Open Source v2.17.0 ✓ Checksum Published

Download OWASP ZAP for Windows PC v2.17.0 for Windows PC

Name: OWASP ZAP for Windows PC
Availability: InStock
Author: OWASP

OWASP ZAP is a free, open source web application security scanner from the Open Worldwide Application Security Project, used by developers and security...

⬇ Direct Download (244.2 MB)

Technical Specifications & System Requirements

Developer OWASP

Platform & OS Windows 10 / 11 (64-bit)

Package Size 244.2 MB

Architecture x64 (64-bit)

Package Format EXE Installer

Security Verification SHA-256 checksum published

SHA-256 Cryptographic Checksum Computed from the file we serve

              ebdaf6f00ffd9c21891d29360196e13a14091f84dde2bfa1e0b61213a93bc5ca
            

              $ Get-FileHash .\owasp-zap-security-scanner-pc.exe -Algorithm SHA256
            

Software notes

The Bottom Line: ZAP rewards patience: point its spider at a test site, browse through the proxy so it learns your application, then run the active scan and it surfaces real issues like cross-site scripting, SQL injection risks, and missing security headers with clear evidence and remediation advice. For developers, the passive scanner alone is valuable, flagging problems quietly as you test manually without attacking anything. Reports are detailed enough to act on without hiring a consultant. It is not a push-button answer machine, however. First scans produce false positives and low-priority noise that you must triage with judgment, and the dense interface assumes you understand HTTP, sessions, and authentication. Active scanning must only ever be run against applications you own or have explicit permission to test, and tuning authenticated scans takes real setup time. Given a safe staging environment and a little follow-up reading, its findings map directly onto fixes most web developers can understand, prioritize, and verify themselves afterwards.

Features

It is completely free and open source under Apache 2.0, maintained by OWASP, giving individuals and small teams professional-grade scanning without any commercial license costs or per-scan fees whatsoever.
The intercepting proxy records your real browsing sessions, so ZAP learns authenticated and complex application flows that simple crawlers would never reach on their own.
Passive scanning flags vulnerabilities and misconfigurations automatically while you browse, with zero attack traffic, making it safe to use continuously during normal development testing.
The automation framework and Docker images let you run baseline scans in CI pipelines, catching new vulnerabilities every time code is deployed automatically.
A large marketplace of free add-ons extends scanning rules, authentication helpers, and reporting formats, so the core tool grows with your security testing needs.

Considerations

Scan results include false positives and informational noise that require security knowledge to triage, so beginners cannot treat every alert as a confirmed vulnerability.
The interface is dense and terminology-heavy, with a steep learning curve for developers who have no prior background in web security testing concepts.
Scanning authenticated applications properly requires configuring login, session handling, and context settings manually, which can take considerable time before results become trustworthy.

About & Overview: OWASP ZAP for Windows PC

OWASP ZAP is a free, open-source web application security scanner from the Open Worldwide Application Security Project, used by developers and security professionals to find vulnerabilities in their own apps. It combines an intercepting proxy, passive and active scanners, a spider for crawling sites, a fuzzer, and API scanning, with hundreds of add-ons available through its built-in marketplace.

How to Install & Verify OWASP ZAP for Windows PC

STEP 1

Download the installer

Download OWASP ZAP from the official vendor link on this page.

STEP 2

Run the setup

Open the downloaded installer file and follow the on-screen installation steps.

STEP 3

Launch the app

Start OWASP ZAP from the Start menu or desktop shortcut.

Related Windows PC Software & Alternatives

XAMPP for Windows PC 8.2.12 • Open Source

Git for Windows 2.56.0.windows.2 • Open Source

VSCodium 1.140.06880 • Open Source

Eclipse IDE for Windows PC 2026-09 • Open Source

Python 3.15.0 • Open Source

Notepad++ 8.9.8.1 • Open Source

Frequently Asked Questions & Verification Guide

Is OWASP ZAP really free, even for commercial use?

Yes. ZAP is free and open source under the Apache 2.0 license, including for commercial use. It is maintained by the Open Worldwide Application Security Project and a community of contributors.

Is it legal to scan a website with ZAP?

Only scan applications you own or have explicit written permission to test. Running active scans against other people's sites without authorization may be illegal and can also disrupt their service.

What is the difference between passive and active scanning in ZAP?

Passive scanning only inspects traffic passing through the proxy and sends no attacks, so it is safe anywhere. Active scanning deliberately sends crafted requests to probe for vulnerabilities like XSS and SQL injection.

Can ZAP scan APIs as well as websites?

Yes. ZAP can import OpenAPI, SOAP, and GraphQL definitions and scan APIs, and its automation framework supports repeatable API security testing in development pipelines.

Can ZAP run automatically in CI/CD?

Yes. ZAP provides Docker images and an automation framework for headless baseline and full scans, so teams commonly run it in CI to fail builds when new high-risk alerts appear.