GoPhish Alternative
PhishGrid vs GoPhish
GoPhish is a free, open-source phishing framework under the MIT licence. You host it yourself, connect your own SMTP relay, build or import templates and landing pages, and get a dashboard of opens, clicks and submitted data. It is a capable toolkit for penetration testers and technical teams. Its last release, v0.12.1, was published in September 2022, and the most recent commit to the main branch was in September 2024.
PhishGrid is a hosted AI-based human risk reduction platform with a free plan. Both can cost nothing; the difference is what you have to build and run yourself. PhishGrid adds the parts GoPhish leaves to you: training, per-person lessons, SMS and voice simulation, a report button and hosting.
GoPhish facts checked on GoPhish's own website on 7 October 2026. Sources are listed at the end of the page.
Which one fits your team?
PhishGrid fits if you
- want free phishing simulation without running a server, an SMTP relay or sending domains
- need training: PhishGrid turns each click into a lesson and picks each person's next Daily Lesson from their results
- need SMS, voice or QR code simulation as well as email
- want a one-click Report Phishing button for Gmail rather than forwarding to a mailbox
- want support, and a product that is actively developed
GoPhish fits if you
- are a penetration tester or red team that wants full control of infrastructure and templates
- need an open-source tool you can audit, modify and run in an isolated environment
- are comfortable configuring SMTP, DNS, SPF, DKIM and DMARC for your sending domains
- want an API-first tool: the GoPhish interface is a wrapper around its REST API, with a Python client and webhooks
- have your own training content and only need the simulation engine
Feature comparison
Based on getgophish.com, the GoPhish docs and its GitHub repository.
| Feature | PhishGrid | GoPhish |
|---|---|---|
| Price | Free plan; paid plans published | Free, MIT licence |
| Hosting | Hosted for you | Self-hosted (binary or Docker) |
| Sending infrastructure | Included | Your own SMTP relay |
| Email phishing simulation | ||
| SMS (smishing) simulation | ||
| Voice (vishing) simulation | AI voice agent, Enterprise | |
| QR code simulation | ||
| Template library | Ready templates plus AI from a prompt | Build or import your own |
| Import raw email and clone sites | Import HTML | Import Email, Import Site |
| Security awareness training | Daily Lesson, awareness content | |
| Report button | Gmail | IMAP mailbox polling |
| Per-employee risk score | ||
| Public REST API and webhooks | Not published | |
| Latest release | Hosted, updated by us | v0.12.1, September 2022 |
Approach: a toolkit or a programme
GoPhish is a toolkit. You create sending profiles for your SMTP relay, build or import email templates (including pasting a raw email from your mail client), clone landing pages from a URL, import users from a CSV, and launch campaigns. Results show opens, clicks, submitted data and, through IMAP polling, reports. Everything after that, including the training, follow-up and trend reporting, is up to you. The project describes itself as being for businesses and penetration testers, and it does that job well.
PhishGrid is a programme. It runs the same simulate step, then measures clicks, submitted data and reports per person, trains each person on what they missed with short lessons, and tracks risk falling over time. Templates come ready to use or are generated from a prompt, and the AI Training Creator and AI Media Studio help you build training material. There is nothing to host, patch or keep off blocklists.
Neither approach is wrong. If the goal is a one-off test that a skilled engineer controls end to end, GoPhish is hard to beat on price and flexibility. If the goal is lower human risk across an organisation month after month, the training loop matters more than the sending engine.
Pricing model
GoPhish costs nothing to license. The real costs are a server or container to run it, a sending domain and SMTP relay, and the engineering time to set up DNS records, keep the host patched and build training separately.
PhishGrid publishes three plans. Free costs nothing, with no credit card, and covers email and macro phishing simulation, customised reports, awareness content and email support; its limits depend on organisation size. Starter is $0.99 per user per month for organisations of up to 100 employees and adds custom templates on demand. Enterprise is priced on request and adds custom awareness content, 24×7 support, automated vishing, ransomware and malware simulation and the AI attack engine.
For most teams the comparison is engineering hours against a subscription, and both can start at zero.
Moving from GoPhish to PhishGrid
Moving from GoPhish is quick because GoPhish already uses portable formats.
- 1Export your groups from GoPhish as a CSV. GoPhish uses First Name, Last Name, Email and Position; PhishGrid needs name and email.
- 2Import the CSV into PhishGrid on the free plan.
- 3Copy the HTML of your GoPhish templates into PhishGrid's editor, or generate new ones from a prompt.
- 4Allowlist PhishGrid's sending domains in your mail filter, as you did for your GoPhish server.
- 5Export your GoPhish campaign results to CSV for your records, then run a baseline campaign in PhishGrid and retire the server.
PhishGrid vs GoPhish: FAQ
Is PhishGrid a free GoPhish alternative?▾
Yes. PhishGrid has a free plan with no credit card, and it is hosted, so there is no server or SMTP relay to run. It also includes training, which GoPhish does not.
Is GoPhish still maintained?▾
As of 7 October 2026 the latest GoPhish release is v0.12.1 from September 2022, and the last commit to the main branch was in September 2024. The repository is not archived.
Does GoPhish include security awareness training?▾
No. GoPhish provides the simulation engine and results. Training content and follow-up are up to you.
Can I import my GoPhish templates into PhishGrid?▾
Yes. Copy the template HTML into PhishGrid's editor. Users can be moved with a CSV export and import.
Sources
GoPhish pages read on 7 October 2026. PhishGrid facts come from our pricing, platform and company facts pages. Vendors change plans often; tell us at [email protected] if something here is out of date.
Free. Forever.
Start on the free plan with no credit card, run a real campaign, and compare the results yourself.