ZAP
Free, open-source web app security scanner and intercepting proxy, formerly OWASP ZAP.
- Verified facts
- 4 of 4
- Alternatives ranked
- 4
- Approved reviews
- 0
- Visits sent from here
- 0
About ZAP
ZAP (Zed Attack Proxy) is a free, open-source tool for finding security holes in web applications. Like Burp Suite, it works as an intercepting proxy between your browser and the site, letting you inspect and modify requests, and it adds spiders, an active scanner, fuzzing and a passive scanner that flags issues as you browse. Unlike Burp's free edition, the automated scanner is included at no cost. It began as an OWASP project and is now run by its core team with sponsorship from Checkmarx, under the Apache 2.0 licence. ZAP is a Java desktop app with installers for Windows, Linux and macOS, plus Docker images and an automation framework that make it common in CI pipelines. Extra features come from add-ons in the ZAP Marketplace. It suits developers and security teams who want automated scanning without licence costs, though its interface feels dated next to commercial tools.
Best for: Developers and AppSec teams who want free automated web scanning, including in CI.
Pros and cons
What works
- Free and open source, with the automated scanner included
- Docker images and automation framework for CI pipelines
- Add-on marketplace extends it
Why people leave
- Interface is dated and busier than Burp or Caido
- Windows and Linux builds need Java 17 or newer installed
- Releases are unsigned, so operating systems show warnings on install
Top ZAP alternatives
See all 4- 1
Burp Suite66.5The industry standard, with a more polished UI and a stronger paid scanner.
- 2
Caido62.6Modern, fast web proxy with a cleaner interface and a free tier.
- 3
mitmproxy52.6Lightweight, scriptable proxy for testers who mostly inspect and modify traffic.
- 4
Tenable Nessus40.0Scans hosts and networks for missing patches and known CVEs, not just web apps.
Why people left ZAP
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from ZAP, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of ZAP
ZAP: common questions
Is ZAP free?
Yes. ZAP is free, open-source software.
Is ZAP open source?
Yes. The source code is on GitHub at zaproxy/zaproxy.
What platforms does ZAP run on?
ZAP is available for Windows, macOS and Linux.
What are the best alternatives to ZAP?
The highest-ranked ZAP alternatives right now are Burp Suite, Caido and mitmproxy. See the full ranked list for pricing, platforms and verified facts.