A fair pricing model
Pro
per month
One flat rate. No tiers.
Community is free forever.
Pro is €5 one month per licence time!
30 days free trial — no account, no credit card. One trial per device.
Community
Free forever. No account required. No time limit. No crippled features.
Scanner
40 active vulnerability checks covering SQLi, XSS, command injection, path traversal, SSTI, SSRF, XXE, HTTP smuggling, and more. 24 passive checks run on every proxied response — security headers, sensitive data exposure, cookie flags, CSP analysis, stack traces. Out-of-band detection via Oastify across 6 protocols: DNS, HTTP, SMTP, LDAP, FTP, and SMB callbacks.
Intruder
Fuzzer with 19 payload generators, 15 processing rules. Sniper, pitchfork, cluster bomb, and battering ram attack modes.
Toolkit
Repeater for manual request crafting. Decoder for transforms and encoding chains. Sequencer with FIPS randomness analysis. Comparer for response diffing.
Proxy
Full intercepting proxy with HTTP/1.1, HTTP/2, and WebSocket support. On-the-fly TLS with automatic CA certificate generation. Match and replace rules for live traffic modification. Scope filtering to focus on targets that matter. Invisible proxy mode for non-proxy-aware clients. Request and response interception with hold, forward, and drop actions.
Pro
Everything in Community, plus advanced offensive capabilities.
Race Conditions
Single-packet attack, last-byte sync, and barrier-based coordination. 60+ pre-built modules for common race patterns.
MCP
130+ tools for AI agents. Connect Claude, Cursor, or any MCP-compatible client to drive scanning, fuzzing, and exploitation. Full proxy control, intruder automation, flow analysis, scope management, and vulnerability reporting — all through natural language. Includes 56 offensive vurl tools for HTTP smuggling, cache poisoning, SSRF chains, and protocol-level attacks.
Synaps Modules
Community-contributed scanner modules written in Rust and compiled to WASM. Strong sandbox via Wasmtime with fuel-based execution limits and 16MB memory cap. Full guest SDK with HTTP, raw TCP, DNS, TLS inspection, WebSocket, browser automation, and Oastify OOB callbacks. Install modules with a single command.
Lua Extensions
Hook requests, responses, and scan results. Modify live traffic with scripts. Permission-gated and sandboxed with execution limits.
Collaboration
E2E encrypted project sharing. Shared flows, findings, and scope in real time. Multi-project workspaces with isolation.
How it works
- How do accounts work?
- Generate an account ID on the account page. It looks like
HGN-A1B2C3D4-E5F6A7B8-C9D0E1F2. Save it somewhere safe — there is no email, no password, no recovery. Anonymous by design. - What happens when my time runs out?
- Pro features stop working. Your data stays. Community features keep working. Buy more time whenever you want — your expiry extends from the current date.
- Can I pay with crypto?
- Yes. Bitcoin and Monero via BTCPay Server. No KYC, no tracking.
- Refunds?
- Card payments: full refund within 14 days if you haven't used Pro features. Crypto: no refunds (blockchain transactions are irreversible). Full refund policy.
- Why no Enterprise tier?
- Every hunter is a professional. A researcher on HackerOne and a pentester at a consultancy use the same techniques, find the same bugs. We don't charge more because your employer has a bigger budget. One price, same tool, no user-class tax.
- Student discount?
- Yes — students with a GitHub Student Developer Pack get 12 months of Pro free. Claim yours here.