Software · pricing
OWASP ZAP pricing
OWASP ZAP publishes a single tier. Below is what it costs, what it covers, and how that compares with the software tools listed alongside it.
- Entry price
- Free
- Model
- Free
- Tiers
- 1
- Free tier
- Yes
OWASP ZAP plans, side by side
Every published tier in ascending order of price, with the number of features each one lists. An absence here means the record does not itemise it, not that the tier lacks it.
| Plan | Price | Features listed | Step up from the tier below |
|---|---|---|---|
| Free & Open Source | Free | 6 | Entry tier |
Where OWASP ZAP stops being free
Free & Open Source, Free
- Full functionality
- Active & passive scanning
- Spider
- Fuzzer
- API support
- Extensions marketplace
No paid tier on record
OWASP ZAP lists a free tier and no priced tier above it in the record we hold.
What the product covers
The full OWASP ZAP feature record, grouped as the catalogue groups it. This is the product as a whole; the record does not map every feature onto a specific tier.
Core
- Active scanner
- Passive scanner
- Spider/crawler
- Fuzzer
- Forced browse
- WebSocket testing
- AJAX spider
- Authentication support
- API scanning
Integrations
- Jenkins
- GitHub Actions
- GitLab CI
- Azure DevOps
- Docker
- Kubernetes
Security
- OWASP Top 10
- CWE mapping
Deployment
- On-premise deployment
- Docker deployment
Platform
- Desktop support
- Cli support
- Api support
Localization
- English language support
- Portuguese language support
- Spanish language support
- French language support
- German language support
- Japanese language support
- Chinese language support
- Korean language support
People bring OWASP ZAP in for penetration testing, web security, open source. If that is not the job you are buying for, the alternatives to OWASP ZAP are worth a look before you commit to a tier.
Before you pay for OWASP ZAP
Three things this page cannot tell you, and all three change the bill. The record carries a price and a billing period but not the unit - per-seat and flat-rate pricing are indistinguishable in this data, so a five-person team may be looking at five times the figure above. It carries no annual rate, so any discount for paying yearly is not something this page can quote. And it carries no trial length.
What it can tell you is the shape of the ladder: a single tier at Free. Because there is a free tier, the cheapest way to answer the rest is to use it before paying anything.
OWASP ZAP runs on desktop, cli, api, and is published by OWASP Foundation of Global (Non-profit). The full record is on the OWASP ZAP review.
OWASP ZAP pricing questions
- How much does OWASP ZAP cost?
- OWASP ZAP publishes a single tier, Free & Open Source, at Free.
- Does OWASP ZAP have a free plan?
- Yes. The Free & Open Source tier costs nothing and covers full functionality, active & passive scanning, spider.
- What am I actually paying for with OWASP ZAP?
- The record lists 30 features across 6 areas: core, integrations, security, deployment, platform, localization. In practice it is brought in for penetration testing, web security, open source.
- Does OWASP ZAP charge per user?
- The record carries a price and a billing period for each of its 1 tiers, but not the unit that price is charged in. Per-seat and flat-rate billing look identical in this data, so check the vendor's page before budgeting for a team.
- Are these OWASP ZAP prices current?
- They are what the catalogue entry holds, refreshed when the entry is. Vendors change pricing without notice and nobody at Softwr re-verifies each tier by hand, so treat this as a structured summary and the vendor's own pricing page as the authority.
- What should I compare OWASP ZAP against before paying?
- Nothing else in this directory is filed close enough to OWASP ZAP to make a useful price comparison.