DarkPhish

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal testing, and defensive research. It is best suited to security teams that need campaign data and infrastructure under their own control. The free Community tier covers a focused program, while larger or more sophisticated operations will outgrow its one-campaign limit.

Overview

DarkPhish follows the full simulation workflow: administrators create or import email templates, define approved recipients, schedule campaigns, monitor activity, inspect recipient timelines, and export results. That makes it practical for running sanctioned exercises rather than merely building messages.

Self-hosting keeps users, campaigns, and security data under the customer’s control, but it also puts deployment and maintenance on the customer. DarkPhish is explicitly intended for authorized testing and simulations, so it is not the right choice for unrestricted phishing activity.

Key features

• Campaign operations: Scheduling, activity monitoring, recipient timelines, and exports provide a coherent start-to-finish process. Community’s basic reporting is enough for straightforward reviews, but not a substitute for the planned advanced analytics.
• Security safeguards: The service describes encrypted and signed browser sessions, hardened cookie settings, scoped and expiring personal access tokens, and write-only handling of SMTP, IMAP, and webhook secrets. These controls reduce exposure from long-lived credentials and routine API responses.
• Auditability: Administrative events are described as signed, hash-chained records, giving security administrators a stronger basis for reviewing changes than an ordinary undifferentiated log.
• Deployment flexibility: SQLite, MySQL/MariaDB, and PostgreSQL are supported. The installer handles fresh systemd-based Linux deployments on both amd64 and arm64, which suits organizations comfortable operating their own Linux service.
• API and access: The core REST API is included in Community, and SSO support is available. More extensive identity, role, and integration capabilities are reserved for the planned Enterprise tier.

Pricing

Community: €0 per free, billed €0 forever. It includes up to 100 managed users, one active campaign, the simulation engine, basic reporting, and the core REST API. This is a credible starting point for a small security-awareness team, but the single active campaign can constrain recurring or parallel exercises.

Professional: Paid plans start at €249/mo (annual). Professional is in development, with planned support for 250 managed users, unlimited campaigns, human-risk and training workflows, Smart Groups, Entra and Google support, and advanced reporting with AI. It is the intended step up for organizations that need more than Community’s user and campaign ceilings, though those capabilities are not yet presented as a finished package.

Enterprise: Enterprise is also in development and uses custom pricing. Planned features include unlimited managed users and campaigns, SSO, advanced RBAC, SIEM integrations, multi-organization support, an SLA, and on-premises or air-gapped deployment. Choose it only when those governance and deployment requirements justify an enterprise engagement.

Platforms

DarkPhish supports API, Linux, self-hosted, and web use. Linux installation targets systemd-based amd64 and arm64 systems, while the self-hosted model keeps operational control with the customer.

Who it's for

Choose DarkPhish for an authorized internal testing or awareness program that requires self-hosting, an API, and control over security data. Community fits smaller teams running one exercise at a time. Organizations needing concurrent campaigns, richer training workflows, or extensive identity and SIEM integration should wait for, or evaluate alongside, the paid roadmap.

Pros and cons

Pros

• Self-hosted control: Customer infrastructure holds users, campaigns, and security data.
• Complete core workflow: Templates, scheduling, monitoring, timelines, and exports cover practical simulation administration.
• Security-focused design: Expiring scoped tokens, protected secrets, signed sessions, and hash-chained audit events address common operational risks.
• Free entry tier: Community provides up to 100 users and the simulation engine at no cost.

Cons

• One active campaign on Community: Parallel exercises or frequent overlapping programs require a higher tier.
• Paid capabilities are still in development: Professional and Enterprise plans describe planned features rather than a fully established feature set.
• Self-hosting requires ownership: Deployment and ongoing infrastructure work remain with the customer.

Alternatives

Gophish is the stronger pick when a free, open-source phishing framework and broader self-hosted platform coverage across Linux, macOS, and Windows matter more than DarkPhish’s stated security controls.

Wizer suits teams seeking a freemium, web-and-mobile awareness service with a free trial, learner reminders, and basic annual training rather than a self-hosted simulation platform.

SentryMail is another freemium self-hosted and web option for readers comparing community-oriented deployments.

Cofense PhishMe is worth considering for a paid web service with a free tier and an enterprise offering.

Hoxhunt is aimed at organizations that prefer a custom-quoted, multi-platform service priced per employee.

Security Awareness Training Software provides a broader category comparison for teams that are not committed to self-hosting.

Verdict

DarkPhish is a strong fit for authorized security teams that want a self-hosted campaign workflow, API access, and customer-controlled data without paying for a basic deployment. Its main reason to look elsewhere is scale or immediacy: Community permits only one active campaign, while the richer Professional and Enterprise capabilities remain in development.