Why OWASP ZAP?
ZAP is an open-source web security proxy and scanner for HTTP/HTTPS inspection, manual application testing and automation workflows. It includes beginner-friendly quick starts and automation options for DevSecOps teams. Use it only on applications you own or are authorized to test.
Trusted download
Use the Official download button on this page. IROSG does not mirror installers, so the current package, checksum and signature remain under the vendor/project’s control.
Responsible use
For analysis, scanning and penetration-testing applications, a clearly authorized scope is part of the technical workflow. Validate configuration and behavior in a lab before production use.
