Download Burp Suite Community Edition for Windows PC v2026.10 for Windows PC

Burp Suite Community Edition 2026.10 by PortSwigger is the free web-security testing toolkit: an intercepting proxy, Repeater, Decoder and a throttled...

Features

• The intercepting proxy with its pre-configured built-in Chromium browser makes capturing, holding and modifying live HTTP and HTTPS traffic straightforward from the first launch.
• Repeater, Decoder, Comparer and Sequencer are included in full, giving free users the same manual request-testing toolkit that professionals use daily.
• It is free without a time limit or feature trial, so students and developers can learn the industry-standard workflow and test their own applications at no cost.
• The BApp Store adds community-built extensions inside the free edition, covering extras such as advanced logging and token editing without leaving the tool.
• Target scope and site-map tools help you define exactly which hosts you are authorised to test and keep unrelated browser traffic out of your history.

Considerations

• There is no automated vulnerability Scanner or Burp Collaborator in Community Edition, so every check is manual and blind out-of-band issues are easy to miss.
• Intruder is deliberately throttled in the free edition, which makes large wordlist or fuzzing attacks painfully slow compared with Professional's unthrottled speed.
• Community Edition cannot save projects to disk, so your proxy history, site map and notes are lost when you close Burp, unlike Professional's persistent project files.

Burp Suite's centrepiece is an intercepting proxy between your browser and a target web application — Burp includes its own pre-configured Chromium browser — so every request and response can be inspected, held, modified and forwarded. It remains the clearest way to understand what a web application is really doing: log in with the built-in browser, watch the actual requests appear, hold one, change a price, an ID or a cookie, and forward it to see what the server accepts. Target scope and site-map tools help you define exactly which hosts you are working on. Burp is for systems you own or are explicitly authorised to test — your own applications, deliberately vulnerable practice labs, training platforms, or live sites covered by a bug-bounty or penetration-testing agreement that includes them in scope.

The manual testing tools are included in full. Repeater turns curiosity into methodical testing — edit and re-send individual requests and watch the responses. Decoder handles encoding, decoding and hashing, Comparer diffs responses, and Sequencer analyses session-token randomness. The BApp Store lets you add community extensions inside the free edition, for tasks like JWT editing and extra logging. Since version 2026.4, PortSwigger ships one combined desktop installer for both editions — the edition is chosen at launch, so select the option to continue with Burp Suite Community Edition and the free edition runs. Community Edition 2026.10 is free without a time limit, with no trial clock — for students, developers checking their own applications and bug-bounty beginners working inside a programme's scope, this free edition teaches the real professional workflow, not a toy version of it.

What Professional keeps is specific. There is no automated vulnerability Scanner and no Burp Collaborator for out-of-band detection, so every check is manual and blind out-of-band issues are easy to miss. Intruder is deliberately rate-limited — throttled to roughly a request per second — so large fuzzing jobs crawl compared with Professional's unthrottled speed. And Community Edition cannot save projects to disk, so your proxy history, site map and notes are lost when you close Burp, which hurts on multi-day engagements — Professional itself is a paid per-user annual licence. Treat Community as the excellent free learning and manual-testing edition it is, and budget for Professional the moment your testing becomes paid, deadline-driven work. It needs Windows 10 or later (64-bit), 4 GB of RAM (8 GB recommended) and 2 GB of space.

Download the official Burp Suite 2026.10 Windows x64 installer (EXE, about 417 MB) from PortSwigger using the download button on this page — since 2026.4 this single installer serves both Community and Professional editions, so there is no separate Community file to look for.

Open the downloaded EXE and follow the installation wizard with the default options; Burp Suite is self-contained and bundles its own Java runtime, so no separate JDK install is needed.

Start Burp Suite, and on the opening screen choose to continue with Burp Suite Community Edition, then open a temporary project and launch Burp's built-in browser — visit a site you own or a practice lab and watch its traffic appear under Proxy > HTTP history to confirm the proxy is working.

Is Burp Suite Community Edition for Windows PC free?

Yes. Burp Suite Community Edition for Windows PC is freeware, so it is free to download and use at no cost. It is proprietary software from PortSwigger rather than open source, so its source code is not publicly available.

Can I use Burp Suite for free?

Yes. Burp Suite Community Edition is free without a time limit: since version 2026.4, PortSwigger ships one combined desktop installer, and the edition is chosen at launch — select 'Continue with Burp Suite Community Edition' and the free edition runs with no licence key. The manual tools (Proxy, Repeater, Decoder, Comparer, Sequencer) are included in full.

Is using Burp Suite legal?

Only against systems you own or are explicitly authorised to test — your own applications, deliberately vulnerable practice labs, training platforms, or live sites covered by a bug-bounty or penetration-testing agreement that includes them in scope. Intercepting or testing other people's systems without permission can be a criminal offence; use Burp's target scope settings to restrict testing to the hosts you are authorised for.

What is Burp Suite community edition?

It is the free edition of PortSwigger's web application security testing platform, built around an intercepting proxy — Burp includes its own pre-configured Chromium browser — so every request and response can be inspected, held, modified and forwarded. Community deliberately leaves out the automated Scanner and Burp Collaborator, throttles Intruder to roughly one request per second, and cannot save project files to disk.

How much does Burp Suite cost?

Community Edition costs nothing and has no trial clock. Professional — which adds the automated Burp Scanner, Burp Collaborator, unthrottled Intruder and saving projects to disk — is a paid per-user annual licence sold by PortSwigger, and the same installation is unlocked by entering the licence, with no reinstall.

What are the main reasons people use Burp Suite?

To see and control what a web application is really doing: capture live HTTP and HTTPS traffic in the proxy, hold a request, change a value such as a price, an ID or a cookie, and forward it with Repeater to see what the server accepts. Developers use it to check their own applications, students to learn the professional workflow, and bug-bounty hunters to test programmes inside their authorised scope.