Burp Suite Community Edition
Burp Suite Community Edition is PortSwigger's free toolkit for inspecting web traffic: an intercepting proxy and related tools that let you see and edit the HTTP requests a browser sends to a web application. It pairs with PortSwigger's free Web Security Academy, whose labs are the legal place to learn with it.
Tool
Web Development
PortSwigger
Beginner
Free
What it is
Burp Suite Community Edition is the free edition of PortSwigger's Burp Suite. At its heart is an intercepting proxy that sits between your browser and a web application, so you can see every request and response and understand how the application really behaves. Alongside the proxy it includes tools for resending a single request with small changes (Repeater), converting data between encodings (Decoder) and comparing two responses (Comparer). It also ships with a built-in browser that is already configured to use the proxy.
Why developers and testers learn it
Most web security problems come down to an application trusting input it should not. Watching real traffic through a proxy makes that concrete: you see cookies, headers, hidden form fields and API calls that the page never shows. Web developers use it to debug and to understand their own applications, application security engineers use it when reviewing features, and authorised penetration testers and bug bounty hunters use it as their everyday workbench.
Where to practise legally
PortSwigger's free Web Security Academy (portswigger.net/web-security) is the natural companion. It has written lessons and deliberately vulnerable labs that PortSwigger hosts for you to test, covering the main vulnerability classes in web applications. OWASP Juice Shop, running on your own machine, is another good target.
Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. Using Burp against a website without permission can be illegal even if nothing breaks.
Free versus paid
Community Edition is free with no time limit and is enough to learn the fundamentals and complete the Web Security Academy labs. Burp Suite Professional is a paid edition that adds automated scanning, faster tooling and saved projects for professional work. Check PortSwigger's pricing page for current Professional pricing; you do not need it to learn.
Prerequisites and time needed
Understanding how HTTP works (methods, status codes, headers, cookies) makes the tool click much faster. Getting comfortable with the proxy and Repeater takes an afternoon; working through the Academy's apprentice level labs takes a few weeks of evenings.
What you can do afterwards
You will be able to read and reason about any web application's traffic, explain what a vulnerability report actually shows, and review your own projects for common mistakes. For developers, that alone improves the code you ship.
Common questions
Is Community Edition enough to start? Yes. Almost everyone starts on it.
Does it run on Windows, macOS and Linux? Yes, PortSwigger provides installers for all three.
Should I also learn ZAP? It is worth knowing both. ZAP is a free, open source alternative with automated scanning included.
Ready to start?
Opens on PortSwigger in a new tab.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.