46 free and open-source tools we actually use in production work, grouped into 10 categories. Every link points to the vendor or project’s own download page — we do not mirror binaries, bundle installers, or wrap anything in an ad-supported downloader.
Get-FileHash file.exe -Algorithm SHA256; on Linux or macOS use sha256sum or shasum -a 256.We receive no payment from any project listed here. See our affiliate disclosure and editorial policy.
The long-standing free SSH, Telnet, serial and raw-socket client for Windows, plus PSCP/PSFTP command-line transfer tools and the PuTTYgen key generator.
Best for: Quick SSH and serial-console sessions on a locked-down Windows box.
Tabbed terminal with an embedded X11 server, SFTP browser pane, and built-in RDP/VNC/SSH session manager. The Home Edition is free with session-count limits.
Best for: Engineers who need X11 forwarding and file transfer in the same window.
Microsoft's GPU-accelerated, tabbed terminal host for PowerShell, CMD, WSL and SSH profiles, with panes, themes and JSON-based configuration.
Best for: A modern default shell host with native OpenSSH.
The reference SSH implementation: client, server, ssh-keygen, ssh-agent and sftp. Ships with Linux, macOS and modern Windows as an optional feature.
Best for: Scripted, key-based access and port forwarding without extra software.
Open-source remote desktop with optional self-hosted relay and ID servers, so screen sharing does not have to traverse a vendor cloud.
Best for: Self-hosted remote support where TeamViewer licensing is a blocker.
Host discovery, port scanning, service and OS fingerprinting, plus the Nmap Scripting Engine for vulnerability and enumeration scripts. Zenmap provides a GUI.
Best for: Authorised inventory and exposure scans of a subnet.
Deep packet inspection with thousands of protocol dissectors, capture filters, TLS key-log decryption and the tshark command-line companion.
Best for: Proving where a connection actually fails, packet by packet.
Active throughput measurement for TCP, UDP and SCTP with tunable window sizes, parallel streams and JSON output for automation.
Best for: Benchmarking a link before blaming the application.
Lightweight, cross-platform IP and port sweeper that exports CSV/TXT/XML — useful when a full Nmap install is not permitted.
Best for: Fast subnet sweeps on a helpdesk laptop.
SNMP and flow-based device monitoring. Zabbix is fully open source; PRTG offers a permanently free tier limited to 100 sensors.
Best for: Interface, latency and availability graphs for a small estate.
Full vulnerability scanner with a community feed of network vulnerability tests, authenticated scanning and scheduled reporting.
Best for: Recurring authenticated vulnerability scans without a licence.
Intercepting proxy and dynamic application scanner with passive rules, an active scan engine, and an API for CI pipelines.
Best for: Testing your own web apps before a pen-test engagement.
Offline password manager using the KDBX format, with browser integration, TOTP, YubiKey challenge-response and no cloud dependency.
Best for: Credential storage where a hosted vault is not acceptable.
Microsoft's toolkit including Process Explorer, Process Monitor, Autoruns, TCPView and Sysmon for endpoint telemetry.
Best for: Triaging a suspicious Windows host in minutes.
Open-source antivirus engine with on-demand and daemon scanning, signature updates via freshclam, and mail-gateway integration.
Best for: Server-side file scanning in upload and mail pipelines.
Cross-platform editor with an enormous extension marketplace, integrated Git, debuggers, containers/WSL remote development and terminal.
Best for: Almost any language, especially web, Python, Go and infrastructure code.
Microsoft's full IDE — designers, profilers, advanced debugger, test tooling — free for individuals, open source projects and small teams under the licence terms.
Best for: .NET, C++ and Windows desktop development.
Fast Windows text editor with syntax highlighting, macros, column editing, large-file handling and a plugin ecosystem.
Best for: Editing config and log files on a support workstation.
Distributed version control, plus Git Bash and Git Credential Manager on Windows installations.
Best for: Version control for code and infrastructure definitions.
JetBrains' free JVM IDE with refactoring, static analysis, JUnit integration and Gradle/Maven support.
Best for: Java and Kotlin projects that need heavy refactoring support.
Type-2 hypervisor with snapshots, shared folders, host-only networking and a scriptable VBoxManage CLI.
Best for: Lab VMs and OS testing on a workstation.
Bare-metal KVM and LXC platform with clustering, Ceph storage, built-in backup and a web console. Free without a support subscription.
Best for: Homelab and small-business virtualisation clusters.
Container build and run tooling. Docker Engine is free everywhere; Docker Desktop is free for personal use, education and small businesses under Docker's terms.
Best for: Local container builds matching your CI images.
Daemonless, rootless container engine with a Docker-compatible CLI, pods, and systemd unit generation.
Best for: Rootless containers and licence-free desktop container tooling.
Creates bootable USB media from ISO images, including Windows installers with TPM/Secure Boot requirement bypass options and persistent Linux drives.
Best for: Building install media faster than the vendor tools.
Installs once to a USB drive, then boots any ISO you copy onto it — multiple operating systems and rescue images on one stick.
Best for: A single technician USB with every rescue ISO.
Bootable partition editor supporting ext4, NTFS, FAT32, XFS and btrfs — resize, move, copy and repair partitions offline.
Best for: Resizing a system partition safely outside the running OS.
High-ratio archiver supporting 7z, ZIP, TAR, ISO and RAR extraction, with AES-256 encryption and a command-line version for scripts.
Best for: Everyday archive handling and scripted packaging.
Reads SMART attributes from HDDs, SSDs and NVMe drives, shows wear indicators, and raises temperature and reallocated-sector alerts.
Best for: Catching a failing drive before the user does.
Image-level backup for endpoints and up to 10 workloads in the Community Edition, with bare-metal recovery media.
Best for: Free image backups for a handful of servers or laptops.
Encrypted, incremental, deduplicated backups to S3, Backblaze B2, Azure, Google Drive, SFTP and more, driven from a web UI.
Best for: Client-side encrypted offsite backups to cheap object storage.
Command-line sync for 70+ storage providers, with crypt overlay, bandwidth limits, checksum verification and mount support.
Best for: Scripted cloud-to-cloud and server-to-cloud sync jobs.
SFTP, SCP, FTPS and WebDAV client for Windows with directory synchronisation, scripting and PuTTY integration.
Best for: Drag-and-drop transfers to Linux servers from Windows.
Cross-platform FTP, FTPS and SFTP client with a queue manager, site manager and transfer resume.
Best for: Legacy FTP/FTPS endpoints that SFTP tools do not cover.
Pull-based metrics database with PromQL, service discovery, recording rules and Alertmanager routing.
Best for: Infrastructure and application metrics at container scale.
Dashboards and alerting over Prometheus, Loki, Elasticsearch, SQL databases and dozens of other sources.
Best for: One visual layer across mixed telemetry backends.
Vendor-neutral pipeline that receives, processes and exports traces, metrics and logs, so instrumentation is not tied to one backend.
Best for: Avoiding lock-in between observability vendors.
Self-hosted uptime monitoring for HTTP(S), TCP, DNS, ping and certificate expiry, with status pages and 90+ notification channels.
Best for: A free public status page and expiry alerts.
Production-grade relational database with JSONB, logical replication, partitioning, extensions such as PostGIS, and strong SQL conformance.
Best for: The default choice for new transactional workloads.
Universal database client covering PostgreSQL, MySQL, SQL Server, Oracle, SQLite and JDBC sources, with ER diagrams and data transfer.
Best for: One client for every engine you have to support.
Embedded zero-configuration database, plus a free GUI for browsing, editing and importing CSV data.
Best for: Local datasets, prototypes and application-embedded storage.
Open-source BI layer with SQL Lab, chart builder, dashboards and row-level security over any SQLAlchemy-supported database.
Best for: Self-hosted dashboards without per-seat BI licensing.
Full office suite — Writer, Calc, Impress, Base, Draw — with OOXML support, PDF export and headless conversion for servers.
Best for: Document work and batch PDF conversion without licences.
Mail, calendar and contacts client with IMAP/Exchange EWS support via add-ons, OpenPGP encryption and message filters.
Best for: A standards-based desktop mail client.
Screen capture and annotation tools with region capture, scrolling capture (ShareX), OCR and configurable upload destinations.
Best for: Documenting fixes and building runbooks quickly.
Offline diagramming for network topologies, architecture and flowcharts, with AWS/Azure/GCP shape libraries and .drawio version-controlled files.
Best for: Architecture diagrams that live next to your code.
The pairings people ask about most often, and how we choose between them in practice.
These two get compared constantly because both end up being how engineers reach a remote Linux box from Windows — but they solve different halves of the job. PuTTY is a terminal client. VS Code is an editor that can host a remote session.
| Criterion | PuTTY | Visual Studio Code |
|---|---|---|
| Primary purpose | SSH / Telnet / serial terminal client | Code editor with remote development |
| Install size | ~4 MB, portable .exe available | ~100 MB plus extensions |
| Editing remote files | Via vi/nano in the terminal, or PSCP/WinSCP | Full editor, IntelliSense and Git over SSH |
| Serial console (COM ports) | Yes — a core feature for switches and routers | Only with a third-party serial extension |
| Resource use | Negligible | Electron-based; hundreds of MB of RAM |
| Works on a locked-down jump host | Yes, portable and no admin rights needed | Often blocked; needs a server component on the target |
| Session management | Saved sessions, no tabs natively | Workspaces, tabs, terminals and tasks |
| Licence | MIT, open source | Free download; MIT Code — OSS core |
Our take: Use PuTTY when you need a console — switch configuration, serial cable, a break-glass SSH session on a machine where you cannot install much. Use VS Code with the Remote-SSH extension when you are actually writing or refactoring files on the server. Most teams install both, and pair PuTTY with WinSCP for transfers.
The other frequent mix-up: a lightweight cross-platform editor versus Microsoft's full Windows IDE. Both are free to download, but the licence conditions differ.
| Criterion | VS Code | Visual Studio Community |
|---|---|---|
| Type | Editor plus extensions | Full IDE |
| Platforms | Windows, macOS, Linux | Windows only |
| Best languages | JavaScript/TypeScript, Python, Go, YAML, Terraform | C#, F#, C++, .NET, Windows desktop |
| Designers and profilers | Limited, extension-dependent | WinForms/WPF designers, profiler, test tooling |
| Licence limits | No user-count restriction | Individuals, OSS, classrooms, and orgs under Microsoft's size limits |
| Typical install | Minutes | Tens of GB with workloads |
Our take: Pick VS Code for polyglot, cloud and infrastructure work. Pick Visual Studio Community for serious .NET or C++ development — and check the Community licence terms against your organisation's headcount and revenue before deploying it at work.
Both are network tools, but one asks questions of the network and the other listens to it. Knowing which to reach for saves hours during an incident.
| Criterion | Nmap | Wireshark |
|---|---|---|
| Mode | Active — sends probes | Passive — captures traffic |
| Answers | What hosts, ports and services exist? | What exactly happened on the wire? |
| Typical use | Asset discovery, exposure checks, NSE scripts | Handshake failures, retransmits, protocol errors |
| Detectability | Visible to IDS and firewalls | Invisible; capture is read-only |
| Automation | XML/grepable output, scriptable | tshark for CLI capture and filtering |
| Authorisation needed | Yes — always scan only what you own or are contracted to test | Yes — capture may contain personal data |
Our take: Start with Nmap to establish what is listening, then move to Wireshark when a specific connection misbehaves. Together they cover most of the diagnosis path between 'is it reachable' and 'why did it fail'.