ZAP
Test authorised web applications with an extensible intercepting proxy and scanner.
What’s included for free?
ZAP Core is ongoing-free under Apache-2.0 with no provider scan quota; add-ons and compute run locally.
Where it runs: Self-hosted
Provider information ↗Checked 2026-11-01
Before you use it
Apache-2.0 covers the core project. Add-ons, test targets and captured data have separate terms and permissions.
Provider terms can change. Check current pricing and usage rights before starting a project.