On 5 March 2019, the US National Security Agency used the RSA Conference to release Ghidra, the software reverse engineering framework its own researchers had built. The tool is created and maintained by the agency’s Research Directorate, and its source code is published on GitHub under the Apache 2.0 licence.
In a review published four years later, the NSA counted more than one million public downloads. Development remains brisk, and version 12.1.4, the newest when we checked, came out on 21 September 2026.
What Ghidra is for
Reverse engineering means starting from a compiled program, which is nothing more than a stream of machine instructions, and working out what it does without access to its source code. Ghidra opens an executable or a firmware image, identifies its format, locates functions and strings, and presents the assembly code in an annotated listing. Next to it, the decompiler rebuilds a C-like version that is far easier to follow. Both views stay in sync, so renaming a variable or fixing a data type in one updates the other straight away.
Much of its strength comes from the way it is built. Each processor is described in a specification language called Sleigh, which translates instructions into a shared intermediate representation known as P-code. The decompiler works on that representation, which is why it handles every supported architecture, from x86 and ARM chips to far more obscure embedded processors. Everything can be automated with Java or Python scripts, the latter through PyGhidra, and a headless mode analyses batches of files on a server. Ghidra Server provides a shared repository where several analysts each work on a local copy of the same project, and a debugger connects the tool to the system’s native debuggers.
Compared with IDA Pro, the long-standing commercial reference from Hex-Rays, and Binary Ninja from Vector 35, Ghidra’s first selling point is that it costs nothing, decompiler included, whatever the target processor. According to the NSA, the framework has been used to study Wi-Fi routers, car electronics and voting machines, and the state of New Hampshire relied on it for the forensic review of a 2020 local election. Security teams also use it to take malware apart, hunt for vulnerabilities and understand how firmware behaves.
Who is it for?
Ghidra is aimed at malware analysts, vulnerability researchers, incident response teams and developers who need to understand a binary they do not have the source for. It has also found a firm place in education: the agency says it is part of many university courses and is widely used in capture the flag competitions.
It is not a beginner’s tool. You need to read assembly and understand how a processor works, and the Java interface is crowded enough to take real time to learn. The documentation asks for at least 4 GB of memory and recommends two monitors. Ghidra examines programs rather than disks or memory captures, so Volatility is the better choice for a memory image and Autopsy for a disk investigation. Instrumenting a running application is Frida’s territory, and interactive debugging on Windows is where x64dbg shines.
Download Ghidra safely
The only official distribution is the releases section of the NationalSecurityAgency/ghidra repository on GitHub. Each release is a single zip archive that serves Windows, macOS and Linux alike, weighing 543 MB for 12.1.4 and published alongside its SHA-256 hash. There is no installer. You extract the archive into a folder, install a 64-bit Java 21 development kit such as Adoptium Temurin or Amazon Corretto, and run the ghidraRun script. On macOS, the guide expects some native components to be compiled with Xcode and warns that Gatekeeper may block unsigned ones.
Ghidra has no paid edition and asks for no account or licence key. The real risk is a tampered copy. A tool whose job is to open hostile files should never come from a dubious source itself, and an archive repackaged by a download portal could hide anything. The project README also warns that some older versions contain known vulnerabilities and points to the security advisories. Keeping up with the updates posted on GitHub is the safest habit.
Frequently asked questions
Is Ghidra really free?
Yes. It is released under the Apache 2.0 licence, with no premium tier and no locked features. The decompiler, Ghidra Server collaboration and scripting are all included, and the licence allows commercial use.
Can I trust a tool published by the NSA?
The complete source code is public on GitHub, where anyone can read it and even build it themselves instead of using the supplied archive. The project also accepts outside contributions. The sensible precaution is to download it only from the official repository and check the published hash.
Which Java version do I need?
The 12.1 branch requires a 64-bit Java 21 development kit. The documentation being prepared for the next release moves to Java 25, so check the getting started guide whenever a major version comes out. The free Temurin and Corretto builds both work.
