FOFA
A search engine for internet-exposed hosts, services and web applications.
Updated · AppBreakup editorial · Web
Is FOFA free?
Free plan, plus paid plans
- Starting price:
- $25 a month, Personal plan (discounted from $49)
- Free plan:
- Yes, 300 query credits/month, non-commercial
Checked on FOFA's site Nov 8, 2026
Full FOFA pricing and plansSwitch from FOFA to
All 5- Verified facts
- 9 of 9
- Alternatives ranked
- 5
- Approved reviews
- 0
- Visits sent from here
- 0
About FOFA
FOFA is a cyberspace mapping search engine from the Chinese security firm Huashun Xin'an. It indexes hosts and websites across the internet and identifies what they run using a large library of product fingerprints, so you can search for things like every server running a specific CMS version, hosts sharing a favicon, or all assets behind a certain certificate. Penetration testers and bug bounty hunters use it to find targets in scope, and defenders use it to inventory what their organisation exposes. Queries use a field-based syntax in the web interface, and paid plans add an API with aggregation endpoints, higher result limits, fuzzy search and product tags. Registered users get a small monthly allowance of query credits for non-commercial use; larger plans are billed monthly or yearly, and F Points can be bought for one-off queries and downloads. The English site is a translation of the Chinese service, and some pages and support material are still only in Chinese.
Best for: Pentesters and bug bounty hunters who need fingerprint-based asset discovery with an affordable API..
FOFA pricing (checked Nov 8, 2026)
Each line is quoted from FOFA's own site, with the page it came from.
| Plan or term | What it says | Checked | Source |
|---|---|---|---|
| Free plan | Yes, 300 query credits/month, non-commercial | Nov 8, 2026 | en.fofa.info |
| Free plan use | Non-commercial only | Nov 8, 2026 | en.fofa.info |
| Starting price | $25 a month, Personal plan (discounted from $49) | Nov 8, 2026 | en.fofa.info |
| Professional plan | $119 a month (discounted from $149) | Nov 8, 2026 | en.fofa.info |
| Business plan | $1,199 a month (discounted from $1,499) | Nov 8, 2026 | en.fofa.info |
| F Points | 10,000 F Points for $6 | Nov 8, 2026 | en.fofa.info |
Pros and cons
What works
- Large fingerprint rule library identifies specific products and versions
- Free registered tier with monthly query credits
- Query API with host and statistics aggregation on paid plans
- Pay-as-you-go F Points for occasional bulk downloads
Why people leave
- Free tier is for non-commercial use only
- Some pages, including company information, are only in Chinese
- Most API fields and syntaxes are locked behind higher plans
FOFA vs Shodan, Censys and ZoomEye
From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.
| Attribute | FOFA | Shodan | Censys | ZoomEye |
|---|---|---|---|---|
| Pricing | Free plan + paid | Free plan + paid | Free plan + paid | Free plan + paid |
| Verified price | $25 a month, Personal plan (discounted from $49) | $49 one-time (Membership) | — | — |
| Free plan | Yes, 300 query credits/month, non-commercial | Yes | Yes (basic visibility) | Yes |
| Open source | No | No | No | No |
| Self-hostable | No | No | No | No |
| Platforms | Web | Web | Web | Web |
Top FOFA alternatives
See all 5- 1
Shodan68.8Better-known Western equivalent with broad integrations and a cheap lifetime membership.
- 2
Censys64.8Strong certificate data and enterprise attack-surface management from a US company.
- 3
ZoomEye61.8Similar China-based scanner from Knownsec with an official CLI and MCP server.
- 4
Criminal IP59.4Adds IP and domain risk scores, VPN and Tor detection, and STIX or MISP threat feeds to scan data.
- 5
LeakIX57.5Focuses on leaks and misconfigurations like open databases, with cheap euro plans and alerts on your own assets.
Why people left FOFA
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from FOFA, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of FOFA
FOFA: common questions
What is FOFA?
FOFA: A search engine for internet-exposed hosts, services and web applications. Best for pentesters and bug bounty hunters who need fingerprint-based asset discovery with an affordable API. Available for Web.
Is FOFA free?
FOFA has a free plan and paid plans. Free plan: Yes, 300 query credits/month, non-commercial (checked on FOFA's own site).
How much does FOFA cost?
FOFA is free with paid plans. Free plan: Yes, 300 query credits/month, non-commercial; Free plan use: Non-commercial only; Starting price: $25 a month, Personal plan (discounted from $49); Professional plan: $119 a month (discounted from $149). Checked on FOFA's own site, November 2026.
Is FOFA open source?
No, FOFA is not open source.
What platforms does FOFA run on?
FOFA is available for Web.
What are the best alternatives to FOFA?
The highest-ranked FOFA alternatives right now are Shodan, Censys and ZoomEye. See the full ranked list for pricing, platforms and verified facts.
FOFA vs Shodan: what's the difference?
Both FOFA and Shodan are free with paid plans. Verified prices: FOFA $25 a month, Personal plan (discounted from $49), Shodan $49 one-time (Membership). Both run on Web.