GPT-SoVITS is a text-to-speech system that learns a voice from very little audio. Give it a five-second sample and it can speak new text in something close to that voice straight away; fine-tune it on about a minute of clean recordings and the likeness improves a lot. It speaks Chinese, English, Japanese, Korean and Cantonese, and can speak a language the sample was not recorded in.
It is built for people who are not ML engineers. A browser interface walks through the whole job: separating a voice from background music, slicing recordings into clips, transcribing them, correcting the labels, training, and then generating speech. Windows users can download an all-in-one package and double-click to start. The newest models, v2 ProPlus and v5, are fast enough to generate about four minutes of speech in a few seconds on a recent NVIDIA card.
It is MIT-licensed, with about 63,200 stars and 101 contributors, and is one of the most used open voice cloning tools for dubbing, game mods, audiobooks and video narration. The last tagged release is from June 2025, but the code is updated continuously, with the v5 models added in 2026.
- Repository: github.com/RVC-Boss/GPT-SoVITS
- Licence: MIT (MIT License)
- Language: Python. Stars: 63.2K. Forks: 6,712. Last push: Oct 18, 2026.
- Scan: safe, Oct 19, 2026, commit 1d9fe63
Who it is for
Creators who want narration or dubbing in their own voice, game and animation hobbyists, and developers who need a local TTS engine they can fine-tune, with an NVIDIA GPU or an Apple Silicon Mac.
Getting started
1. Clone the repository
git clone https://github.com/RVC-Boss/GPT-SoVITS.git && cd GPT-SoVITS2. Create a Python 3.10 environment
conda create -n GPTSoVits python=3.10 && conda activate GPTSoVits3. Install for your hardware (CU126, CU128, ROCM, MPS or CPU) and download the models
bash install.sh --device CU128 --source HF4. Start the web interface
python webui.pyOn Windows, the integrated package linked from the README is the easiest route. The installer downloads PyTorch and several gigabytes of pretrained models from Hugging Face or ModelScope.
Safety scan
We cloned RVC-Boss/GPT-SoVITS at commit 1d9fe63 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no bare-IP URLs across 282 files and about 62,000 lines of Python.
- The one committed binary is cudart64_12.dll, NVIDIA's CUDA runtime library, added in October 2026 with the CUDA graph acceleration code for Windows. It is a standard NVIDIA redistributable, but it is a prebuilt file you are trusting the maintainers to have copied unchanged.
- install.sh and install.ps1 (about 380 and 240 lines, no sudo) create nothing outside the project: they pip and conda install packages and download models from PyTorch, Hugging Face, its hf-mirror.com mirror and ModelScope.
- webui.py starts its Gradio interface on 0.0.0.0, so anyone on the same network can reach it while it runs. A public Gradio share link is off unless you turn it on. Use it on a trusted network or a firewall-protected machine.
- The requirements files list version ranges rather than exact pins, so there were no dependency advisories to look up. 2 workflows, none using pull_request_target; none of the 10 third-party actions is pinned to a commit. Licence present; no security policy, contributing guide or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 3 installer scripts |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 2 workflows. None use pull_request_target. 10 of 10 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 25 distinct hosts referenced from source; most often github.com, huggingface.co, www.apache.org, www.modelscope.cn. No URLs to bare IP addresses. |
| Known vulnerabilities | 0 advisories across 3 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. requirements-py312-win-flash_attention/requirements_py312_win_cu118_china.txt: 1 packages, 0 advisories; requirements-py312-win-flash_attention/requirements_py312_win_cu118_overseas.txt: 1 packages, 0 advisories; requirements-py312-win-flash_attention/requirements_py312_win_cu128_china.txt: 1 packages, 0 advisories; requirements-py312-win-flash_attention/requirements_py312_win_cu128_overseas.txt: 1 packages, 0 advisories; requirements.txt: 1 packages, 0 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (3)
- Docker/install_wrapper.sh, 34 lines
- install.ps1, 242 lines; talks to download.pytorch.org, hf-mirror.com, huggingface.co, www.modelscope.cn
- install.sh, 383 lines; talks to download.pytorch.org, hf-mirror.com, huggingface.co, www.modelscope.cn
Committed binaries (1)
GPT_SoVITS/Accel/vendor/cuda/bin/cudart64_12.dll: PE (Windows executable), 574 KB
By the numbers
| Stars | 63.2K |
|---|---|
| Forks | 6,712 |
| Contributors | 101 |
| Commits | 1,064 |
| Open issues | 797 |
| Open pull requests | 103 |
| Releases | 4 |
| Latest release | 20250606v2pro |
| Licence | MIT |
| Main language | Python |
| Project age | 2 years |
| Last push | Oct 18, 2026 |
| Tracked files | 282 |
| Lines of code | 62.3K |
| Checkout size | 37 MB |
Lines by language: Python 50K, Markdown 6,797, JSON 3,362, YAML 741, Shell 584, PowerShell 445.
Questions
Is GPT-SoVITS free?
Yes. The code is MIT-licensed and the pretrained models are free to download. Running it needs your own hardware, ideally an NVIDIA GPU; it also runs on Apple Silicon and on CPU, much more slowly.
Is it legal to clone someone's voice with GPT-SoVITS?
Cloning your own voice, or one you have permission to use, is fine. Using someone else's voice without consent can break laws on likeness, fraud and impersonation in many places, and platforms often require AI voices to be labelled. The tool does not check; that is on you.
How much audio do I need?
About five seconds for zero-shot cloning, which gives a rough likeness. For a convincing voice, fine-tune on around a minute or more of clean speech with no music or background noise; the built-in tools help separate and slice it.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.