Gophish

Gophish is a free, open-source framework for running phishing simulations, aimed at pentesters and businesses conducting exercises themselves. It brings campaign scheduling, recipient-level activity timelines and report exports into one toolkit, but requires an organization to manage its own deployment.

Overview

Gophish covers the core simulation cycle: prepare a phishing message, send a campaign and review recipient activity. Results arrive near real time, and reports can be exported, giving teams a direct way to see how people interact with a campaign.

This is a framework rather than a managed training service. It can run from a downloaded binary or the official Docker container, and the project directs users to file issues for bugs, feature requests or documentation gaps. The Community Edition's MIT License permits use, modification, distribution and sale subject to its terms.

Key features

Templates and campaign scheduling

Teams can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send email in the background and can be scheduled, which supports repeatable exercises without requiring each send to be initiated manually. The browser editor and scheduling are useful for teams shaping their own campaigns; they do not turn Gophish into a packaged awareness curriculum.

Recipient activity and reporting

Recipient timelines show email opens, link clicks and submitted credentials. Near-real-time results and exportable reports help teams follow campaign outcomes at both the individual and campaign level. This is valuable for measurement, but credential submission data calls for careful handling within an organization's security practices.

API and deployment

A REST API and Python client give technical teams ways to integrate Gophish into their own workflows. The binary and official Docker container offer two deployment routes, while the self-hosted nature puts operation in the user's hands. Version 0.12.1 added configurable trusted origins to the CSRF handler for deployments where TLS ends at an upstream load balancer.

Attachment tracking

Attachment tracking is supported for docx, docm, pptx, xlsx, xlsm, txt, html and ics files. Teams whose exercises depend on other attachment formats should not assume those files will be tracked in the same way.

Pricing

Gophish costs nothing, billed for free. The Gophish plan is an open-source phishing framework, and the Community Edition's MIT License allows use, copying, modification, distribution and sale subject to its terms. No seat or usage cap is stated for the free plan. Its price advantage is clear, but the trade-off is that teams deploy and operate the framework themselves rather than buying a managed service.

Platforms

Gophish supports API, Linux, macOS, Windows and self-hosted use. Its binary and official Docker container provide documented deployment options for teams prepared to run the software in their own environment.

Who it's for

Gophish is a strong fit for pentesters and businesses that want to run their own real-world phishing simulations, need scheduling and recipient-level tracking, and can manage a self-hosted tool. The API and Python client also suit technical teams that want to connect campaign activity to their own processes.

It is less suited to organizations looking for a ready-made training subscription or a managed service. Teams that require attachment tracking beyond the supported formats should also compare alternatives before committing.

Pros and cons

• Free, open-source framework: The MIT-licensed Community Edition can be used and modified without a software charge, subject to the license terms.
• Useful campaign visibility: Scheduled sends, recipient timelines and near-real-time results make it possible to follow campaign activity and export reports.
• Technical integration options: A REST API and Python client can support workflows built around the framework.
• Self-management required: Users must deploy and operate it through a binary or Docker rather than rely on a managed training service.
• Bounded attachment support: Tracking applies to the documented file types, which can constrain exercises using other formats.
• Issue-based project support: The project asks users to file issues for bugs, feature requests or missing documentation.

Alternatives

CanIPhish is worth considering for a small organization that wants a free plan capped at 10 employees, or a paid option for larger teams; it is freemium and supports API and web platforms. SMARTFENSE Simulation Tools is a paid alternative for readers comparing a simulation tool across a broad set of platforms, including mobile, desktop and web.

Trellix Data Loss Prevention is a different kind of security product: choose it when the need is enterprise data-loss protection across endpoints, email, web, networks and storage, with on-premises or SaaS management. Hoxhunt offers a custom-quote paid option priced per employee, with the quote dependent on employee count and required capabilities.

Proofpoint Email DLP and Encryption is a paid email data-loss prevention and encryption alternative. Infosec IQ is a paid alternative with Enterprise and Infosec IQ + Skills plans. Shirudo is another paid option. Mimecast Data Leak Prevention offers paid Professional and Enterprise plans.

For more options, browse Phishing Simulation Software or Security Awareness Training Software.

Verdict

Choose Gophish if your team wants a free, flexible framework for scheduled phishing simulations and recipient-level reporting, and is prepared to deploy and manage it. Look elsewhere if you need a managed training service or require attachment tracking beyond the supported file formats.