01
Set Templates & Targets
Create or import high-fidelity phishing templates, define approved recipients, and customize campaign content directly in the browser.
Free · Security-first · Actively maintained
Phishing simulations.
Built for defenders.
DarkPhish is a free platform for authorized phishing simulations, security-awareness training, internal security testing, and defensive research.
For authorized security testing only.
scoped access
signed audit trail
DarkPhish workflow
Launch a Campaign in 3 steps
02
Launch the Campaign
Start immediately or schedule delivery for later. DarkPhish handles campaign delivery in the background while you stay in control.
03
Track Results
Monitor campaign activity in near real time, review recipient timelines, and export results for reporting and follow-up.
Security is part of the product
A modern foundation for authorized simulations.
DarkPhish keeps the straightforward deployment model that made Gophish useful, while hardening the platform for current security and operational expectations.
Secure browser sessions
Encrypted and signed sessions with hardened cookie settings.
Scoped API access
Expiring personal access tokens instead of permanent legacy API keys.
Protected secrets
Sensitive SMTP, IMAP, and webhook secrets stay write-only in normal API responses.
Deployment posture
Hardened
production controls enabled
API tokensScopedexpiring credentials
Audit eventsSignedhash-chained records
DarkPhish plans
Simple pricing. Built to scale.
Start with DarkPhish Community for free. Professional and Enterprise are in development. Self-hosted deployment. Your data stays under your control.
Community
Free€0 / forever
For individuals, labs and small security teams.
- Managed usersUp to 100
- Active campaigns1
- Simulation engine✓
- Basic reporting✓
- Core REST API✓
For authorized internal security testing, awareness and defensive use.
Coming soon
Professional
Coming soonCurrently in development
For organizations running a continuous human risk management program.
- Managed users250 included
- CampaignsUnlimited
- Human Risk + Training✓
- Smart Groups✓
- Entra / Google✓
- Advanced reporting + AI✓
Planned features. Join release updates to hear when Professional is ready.
Enterprise
Coming soonCurrently in development
For large, regulated and security-sensitive organizations.
- Managed usersUnlimited
- CampaignsUnlimited
- SSO + Advanced RBAC✓
- SIEM integrations✓
- Multi-org + SLA✓
- On-prem / air-gapped✓
Planned features. Contact Sales to discuss your requirements before launch.
Need help choosing the right plan?
Community gets you started. Professional and Enterprise are in development; the comparison below shows planned capabilities.
| Capability | Community | Professional | Enterprise |
|---|---|---|---|
| Price | Free | Coming soon | Coming soon |
| Managed users | Up to 100 | 250 included | Unlimited |
| Campaigns | 1 active | Unlimited | Unlimited |
| Human Risk | — | ✓ | ✓ |
| Training | — | ✓ | ✓ |
| Smart Groups | — | ✓ | ✓ |
| Entra / Google | — | ✓ | ✓ |
| Advanced Reporting | — | ✓ | ✓ |
| AI Assistance | — | ✓ | ✓ |
| SSO — SAML / OIDC | — | — | ✓ |
| Advanced RBAC | — | — | ✓ |
| SIEM integrations | — | — | ✓ |
| SLA | — | — | ✓ |
| Multi-organization | — | — | ✓ |
Self-hosted by design. Your users, campaigns and security data remain under your control.
No vendor lock-in. No mandatory cloud. No continuous phone-home requirement.