Integrated penetration testing tool for finding vulnerabilities in web applications
Publisher’s description
What is zaproxy?
zaproxy is open-source Windows software in the package managers & updaters category. It is written in Java.
Installation and requirements
The publisher provides Portable installers for Any CPU Windows. It runs without installation (portable).
Popularity and file types
The source code on GitHub (zaproxy/zaproxy) has 15,993 stars. Similar programs include Chocolatey, NuGet and uv.
Project description on GitHub: “The ZAP by Checkmarx Core project”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Portable: runs without installation
- Large user base
In short: zaproxy is an open-source package managers & updater tool for Any CPU PCs.
Is zaproxy safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
94C8F767B1C2E94F0DB66B3AE56514D5E3F5A728EE1B6C798E0C8FE2D61FBFF0· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Security practices (OpenSSF Scorecard)
Automated checks of the zaproxy/zaproxy repository on GitHub by the Open Source Security Foundation, last run on October 19, 2026.
- Actively maintained10
- Code review10
- No dangerous workflows10
- Security policy10
- Licence declared10
- Static code analysis10
- Published packages10
- No binaries in the repository9
- OpenSSF Best Practices badge5
- Pinned dependencies4
- Restricted token permissions0
- Fuzzing0
- Signed releases0
The score rates how the project is developed and released, not whether the program is safe to install. scorecard.dev
Recent versions
All 1 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 2.17.0Latest | — | Any CPU ZIP |
Install from the command line
Silent install ›scoop install extras/zaproxyProgram files (.exe): zap.exe
Related guide: How to use winget: install and update apps
Information
- Category
- Package managers & updaters
- Licence
- Apache-2.0
- Price
- Free
- Source code
- github.com/zaproxy/zaproxy
- Written in
- Java
- Requires
- Windows 11 / 10
- Architecture
- Any CPU
- Installer
- Portable
- Version
- 2.17.0
- Versions listed
- 1
- GitHub stars
- 15,993
- GitHub forks
- 2,672
- Website
- zaproxy.org
- Scoop package
- extras/zaproxy
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to zaproxy
See all ›-
Chocolatey2.7.4.0Chocolatey is The Package Manager for Windows. It was designed to be a decentralized framework for quickly installing applications and tools that you need. It is built on the NuGet infrastructure and uses PowerShell as its focus for delivering packages.Open source386.2M ↓ -
Open source2.6M ↓ -
Open source183K ↓ -
Conan Package Manager2.33.0An open source, decentralized C/C++ package manager, to automate building and sharing of packages.Open source257.3K ↓ -
Open source78.1K ↓ -
Open source3.9K ↓ -
Open source9.8K ↓ -
Open source15K ↓
Frequently asked questions
Is zaproxy free?
Yes. zaproxy is open-source software under the Apache-2.0 licence.
Is zaproxy safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
Does zaproxy run on ARM (Windows on Arm)?
The installer is architecture-neutral.
Can I use zaproxy without administrator rights?
Yes, it is portable: unpack and run it.
