Ghostwriter vs PwnDoc vs Pental: Free Pentest Reporting

Ghostwriter, PwnDoc and Pental’s reporting tool are all free, open source and run on your own server, and the biggest difference between them is how a report gets made. Ghostwriter fills Word templates written in Jinja2 and produces no PDF; PwnDoc fills Word templates written with docxtemplater tags and produces Word only; our free, open-source reporting tool fills your own Word template without template code, renders a PDF as well, and brings a Ghostwriter or PwnDoc template across as it is. Every fact here about Ghostwriter or PwnDoc is from its own documentation, release notes or issue tracker, as they stood on 1 November 2026.

At a glance

	Ghostwriter	PwnDoc	Our free tool
Built for	Red teams and consultants planning, running and documenting assessments	Writing findings and generating a customisable Word report	Writing findings with your team and handing over a PDF or Word report in your brand
Installing	Docker, then its own command-line tool, which its documentation warns some anti-malware tools flag	Docker and Docker Compose, then its pwndoc-cli script	One command, which checks for Docker and on Linux offers to set it up
What runs	Seven containers, PostgreSQL, Redis and Hasura among them; 16 GB of memory recommended for more than five users	A back end, a front end and MongoDB 4.2, with LanguageTool optional	The app, beside its own PostgreSQL
Reports	Word, PowerPoint, Excel and JSON; no PDF documented	Word only	The built-in PDF, and Word from your own template
Templates	Jinja2 through docxtpl: _rt names, p and tr tags, and named Word styles	docxtemplater tags and Angular expressions, named styles, and numbering.xml edited for lists	Your own report made a template by the Document Builder, or the Draft and the Placeholder Key
Retests	None; requested since August 2022	A retest stage since February 2025	Each finding’s result recorded, and a retest summary
Two people at once	Real-time collaborative editing	The last to save wins, its documentation says	A colleague’s save appears at once, and overwriting it asks first
AI	None in the application; separate agent skills, read-only, since September 2026	Drafting per field since August 2026, off by default	Drafting from your evidence, on your own key or with Ollama on your own hardware
Updates	Its update command, with a server snapshot advised first	pwndoc-cli update pulls the latest images	Overnight by itself on Linux and macOS, the database copied first; the install command again on Windows
Licence	BSD 3-Clause	MIT	AGPL-3.0

Templates are where the hours go

All three fill a Word document your firm designed, which is what clients expect. The difference is what you have to learn to make one, and what happens when it breaks.

Ghostwriter uses Jinja2 through python-docx-template. Formatted text needs an _rt name and a p tag, table rows need tr tags, and nothing else may sit beside a prefixed tag, because the whole paragraph or row is replaced. When a generated report will not open, its documentation says there is no easy way to find the cause, and suggests deleting half the template, uploading it again and repeating. In August 2026 its maintainers opened an issue of their own about users having to download and inspect a template to discover the variables it uses; it was still open on 1 November 2026.

PwnDoc uses docxtemplater with Angular expressions. Formatted text and pictures must each be the only thing in their paragraph, the editor’s content needs named styles defined in the template, and bullet and numbered lists need the template’s numbering.xml edited in an archive manager. A user asked in March 2021 for errors that say where a template broke, and an issue opened in March 2026, still open, reports report generation failing with nothing in the back end’s logs to say which field caused it.

Our free tool fills a Word template too, but nobody writes the tags. The Document Builder takes a report you already send and places each placeholder where it belongs, for you to check and save; the Placeholder Key lists every placeholder, your own fields included; a description arrives with its formatting from one placeholder, {description}, with no prefix or second name. And a template you already have converts: upload a Ghostwriter or PwnDoc .docx and each placeholder with a Pental equivalent becomes it, its loops and table rows kept and the rest of the document as you made it, with a list of what each became, and of what has no equivalent, before anything is saved. Converting a Ghostwriter or PwnDoc Word template shows every mapping.

PDF, and what the client receives

Ghostwriter’s documented report types are Word, Excel, PowerPoint and raw JSON; a PDF renderer for it exists as a community project, announced in its discussions in March 2026. PwnDoc generates Word documents, and a request for other export formats has been open since October 2020. With both, the PDF is made in Word on somebody’s desk, and both have internal users only: neither documents a way for a client to sign in.

Our free tool renders a PDF from your settings, with your cover, a contents page, a version history, a severity summary and chart, every finding and your appendices, or fills your Word template, and the same engagement renders the same file every time. When a client should have an account of their own, Pental’s Portal gives each one a white-labelled portal with every report, finding and retest outcome.

Retests, review and working together

Ghostwriter has no retest workflow: the request has been open since August 2022. Its review is two statuses, needs editing and ready for review, which its own documentation calls a preliminary version, and the request for reviewer comments and tracked changes, opened in April 2024 and marked in progress, is the most-commented open issue in its tracker. Its editor is collaborative in real time.

PwnDoc added a retest stage in February 2025, and has edit, review and approved stages with threaded comments. Its documentation warns that when two people edit the same section, the last to save wins.

In our free tool you mark findings for retest, record each as remediated, part remediated, not remediated or risk accepted, and write the retest summary, and all of it goes into the report. What a colleague saves appears for everyone at once, and two people saving the same finding are asked before one overwrites the other. The Portal adds a QA review in which reviewers suggest edits on the field itself before a report can be approved, and retests your clients ask for from the finding they are reading.

Installing and keeping it running

Ghostwriter runs as seven containers, among them PostgreSQL, Redis and the Hasura GraphQL engine, installed and managed with its own command-line tool, which its documentation warns some anti-malware tools flag as malware. It recommends 16 GB of memory for teams of more than five, and a server snapshot before each update. Version 6 required upgrading the database to PostgreSQL 16 (July 2025), version 7 required new API tokens (June 2026), and 7.2.0 changed how evidence attaches to a report, marked as breaking (June 2026).

PwnDoc runs as a back end, a front end and MongoDB 4.2, with LanguageTool for spellcheck optional, managed since February 2026 with its pwndoc-cli script. Its release notes have asked users to re-save custom fields after one update (1.3.0) and to move custom filters after another (1.2.0). It went 31 months without a release, from July 2022 to February 2025, and ten months from April 2025 to February 2026, before ten releases in 2026.

Our free tool installs with one command, beside its own PostgreSQL, on a Mac, a Windows PC or a Linux server. On Linux and macOS the installer offers an updater that installs each release overnight, copies the database first and puts the version before it back if the new one does not start; on Windows, running the install command again updates it, with your settings and data as they are. Free to download is not free to run, and what open-source pentest reporting costs counts the hours.

Where Ghostwriter or PwnDoc fits better

Ghostwriter is a red team operations platform as much as a reporting tool: it tracks domains and servers, takes operation logs from Mythic and Cobalt Strike, and puts BloodHound results in reports. If that is what you use it for, Pental does none of it. PwnDoc’s templates are filled by docxtemplater, as ours are, so a team whose PwnDoc template already works, and who only ever send Word, has less to gain from moving than a team fighting its template, its PDFs or its updates.

Moving across

Your Word template moves first: upload it in our free tool or the Portal, read what each placeholder became and what has no equivalent, and save it. In the Portal, Coming from another platform takes a Ghostwriter report’s JSON and its finding library CSV, or a PwnDoc backup with its audits, images and vulnerability library, shows you the mapping with your own values beside each field, and writes nothing until you have checked it. The comparisons go further, product by product: Pental vs Ghostwriter and Pental vs PwnDoc.