EvoMaster
EvoMaster is a free, open-source tool that generates system-level tests by fuzzing web and enterprise applications.
What EvoMaster is
EvoMaster is a free, open-source tool that generates system-level tests by fuzzing web and enterprise applications. Its black-box mode works against APIs in any programming language, while white-box mode analyzes JVM application bytecode. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift, and generates JUnit 4 or 5 tests in Java or Kotlin, as well as test suites in Python or JavaScript. More than 30 oracles check for issues such as HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions, with support for PostgreSQL, MySQL, H2, and MongoDB. Authentication can use headers and cookies, including tokens obtained from a login endpoint. REST APIs need an OpenAPI schema; versions 2.0, 3.0, and 3.1 are supported, while 3.2 support is on hold. EvoMaster is free under LGPL v3, can run in GitHub Actions, and is distributed through PyPI, Docker, and an uber-fat JAR. The project says it has no telemetry and needs no internet services beyond the application being tested.
Good
- Targets REST, GraphQL, and RPC APIs.
- Generates tests in Java, Kotlin, Python, or JavaScript.
- Checks for issues using more than 30 oracles.
- Free and released under LGPL v3.
- Project says it has no telemetry.
Watch out
- White-box testing requires a manually written driver.
- Does not yet automatically mock external services.
- REST APIs require an OpenAPI schema.
- Windows MSI, macOS DMG, and Linux DEB installers are deprecated.
Who it suits
EvoMaster suits teams testing web or enterprise APIs that want generated tests across black-box or JVM bytecode-based white-box modes. It may also suit teams seeking API testing that can run through GitHub Actions.
Verdict
EvoMaster offers a free route to fuzzing-based system tests for several API types and test languages. Check its white-box driver requirement and REST schema needs against your setup before choosing it.
Plans and prices
From EvoMaster's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| EvoMaster | Free | Open source · no paid external services required · No monetary cost |
The facts
Each one read from EvoMaster's own pages, with the date it was checked.
What it does
- API coverage
- It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift.checked 8 Oct 2026
- Authentication
- It supports authentication headers and cookies, including dynamically obtaining tokens or cookies from a login endpoint.checked 8 Oct 2026
- Database support
- For white-box testing, it can analyze SQL and MongoDB interactions and supports PostgreSQL, MySQL, H2, and MongoDB.checked 8 Oct 2026
- Fault detection
- Its heuristics check for issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection, using more than 30 oracles.checked 8 Oct 2026
- Installation
- The recommended install method is PyPI; the project also provides an uber-fat JAR and Docker distribution.checked 8 Oct 2026
- Integrations
- It can run in GitHub Actions through a custom action and is distributed as a Docker image.checked 8 Oct 2026
- Known limitations
- White-box testing requires a manually written driver, and EvoMaster does not yet automatically mock external services.checked 8 Oct 2026
- License and funding
- The source code is released under LGPL v3 and the project reports funding from ERC and the Research Council of Norway.checked 8 Oct 2026
- Purpose
- EvoMaster automatically generates system-level tests through fuzzing for web and enterprise applications.checked 8 Oct 2026
- REST schema limits
- REST APIs need an OpenAPI schema; versions 2.0, 3.0, and 3.1 are supported, while 3.2 support is on hold.checked 8 Oct 2026
- Security and privacy
- The project says it has no telemetry and does not require internet services beyond the application being tested.checked 8 Oct 2026
- Support
- The project directs users to GitHub issues and discussions for documentation and usage questions.checked 8 Oct 2026
- Test generation
- It generates JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript.checked 8 Oct 2026
- Testing modes
- Black-box mode can run against APIs in any programming language, while white-box mode analyzes JVM application bytecode.checked 8 Oct 2026
The company
- Founded
- 2016checked 28 Sep 2026
Where it runs
- Platform installers
- Windows MSI, macOS DMG, and Linux DEB installers are listed as deprecated.checked 8 Oct 2026
Alternatives to EvoMaster
- 1
Jazzer
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 2
AFL++
Free planAndroidLinuxmacOSSelf-hosted7.2From €20,000 a year - 3
Mayhem
Free planWebAPILinuxmacOS7.0From $236 a month - 4
ClusterFuzz
Free planWebLinuxmacOSSelf-hosted6.8Free plan - 5
cargo-fuzz
Free planLinuxmacOSWindows6.7Free plan - 6
boofuzz
Free planAPILinuxSelf-hostedWindows6.4Free plan