ffuf vs httpx
Which should you use? A side-by-side look at what each one does, who it suits, what it costs, how hard it is to set up, and where each falls short.
Open source · MIT
A fast command-line tool that guesses hidden web paths, parameters and hostnames by trying many inputs.
Open source · MIT
A command-line tool that quickly checks many web hosts and reports details about each one.
The short answer
Choose ffuf if you need…
- Security testers doing authorized web content discovery
- Developers checking which paths or parameters their own server accepts
- Students practising web fuzzing on legal practice targets such as the ffuf.me lessons mentioned in the README
- People who want a scriptable command-line tool with response filtering
Choose httpx if you need…
- Security testers doing reconnaissance on lists of hosts they are authorized to test
- Bug bounty hunters who need to filter large lists of subdomains down to live web servers
- Researchers gathering metadata about many websites at once
- Developers who want a scriptable way to check many URLs and pipe results to other tools
Side-by-side
| ffuf | httpx | |
|---|---|---|
| Type | CLI | CLI |
| Price | Free and open source | Free and open source |
| Licence | MIT | MIT |
| GitHub stars | 17k | 10.6k |
| Setup difficulty | Intermediate | Intermediate |
| How you get it | Install with a package manager | Install with a package manager |
| Main language | Go | Go |
| Last code update | 41 days ago | 4 days ago |
What each one is
ffuf
ffuf is a command-line web fuzzer written in Go. You give it a wordlist and mark where the word should go with the FUZZ keyword in a URL, header or POST body, and it sends a request for each word and reports the responses. People use it to find hidden directories, virtual hosts, and parameter names on web servers they are allowed to test.
httpx
httpx is a command-line program that sends HTTP requests to a list of hosts, URLs, or IP ranges and reports what each one returns, such as status code, page title, server name, and TLS certificate details. It is built on the retryablehttp library and is designed to stay reliable when many threads run at once. People use it to quickly survey large sets of web servers, for example during security testing or research.
Best for
ffuf
- Security testers doing authorized web content discovery
- Developers checking which paths or parameters their own server accepts
- Students practising web fuzzing on legal practice targets such as the ffuf.me lessons mentioned in the README
- People who want a scriptable command-line tool with response filtering
httpx
- Security testers doing reconnaissance on lists of hosts they are authorized to test
- Bug bounty hunters who need to filter large lists of subdomains down to live web servers
- Researchers gathering metadata about many websites at once
- Developers who want a scriptable way to check many URLs and pipe results to other tools
Strengths
ffuf
- Written in Go and distributed as prebuilt binaries for many platforms, per the release assets
- Flexible filtering of responses by size, status code and other criteria, shown in the README examples
- Supports configuration files and an external mutator via --input-cmd
httpx
- Fast, with many configurable probe flags covering status, title, TLS, hashes, and more
- Supports hosts, URLs, and CIDR ranges as input and can fall back from https to http automatically
- Includes retries and backoffs intended to handle web application firewalls
Not ideal for
ffuf
- Anyone testing sites they do not have permission to test, since it sends large numbers of requests
- People who want a graphical interface; the README describes a command-line tool with an interactive mode, not a GUI
httpx
- People who want a visual web browser or point-and-click interface, since it is a command-line tool
- Anyone probing systems they do not have permission to scan, because it can generate heavy traffic and is widely used for pentesting
- Users who need to run it as an always-on public service, since the README warns that running it as a service may pose security risks
Trade-offs
ffuf
- Its power is aimed at security testing, so it needs care and permission to use responsibly
- Detailed documentation lives in an external wiki and a third-party guide rather than the README alone
- Building from a git checkout needs Go 1.20 or greater, and local builds are not official releases
httpx
- The README says the project is in active development and may have breaking changes between releases
- Its main purpose is as a standalone CLI tool, and the README cautions about running it as a service
- Some features, such as headless screenshots and certain probes, are off by default and need extra setup or flags
Getting started
ffuf
Install with Go
go install github.com/ffuf/ffuf/v2@latestInstall with Homebrew on macOS
brew install ffufhttpx
Install httpx with Go
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latestFrequently asked questions
What is the difference between ffuf and httpx?
ffuf: A fast command-line tool that guesses hidden web paths, parameters and hostnames by trying many inputs. httpx: A command-line tool that quickly checks many web hosts and reports details about each one. ffuf suits security testers doing authorized web content discovery, while httpx suits security testers doing reconnaissance on lists of hosts they are authorized to test.
Are ffuf and httpx free?
ffuf: Free and open source. httpx: Free and open source.
Is ffuf or httpx more popular?
ffuf has more GitHub stars (17k) than httpx (10.6k). Popularity isn't the same as fit — check which one matches your use case above.
What are other alternatives to ffuf and httpx?
Other options people compare them with include subfinder, Sherlock, HackBrowserData.
Keep comparing
Built from our catalogue entries for both products: open-source details come from each project's README (AI-assisted, refreshed weekly) and GitHub data; AI-tool details are editorial. Spotted something wrong? Let us know from either product's page.