FACT
FACT is free, open-source software for automated firmware security analysis.
What FACT is
FACT is free, open-source software for automated firmware security analysis. It targets firmware from routers, IoT equipment, UEFI systems, webcams, and drones. FACT identifies container formats, unpacks nested layers, and analyzes software, versions, boot services, known CVEs, hard-coded credentials, cryptographic material, CPU architecture, and possible implementation flaws. Firmware images can be compared to find changed or equal files and software versions. A searchable database stores firmware and results, including byte-pattern searches in unpacked files. The browser interface displays components and analysis results, while a REST API covers almost all features. Extractors, analysis functions, and comparisons are plugin-based, with additional plugins installable locally. FACT is self-hosted Linux software, with stable installer listings for Debian 13 and Ubuntu 22.04, 24.04, and 26.04; Kali support is experimental. Minimum requirements are four CPU cores, 8 GB RAM, and 10 GB disk.
Good
- Automates firmware extraction and layered unpacking
- Identifies CVEs, credentials, keys, and architecture
- Compares firmware files and software versions
- Searchable results database with byte-pattern search
- REST API and plugin extensibility
Watch out
- Requires a self-hosted Linux installation
- Kali support is experimental
- Web interface is not hardened for public use
- Described as a research prototype
Who it suits
It suits security teams and researchers analyzing firmware on self-hosted Linux systems. Users should be prepared to manage storage for extracted files and results.
Verdict
FACT provides broad, plugin-based firmware analysis with browser and API access at no software cost. Its Linux deployment, security cautions, and prototype status require careful operational planning.
Plans and prices
From FACT's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| FACT | Free | GPL-3.0 software · self-hosted installation · requires Linux |
The facts
Each one read from FACT's own pages, with the date it was checked.
What it does
- Analysis
- It identifies software, versions, boot services, known CVEs, hard-coded credentials, cryptographic material, CPU architecture, and potential implementation flaws.checked 8 Oct 2026
- Authentication
- FACT offers optional basic authentication, roles, and user management.checked 8 Oct 2026
- Comparison
- FACT can identify changed or equal files and changed software versions between firmware images.checked 8 Oct 2026
- Extensibility
- Extractors, analysis features, and comparison functions are implemented as plugins, and additional plugins can be added to a local installation.checked 8 Oct 2026
- Firmware extraction
- FACT automates identifying firmware container formats and unpacking firmware layers.checked 8 Oct 2026
- Integration
- FACT provides a REST API covering almost all of its features.checked 8 Oct 2026
- Interface
- The product provides a browser-based interface for browsing firmware components and navigating analysis results.checked 8 Oct 2026
- License
- FACT is free software under GPL version 3 or, at the user's option, any later version; some plugins may use different licenses.checked 8 Oct 2026
- Limitations
- The repository describes FACT as a research prototype, and says its Dockerized version is currently unmaintained.checked 8 Oct 2026
- Purpose
- FACT automates firmware security analysis for devices such as routers, IoT equipment, UEFI systems, webcams, and drones.checked 8 Oct 2026
- Requirements
- The documented minimum system requirements are 4 CPU cores, 8 GB RAM, and 10 GB disk space, with additional disk space needed for extracted files and analysis results.checked 8 Oct 2026
- Search
- FACT stores firmware files and analysis results in a searchable database that supports searching byte patterns in unpacked files.checked 8 Oct 2026
- Security
- The maintainers caution that FACT is not intended as a public internet service and that its web interface is not hardened; they recommend resetting passwords before use on networks that are not fully trusted.checked 8 Oct 2026
- Supported systems
- The installer lists Debian 13 and Ubuntu 22.04, 24.04, and 26.04 as stable, with Kali support marked experimental.checked 8 Oct 2026
The company
- Maker and funding
- FACT is developed by Fraunhofer FKIE and the FACT community, with partial funding from Germany's Federal Office for Information Security and others.checked 8 Oct 2026
Alternatives to FACT
- 1
Binary Ninja
Free planWebAPILinuxmacOS7.8$199 one-time - 2
Frida
Free planOpen sourceAndroidiOSAPILinux7.7Free plan - 3
rev.ng
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
JEB
Free planAPILinuxmacOSSelf-hosted7.6From $1,200 a year - 5
Ghidra
Free planOpen sourceAPIExtensionLinuxmacOS7.3Free plan - 6
IDA Pro
Free planLinuxmacOSWindows7.0From $1,099 a year