Skip to content
SPECIFICTION
Get listed

OWASP ZAP

zaproxy.org

Free plan Open source WindowsmacOSLinuxAPISelf-hostedBrowser extension
Visit zaproxy.org
Spec score 8.5 #3 of 29 in Web Application Security Scanners

What it is

OWASP ZAP is a web application scanner and proxy for security testing. Its tools include active and passive scanning, a spider, alerts, and scan policies. ZAP’s Automation Framework uses YAML plans to coordinate jobs such as scanning, spidering, API imports, and report generation. It can import OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons. GitHub Actions are available for baseline, full, and API scans via Docker-packaged scans, and the project publishes Docker images, including a minimal image for CI. Add-ons come from an online Marketplace and are generally installed or removed without restarting ZAP. The software is free and open source, with a free plan at free. It supports Linux, macOS, Windows, API use, and self-hosted deployment. Windows and Linux installers require Java 17 or later; the macOS installer includes Java 17. ZAP says it can support only its latest full release, and current releases are unsigned, though checksums are provided.

Spec sheet

What it does
ZAP is a web application security scanner and interception proxy for automated and manual testing.Read 15 Oct 2026 · zaproxy.org
Purpose
ZAP is a web application scanner and proxy for security testing.Read 29 Sep 2026 · zaproxy.org
Audience
ZAP says it is designed for developers, testers new to security testing, and security testing specialists.Read 29 Sep 2026 · zaproxy.org
Deployment
ZAP publishes Docker images, including a bare image described as minimal and ideal for CI.Read 29 Sep 2026 · zaproxy.org
API
The API and daemon mode provide programmatic control over ZAP, including scanner and spider operations.Read 15 Oct 2026 · zaproxy.org
Founded
2010Read 23 Sep 2026 · zaproxy.org
Active scanning
The feature set includes active scanning that sends attack requests to identify vulnerabilities.Read 15 Oct 2026 · zaproxy.org
Add-ons
Add-ons can be installed dynamically from the online Marketplace, and are typically added or removed without restarting ZAP.Read 29 Sep 2026 · zaproxy.org
API formats
The Automation Framework supports importing OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons.Read 29 Sep 2026 · zaproxy.org
Authentication
Authentication features include browser-based, script-based, header-based and OAuth2 methods through the Authentication Helper add-on.Read 15 Oct 2026 · zaproxy.org
Automation
The Automation Framework controls ZAP with a YAML plan and supports jobs including active scanning, passive scanning, spidering, API imports, and report generation.Read 29 Sep 2026 · zaproxy.org
Automation integrations
Automation options include Docker packaged scans, GitHub Actions, the Automation Framework, command line, ZAPit and API/daemon mode.Read 15 Oct 2026 · zaproxy.org
CI integration
ZAP provides GitHub Actions for baseline, full, and API scans through its Docker packaged scans.Read 29 Sep 2026 · zaproxy.org
Company fact: Checkmarx support
The official ownership page says three ZAP Core Team members are employed by Checkmarx to work on ZAP.Read 15 Oct 2026 · zaproxy.org
Company fact: OWASP Foundation
LinkedIn lists the OWASP Foundation as a Wilmington, Delaware nonprofit founded in 2001, with a stated company size of 2–10 employees.Read 15 Oct 2026 · linkedin.com
Current release
Release 2.17.0 is described as a bug-fix and enhancement release with alert deduplication, systemic alerts, an Insights tab and improved disk and memory handling.Read 15 Oct 2026 · zaproxy.org
Distribution security warning
The download page warns that releases are currently unsigned and that browsers or antivirus tools may flag them.Read 15 Oct 2026 · zaproxy.org
Documentation
The project publishes getting-started material, a desktop user guide, developer guide, API reference, automation documentation, videos and community resources.Read 15 Oct 2026 · zaproxy.org
Download security
The download page warns that current ZAP releases are unsigned and provides checksums for downloads.Read 29 Sep 2026 · zaproxy.org
Extensibility
The Marketplace distributes team and community add-ons, and users can publish their own add-ons.Read 15 Oct 2026 · zaproxy.org
Licence
The ZAP software package is open source under Apache License 2.0, with separately licensed third-party libraries.Read 15 Oct 2026 · github.com
Limit: documentation and interface
G2 feedback cites documentation gaps, cluttered or dated navigation and a lack of an integrated browser experience.Read 15 Oct 2026 · g2.com
Limit: false positives
G2 reviewers repeatedly report false positives that require manual validation or tuning.Read 15 Oct 2026 · g2.com
Limit: scan duration and documentation sprawl
Capterra reviewers report that large scans can take a long time, progress estimates can be inaccurate and documentation is spread across locations.Read 15 Oct 2026 · capterra.com
Notable news
On October 13, 2026, the project said it would continue accepting community contributions while requiring smaller, tested and easier-to-review pull requests, including LLM-assisted submissions.Read 15 Oct 2026 · zaproxy.org
Open source
ZAP describes itself as free and open source, and says anyone can contribute to the project.Read 29 Sep 2026 · zaproxy.org
OWASP relationship
The team removed ZAP from OWASP in September 2023 to obtain funding for continued maintenance, while remaining OWASP supporters.Read 15 Oct 2026 · zaproxy.org
Passive scanning
ZAP passively analyzes proxied traffic for security issues without attacking the application.Read 15 Oct 2026 · zaproxy.org
Praise: findings and installation
Capterra reviewers praise easy installation, understandable results, severity sorting, remediation guidance and broad testing features.Read 15 Oct 2026 · capterra.com
Praise: usability and automation
G2 reviewers repeatedly praise ease of use, automated scanning, spidering, reporting and CI/CD integration.Read 15 Oct 2026 · g2.com
Project governance
ZAP is an independent open-source project controlled by its Core Team and supported by Checkmarx.Read 15 Oct 2026 · zaproxy.org
Project status
ZAP says it has not been an OWASP project since August 2023 and identifies its current name as ZAP or ZAP by Checkmarx.Read 29 Sep 2026 · zaproxy.org
Proxy and interception
The desktop application provides a man-in-the-middle proxy, breakpoints, request editing and HTTP-session handling.Read 15 Oct 2026 · zaproxy.org
Rating on Capterra
5.0 out of 5 from 4 reviews.Read 15 Oct 2026 · capterra.com
Rating on Chrome Web Store
The ZAP by Checkmarx browser extension listing shows 986 users and does not display a star rating or rating count.Read 15 Oct 2026 · chromewebstore.google.com
Rating on G2
4.7 out of 5 from 12 reviews.Read 15 Oct 2026 · g2.com
Rating on GetApp
5.0 out of 5 from 4 reviews.Read 15 Oct 2026 · getapp.com
Rating on TrustRadius
7.3 out of 10 from 2 reviews.Read 15 Oct 2026 · trustradius.com
Release support
The download page says the ZAP team can support only the latest full release.Read 29 Sep 2026 · zaproxy.org
Reporting
Official report formats include HTML, JSON, XML, Markdown, PDF and SARIF variants.Read 15 Oct 2026 · zaproxy.org
Runtime requirement
The Windows and Linux installers require Java 17 or higher, while the macOS installer includes Java 17.Read 29 Sep 2026 · zaproxy.org
Scanner
ZAP provides active scanning, passive scanning, a spider, alerts, and scan policies.Read 29 Sep 2026 · zaproxy.org
Scripting
ZAP supports scripts and the Zest graphical security scripting language, with scripting documentation in the feature catalog.Read 15 Oct 2026 · zaproxy.org
Self-hosting
ZAP can run locally from platform installers, cross-platform packages or official Docker images.Read 15 Oct 2026 · zaproxy.org
Spidering
ZAP includes a traditional Spider and a JavaScript-capable AJAX Spider, with the newer Client Spider recommended for modern applications.Read 15 Oct 2026 · zaproxy.org
Supported desktop systems
Official downloads include Windows 64-bit and 32-bit, Linux, macOS Intel, macOS Apple Silicon and cross-platform packages.Read 15 Oct 2026 · zaproxy.org
System requirements
Windows and Linux packages require Java 17 or newer; the macOS installer bundles Java 17; weekly packages also require Java 17 or newer.Read 15 Oct 2026 · zaproxy.org
Third-party integrations
ZAP lists DefectDojo, Dradis, and Faraday among products and services that can import ZAP results.Read 29 Sep 2026 · zaproxy.org
Web protocols
The feature catalog lists WebSockets, Server-Sent Events, SOAP, GraphQL, gRPC and OpenAPI support.Read 15 Oct 2026 · zaproxy.org

Plans and prices

Free / open source Free full ZAP functionality · desktop, command line, Docker and API use Read 15 Oct 2026 · zaproxy.org
ZAP Free Free and open source · add-ons available in the Marketplace Read 29 Sep 2026 · zaproxy.org

Every OWASP ZAP plan and price →

Strong points and limits

Strong points

  • Active and passive scanning, spidering, alerts, and scan policies.
  • YAML automation supports scans, imports, and report generation.
  • GitHub Actions cover baseline, full, and API scans.
  • Free and open source, with Marketplace add-ons.

Limits

  • Windows and Linux installers require Java 17 or later.
  • Only the latest full release is supported.
  • Current releases are unsigned.

Who it suits

ZAP is designed for developers, testers who are new to security testing, and security testing specialists. Its automation and CI options also suit teams incorporating scans into development workflows.

Verdict

ZAP combines web application scanning with automation and CI options, and supports several API definition formats. Check installer requirements and release support before choosing it.

Where Specifiction places it

Alternatives to OWASP ZAPAll alternatives →