPP, LPD, BACnet, Modbus, DHCP, TFTP, Telnet CLI, Netconf, COPS, and raw requests |
| 20 | Wfuzz | 5.3 | No | — | Yes | — | generation | HTTP URLs, paths, files, query parameters, POST data, cookies, headers, HTTP verbs, authentication |
| 21 | EvoMaster | 5.2 | No | — | Yes | — | — | — |
| 22 | EvoMaster | 5.2 | No | — | Yes | — | — | — |
| 23 | Fuzzinator | 5.2 | No | — | — | — | generation, mutation | stdin, command-line, files, HTTP/browser |
| 24 | Fuzzware | 5.2 | No | — | — | — | mutation | ARM Cortex-M firmware; Infineon AURIX TriCore firmware; MMIO and interrupt-driven embedded systems |
| 25 | Metalware | 5.2 | No | — | — | — | generation and mutation, with symbolic input generation | ELF and raw .bin firmware; ARM Cortex-M, embedded peripherals, DMA, RTOS, and bare metal targets |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which fuzz testing software is ranked first on Freedom251?
ClusterFuzz is ranked #1 of 27 with a score of 6.7. Accessibility Test Framework for Android is second and AFL++ third.
How many of these have a free plan?
12 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Mayhem has the lowest first paid tier we found: $236/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation.