Best Self-hosted Security & Privacy tools in 2026

Client-side web app to encrypt or split secrets into QR codes and OCR-friendly printouts for offline recovery using AES and Shamir Secret Sharing.

Slowing down

Alternative to:

Onetime Secret+1

Secrover generates human-readable HTML security audit reports for repositories and domains. Scans dependencies, code, and domains; supports scheduling and remote exports.

GPL-3.0Actively maintained

Alternative to:

Snyk+15

Web-based UI for mkcert to generate, download, and monitor locally-trusted development TLS/SSL certificates with SCEP, authentication, Docker deployment, and email alerts.

GPL-3.0Actively maintained

Alternative to:

ZeroSSL+6

Open-source API and web interface to test TCP port availability for hostnames and IPs. Docker-ready, minimal dependencies, and exposes Prometheus metrics for monitoring.

GPL-3.0Actively maintained

Alternative to:

MXToolbox Open Port Check+3

Single-binary TLS reverse proxy for self-hosted apps that provides SSH- and Telegram-based authorization, simple SSO, Let's Encrypt support and whitelist access control.

GPL-3.0Likely dormant

Alternative to:

Cloudflare Access+4

Open-source companion app for Plex Media Server to monitor live streams, enforce per-user device access, and automate session blocking with notifications and schedules.

Actively maintained

Alternative to:

Tautulli

A minimal, Rust-based forward authentication middleware for reverse proxies (Traefik, Caddy, nginx) using a passwd file and signed auth tokens.

MITActively maintained

Alternative to:

Cloudflare Access+9

Node.js SOCKS5 proxy server with optional authentication, per-user statistics, Docker Compose deployment, CLI management scripts, and a Telegram admin bot.

Apache-2.0Slowing down

Alternative to:

Bright Data+8

Lightweight Go-based authentication gateway that provides unified SSO for Plex, Jellyfin, and Emby users with OIDC, MFA and an admin console. Runs in Docker and stores profiles in Postgres.

GPL-3.0Actively maintained

Alternative to:

Auth0+19

Self-hosted Docker web app for generating secure passwords and passphrases with customizable options, haveibeenpwned checks, PWA support, and environment variable configuration.

Advanced SSH server and bastion that authenticates via OpenID Connect or keys, runs sessions inside Docker containers or Kubernetes pods, and supports automatic user provisioning.

Apache-2.0Actively maintained

Alternative to:

Teleport+7

Minimal, dependency-free browser password generator written in HTML, CSS and plain JavaScript. Customizable character sets, length, translations and a strength indicator.

GPL-2.0Likely dormant

Alternative to:

Microsoft Edge

Open-source TOTP client and encrypted vault using zero-knowledge encryption to store, sync and retrieve TOTP secrets via web, rescue frontend, iOS and CLI; self-hostable.

GPL-3.0Actively maintained

Alternative to:

Google Authenticator+3

Browser-based self-custodial crypto wallet that derives a private key from a password and passcode using scrypt and keccak256; no registration or seed phrases.

Kontoj loads a JSON services list to generate credentials, autofill signup forms via a userscript, and export generated credential emails for bulk account creation.

PHP-based authentication server repository that provides backend auth logic and templated views for the Authman app; frontend is provided separately.

Cloudron is a self-hosted platform for deploying and managing web apps with one-click installs, automatic updates, backups, and integrated HTTPS, email, and user management.

Activity unknown

Alternative to:

Cloudron+19

Self-hosted control panel to deploy, manage, and monitor Docker-based apps with domains, SSL, environment variables, and one-click services.

Activity unknown

Alternative to:

Coolify Cloud+15

FusionAuth is a self-hosted authentication and IAM platform supporting OAuth2, OIDC and SAML, with SSO, MFA, user management and developer-focused integrations.

Activity unknown

Alternative to:

Auth0+19

Mistborn aggregates threat intelligence from multiple sources to enrich, normalize, and distribute IOCs for security analysis and incident response workflows.

Activity unknown

Alternative to:

VirusTotal+2

The sftp-server subsystem in OpenSSH provides SFTP file-transfer services over SSH with support for internal-sftp, chroot jails, public-key and certificate authentication, and protocol extensions.

Activity unknown

Alternative to:

Files.com+12

Passit is an open-source password manager to store passwords and secure notes, organize them in groups, and share access on self-hosted instances.

Activity unknown

Alternative to:

LastPass+9

Privoxy is a self-hosted, non-caching web proxy that filters ads and trackers, rewrites content, and modifies HTTP headers for privacy and access control.

Activity unknown

Alternative to:

AdGuard+6

Psono is a self-hosted, open-source password manager with client-side encryption, web & mobile clients, admin portal and a fileserver for encrypted file storage.

Activity unknown

Alternative to:

LastPass+9

Samba is an open source SMB/CIFS file and print server that also provides Active Directory Domain Controller and member server capabilities for Linux/Unix systems.

Activity unknown

Alternative to:

Microsoft Windows Server+5

Stackspin is an open source platform that bundles common team collaboration apps with single sign-on, centralized user management, backups, and monitoring for admins.

Activity unknown

Alternative to:

Google Workspace+19

Turtl is an end-to-end encrypted note-taking and bookmarking app with tagging, full‑text search, and optional self-hosted sync via Turtl Server.

Activity unknown

Alternative to:

Standard Notes+19