Uncensored LLMs on one key
An uncensored LLM is a model build whose refusals have been reduced by a weight edit or by tuning. PentestLLM hosts the abliterated builds and 9 security-tuned builds behind one prepaid key, each with its own per-token price and context window, for authorized security testing.
from openai import OpenAI
client = OpenAI(base_url="https://api.pentestllm.ai/v1", api_key="sk-ptl-live-…")
reply = client.chat.completions.create(
model="auto/security",
messages=[{"role": "user", "content": "Explain this advisory and list what to check on an affected host."}],
)
print(reply.model) # the build that answered
print(reply.choices[0].message.content)
The builds behind the word
- Security-tuned
- Trained on security material. Answers in the vocabulary of the field and is the default for testing work. 9 are listed on 2026-11-12.
- Abliterated
- A general model with its refusal direction projected out of the weights. Keeps the base model’s knowledge and style.
- Heretic and derestricted
- Refusal removal done with more care for side effects. The gateway tags these abliterated, and some carry the word uncensored in the id.
Those are the kinds listed here. The table at the foot of this page is read from the live catalog, so a build that is added or retired shows up there without this text changing.
There is no single best uncensored LLM
- Context window
- A full scan export or a large source file needs room. The largest security build takes 1M tokens; smaller builds are usually quicker and cost less.
- Tool calling
- An agent needs a build that takes tool calls. Some builds do and some do not, and each model page says which.
- Reasoning
- Some builds expose a reasoning mode. It helps with multi-step analysis and spends more output tokens.
- Price
- Input and output are priced separately per million tokens. A triage job that reads a lot and writes little is mostly input cost.
Searches for the best uncensored LLM assume one winner. In practice the right build depends on the request, and the four columns above decide it. A build that is ideal for ranking a scan export can be the wrong one to drive an agent.
Comparing uncensored LLMs on your own work
Every build answers the same endpoints on the same key, so a comparison is a loop over model ids. Take five requests that represent your week: a scanner export to rank, an advisory to explain, a diff to review, a finding to write up, a detection rule to draft. Send each to three builds and read the answers for the things that matter to you. Did it start on the answer? Did it get the facts right? Did it keep to the format you asked for?
A non-streamed response carries its settled charge in the x-uplink-charge header, so the same loop tells you what each build costs on your own inputs. That figure is more useful than any ranking, because it reflects your prompts and your output lengths.
Or let the router choose
If you would sooner not pick, send auto/security. The router reads what each request carries and sends it to a fast, balanced or frontier security build, billed at that build’s price with no router fee. The response names the build that answered, which is also a quick way to learn which builds suit which requests. The auto router page describes the tiers.
One key, prepaid, for authorized work
There is one key for all of it. The balance is prepaid from $10 by card, there is no subscription, and a request that would overdraw the balance is refused, not billed. The key is sold for lawful security work on systems you own or have written permission to test. The acceptable use policy applies to every build, and reduced refusals do not widen it.
If your interest is pentest work specifically, uncensored LLMs for pentesting goes deeper on agent loops. For the difference between the labels, read abliterated vs uncensored.
74 uncensored and abliterated builds, priced per token
Read from the live catalog on 2026-11-12. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
Questions
A language model build whose refusal behaviour has been reduced, by editing the weights or by further training. It answers questions a stock model declines and is otherwise an ordinary model.
It depends on the request. For security questions start with the security-tuned builds through auto/security. For general coding or writing with a security subject, an abliterated build of a strong base model is usually the better fit.
The table on this page is the live count. On 2026-11-12 there are 9 security-tuned builds, and the abliterated builds are listed beside them on the models page.
Some do. Tool calling depends on the build, and each model page lists the request parameters that build supports.
Not here. The builds run behind the API and are billed per token. You need a key, the base URL and a model id.
Yes. Refusals are reduced, not removed, and different builds decline in different places. If one build declines a legitimate request in scope, the same request can go to another build on the same key.
Read next
- Uncensored LLM APIThe endpoints, wire formats and per-token billing behind the uncensored builds.
- Abliterated modelsHosted abliterated builds by API, with no weights to download or GPU to rent.
- Abliterated vs uncensoredThe difference between abliterated, uncensored, derestricted and security-tuned builds.
- Uncensored LLM for pentestingWhat abliterated and security-tuned builds change for authorized penetration testing.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60