gowitness: Take Screenshots of Any Web Page, Instantly and Accurately

If you've ever needed to snapshot a bunch of websites for a security audit, a client report, or even just to archive a few pages, you know it's rarely as simple as hitting Print Screen. Browsers are heavy, scripts can hang, and timing is tricky. That's where gowitness comes in. It's a fast, accurate web screenshot tool built on Chrome Headless that does exactly one thing: takes screenshots of web pages, and does it well.

The project lives at sensepost/gowitness on GitHub, and it's already become a go-to tool for penetration testers, bug bounty hunters, and anyone who needs to batch screenshot URLs without the overhead of a full browser UI.

What It Does

gowitness is a command line tool written in Go. You give it a list of URLs (or a file with URLs), and it uses Chrome in headless mode to:

• Navigate to each page with a customizable user agent and viewport size.
• Wait for the page to fully load, including JavaScript and assets.
• Take a screenshot and save it as a PNG file.
• Optionally write metadata (like response headers, TLS certificate info, and page title) to a SQLite database.

It handles redirects, timeouts, and even supports login forms or cookies for authenticated pages. The output is clean: one screenshot per URL, named by domain or a custom pattern, along with a database you can query later.

Why It’s Cool

There are other screenshot tools out there, but gowitness does a few things that set it apart.

First, it's fast. Because it's written in Go and uses Chrome Headless directly (not Selenium or a custom browser wrapper), it can process hundreds of URLs per minute on modest hardware. The default concurrency is well tuned, but you can also control the number of parallel goroutines to avoid overwhelming your machine or the target servers.

Second, it's accurate. The tool uses Chrome's full rendering engine, so you get the exact page as a real user would see it, unlike lightweight tools that only capture HTML or rely on server side screenshots. It also respects JavaScript rendering, so single page apps work fine.

Third, the database integration is a killer feature. After a scan, you can query the SQLite database to find all pages that returned a specific response header, or all pages with a certain TLS certificate subject. That's incredibly useful for security analysis or for finding patterns across a set of domains.

Use cases range from simple site monitoring and compliance checks to more specialized things like subdomain takeover discovery, phishing page verification, or tracking the layout of a competitor's landing page over time.

How to Try It

Getting started is easy. If you have Go installed, you can build from source:

go install github.com/sensepost/gowitness@latest

Or download a precompiled binary from the releases page for your OS (Windows, macOS, Linux).

Then run it with a single URL:

gowitness single https://example.com

Or with a list of URLs in a file:

gowitness file --source ./urls.txt

You'll get a screenshots folder with PNGs and a gowitness.sqlite3 database. You can also use the serve subcommand to start a small web interface that shows all your screenshots in a gallery.

The README has full details on all flags, including custom headers, proxy support, and timeouts.

Final Thoughts

gowitness is the kind of tool that feels like it should have existed years ago, but now it does, and it's solid. It's not trying to reinvent anything, just do one thing extremely well. The combination of speed, accuracy, and the metadata database makes it a perfect fit for security workflows, but honestly, any developer who needs to snapshot a batch of URLs regularly will appreciate it.

If you're doing any kind of web reconnaissance, automation, or even just want a reliable way to archive pages, give it a shot. It's free, open source, and maintained by the folks at SensePost, so you know it's battle tested.

Follow us at @githubprojects for more developer tools and open source highlights