PwnDoc is a free, open-source pentest reporting application whose reports come out of a Word template written with docxtemplater tags, named styles and, for lists, edits to the file’s numbering.xml. It produces Word documents only, has no client portal, and went 31 months without a release, from July 2022 to February 2025, before ten releases in 2026. Pental fills your Word template without code, brings your PwnDoc template across as it is, and adds PDF, a client portal and two-way issue trackers. Here is the comparison, from each one’s own published information.
Each of PwnDoc's answers is taken from its own website or documentation, and each of Pental's from the screens it describes. Where PwnDoc's documentation does not cover something, the line says so rather than guessing.
| Compared | Pental | PwnDoc |
|---|---|---|
| Built for | Penetration testing firms of every size, with every feature at any size: the Portal priced per tester, the rate falling as a team grows, and our free, open-source reporting tool for a firm that wants only the reporting. | Pentesters writing findings and generating a customisable Word report. |
| Hosting and data | The Portal: Pental runs the software and your firm holds the data, in its own Postgres database: in your own cloud, on a server of yours or on Supabase Cloud, where Pental cannot read your findings. The free reporting tool runs on your own server, beside its own PostgreSQL. | Self-hosted with Docker: a Node.js back end, a front end, MongoDB 4.2 and, optionally, LanguageTool for spellcheck, managed with its pwndoc-cli script. |
| Client portal | A standing account for each client with every report, finding, retest outcome and attestation letter. Findings arrive when you release them, and questions are raised on the finding. | No client portal is documented; its roles are internal: user, admin and roles of your own. |
| Your brand | Your own domain with TLS issued automatically, your sign-in page, email from your own address, and no Pental branding anywhere. | Your own Word template. |
| Report templates | Your own Word template, with your cover page, headers, fonts, tables and appendices, or the built-in PDF. The same engagement renders the same file every time. | Word only, from templates written with docxtemplater tags; bullet and numbered lists need the template’s numbering.xml edited in an archive manager. Other export formats have been requested since October 2020. |
| Editing the report in Word | Upload the edited report and the assessment updates to match, item by item, only where you tick. A reviewer’s tracked changes arrive as suggested edits. | Reading an edited report back is not documented. |
| AI | Your own key with OpenAI, Anthropic or Groq, or a model on your own hardware through Ollama or any compatible endpoint. Every prompt can be read and rewritten. | AI drafting per field since August 2026 (version 1.7.0), off by default, with OpenAI, Anthropic, DeepSeek, Ollama or AWS Bedrock. |
| QA review | Draft, in review and approved, with suggested edits made on the field itself, the firm’s own QA checklist ticked before a report can be approved, an AI reviewer if the firm turns it on, and release waiting for approval. | Edit, review and approved stages, threaded comments, built-in checks and AI checks. When two people edit the same section, its documentation says the last to save wins. |
| Retests | Clients ask from the finding they are reading, or by closing a ticket in their own tracker. Every finding is tracked as fixed, still open or newly introduced. | A retest stage per audit type since February 2025: corrected, not corrected, partially corrected or not verifiable. |
| CVSS | CVSS 3.1 or 4.0, with the vector derived as you choose the metrics. | CVSS 3.1, and CVSS 4.0 since February 2026. |
| Findings library | Write-ups saved once and reused with their scoring and remediation intact. | A vulnerability library, exported as YAML, with Serpico’s format accepted on import. |
| Issue trackers | Clients connect their own Jira (Cloud or Data Center), ServiceNow, Azure DevOps, GitHub, GitLab or Linear, and the ticket’s state is read back; any other system can take findings by webhook. | None documented; Jira and Slack have been requested since May 2021. |
| Importing tool output | Sixteen formats imported as findings, including Nessus, Burp Suite, OpenVAS, Qualys, Nmap, ZAP, Nuclei and SARIF. | Nmap and Nessus port scans, into an audit’s scope only. |
| Pricing | Published: the Portal is £75 a tester a month for one ($99), falling with every tester added, with every feature included. Our reporting tool, the reporting on its own, is free and open source under the AGPL-3.0. | Free and open source, under the MIT licence. |
| Trying it | A free trial of the Portal with no card required, whose days start when your portal goes live. The reporting tool is free to download and run. | Download it from GitHub and run it with Docker. |
Facts about PwnDoc come from PwnDoc’s own documentation, its public source code, release notes, issue tracker, licence and security policy, read on 1 November 2026. Products change: if anything here is out of date, tell us and we will correct it. Product names are the trademarks of their owners, and Pental is not affiliated with any of them.
PwnDoc’s templates are written with docxtemplater tags and Angular expressions: rich text must be the only thing in its paragraph, editor content needs named styles, and bullet and numbered lists need the template’s numbering.xml edited in an archive manager. Its users have asked since 2021 to be told where a template broke. Pental fills your Word template from placeholders you place by clicking on the document, and brings your PwnDoc template across as it is: each placeholder becomes Pental’s, and you see what each became before it is saved.
PwnDoc produces Word documents, with no PDF and no client portal, and requests for other export formats and for Jira have been open since 2020 and 2021. Pental renders the built-in PDF or your own Word template, gives each client a white-labelled portal, and syncs findings both ways with your clients’ Jira, ServiceNow, Azure DevOps, GitHub, GitLab or Linear.
PwnDoc imports Nmap and Nessus port scans into an audit’s scope, and the most-commented issue in its tracker is an Nmap import that would not work. Pental imports sixteen formats as findings, including Nessus, Burp Suite, OpenVAS, Qualys, Nmap, ZAP, Nuclei and SARIF.
PwnDoc runs four containers, MongoDB 4.2 among them, and its release notes have asked users to re-save custom fields after one update and to move custom filters after another. Our free, open-source reporting tool installs with one command and, on Linux and macOS with automatic updates on, updates itself overnight, keeping your settings and your data as they are.
A PwnDoc audit’s JSON, a backup archive or its vulnerability library, YAML or JSON, goes in Coming from another platform, under Settings, Data. Pental reads it, shows you the mapping with real values from your own data beside each field, and lets you correct it before a single row is written. Audits, findings and their images come across, the library goes into your library, and observation, priority and complexity become finding fields of their own.
Your PwnDoc Word template comes too: choose its .docx under Coming from another platform, or upload it under Settings, Document Templates, in the Portal or our free reporting tool. Each placeholder becomes the Pental value that means the same, its loops and severity rows repeat where they did, a field’s text and pictures land where its block was, and the rest of the document stays exactly as you designed it. You see what each placeholder became before it is saved.
Pental fits a testing firm that wants its clients' findings in a database of its own, reports in its own Word template, a client portal under its own name and AI on its own key, with every feature included. See the pricing, or see the platform. For the reporting on its own, our free, open-source reporting tool runs on your own server.
What a report can be, and where it goes. PwnDoc fills a Word template written with docxtemplater tags and produces Word documents only. Pental fills your Word template from placeholders you place by clicking, renders PDF as well, gives each client a white-labelled portal and syncs findings with your clients’ issue trackers. Both have a free, open-source edition you run yourself.
Yes. PwnDoc is free and open source under the MIT licence, and you host it yourself with Docker and MongoDB. Our reporting tool is free and open source too, under the AGPL-3.0, installed with one command.
Its documentation describes Word reports only, and a request for other export formats has been open since October 2020. Pental renders the built-in PDF or your own Word template, and either can be delivered to the client through the Portal.
Yes. Choose its .docx under Coming from another platform, or upload it under Settings, Document Templates. Each placeholder becomes the Pental value that means the same, its loops and severity rows keep working, and you see what each became before it is saved. The client’s logo, which Pental does not keep, is listed and prints nothing.
A PwnDoc audit’s JSON, a backup archive or its vulnerability library goes in Coming from another platform, under Settings, Data. Pental reads it, shows you the mapping with real values from your own data beside each field, and lets you correct it before a single row is written. Your Word template goes in the same place, and comes across as it is.
Set up your own database, upload your own Word template and take a real engagement through it, client portal and all. A free trial of the whole Portal, no card required, and its days start when your portal goes live.