Overview

OWASP ZAP is a self-hosted web application scanner and proxy for security testing, aimed at developers, testers new to security work, and security specialists. Its strongest case is broad, configurable scanning and automation at no software cost; its self-hosted setup and Java requirement on Windows and Linux make it less suitable for teams seeking a managed service.

Key features

Scanning and traffic inspection

Active and passive scanning, a spider, alerts, and scan policies cover discovery and assessment in one tool. The spider helps find application paths, passive scanning checks observed traffic, and active scanning sends tests to the application.

Add-ons and automation

ZAP’s online Marketplace lets users install add-ons dynamically, typically without restarting. This makes it practical to tailor the tool as needs change, though a team must still manage its own setup.

The Automation Framework runs from a YAML plan and supports active and passive scans, spidering, API imports, and report generation. It can import OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons. GitHub Actions support baseline, full, and API scans through Docker-packaged scans, and a minimal Docker image is available for CI. These options make ZAP a credible fit for repeatable pipeline checks, not just interactive use.

Deployment and project status

ZAP is self-hosted and publishes Docker images. Windows and Linux installers require Java 17 or higher; the macOS installer includes Java 17. The download page says the team can support only the latest full release, and warns that current releases are unsigned while providing checksums. Users should verify downloads against those checksums.

ZAP says it has not been an OWASP project since August 2023 and identifies its current name as ZAP or ZAP by Checkmarx. This is worth knowing when seeking current project information or support. Products and services including DefectDojo, Dradis, and Faraday can import ZAP results.

Pricing

ZAP is free and open source, and anyone can contribute. Its ZAP plan costs 0.00 USD per free and includes access to the Marketplace add-ons. There is no paid tier or trial described; the trade-off is that ZAP is self-hosted rather than a hosted service, so it suits users prepared to handle deployment and upkeep.

Platforms

ZAP supports Linux, macOS, Windows, API workflows, and self-hosted deployment. The platform range accommodates desktop and pipeline use, but the Java requirement on Windows and Linux adds a setup consideration that macOS users avoid because its installer includes Java 17.

Who it's for

ZAP is a strong choice for developers and testers learning application security, as well as specialists who want configurable scans and automation without software fees. API testing, authenticated scanning, browser-based scanning, and CI/CD integration broaden its use across application testing workflows. It is a weaker fit for organizations that want a vendor-managed scanner or support across older full releases.

Pros and cons

Pros: Free and open source, with Marketplace add-ons that can usually be installed or removed without a restart.
Pros: YAML-driven automation, Docker scans, and GitHub Actions support make repeatable CI checks practical.
Pros: Imports OpenAPI, GraphQL, SOAP, and Postman definitions, supporting varied API workflows.
Cons: Self-hosted deployment means users must manage the runtime and environment themselves.
Cons: Windows and Linux installers require Java 17 or higher, and only the latest full release is supported by the team.
Cons: Current releases are unsigned, so users need to verify downloads with checksums.

Alternatives

For a different option, compare Dynamic Application Security Testing Software, Web Application Security Scanners, and Penetration Testing Software.

Beagle Security may suit readers who want a freemium option with a defined free allowance: one lite test per month, monthly surface scan reports, and SSL and domain-expiry monitoring. Its Essential plan is 99.00 USD per month, billed Billed $1188 annual.
Veracode DAST is a paid alternative with a free trial and a live-demo option for web applications and APIs.
Bright Security DAST is a paid alternative that offers a demo request.
Tenable One Attack Surface Management is a paid alternative with demo or quote requests.
Detectify Surface Monitoring is a paid web platform that also has a free plan.
Rapid7 Surface Command is a paid option with a free trial, focused on asset discovery, unified inventory, and internal and external attack-surface visibility.
Safeguard DAST is a freemium web option with a free plan.
Wapiti is another free option for Windows, macOS, and Linux.

Verdict

Choose ZAP if you want a free, adaptable web application scanner with API coverage and automation that can fit into CI. Its main advantage is the combination of scanning depth and extensibility without a software charge; look elsewhere if you need hosted deployment or do not want to maintain a Java-based setup on Windows or Linux.

	OWASP ZAP	w3af
Free plan	Yes	No
Free trial	No	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Windows	Linux, macOS
Free plan	Yes	Yes
API testing	Yes	Yes

OWASP ZAP vs w3af

OWASP ZAP

w3af