Here’s a clean, step-by-step guide to install the latest OWASP ZAP on any OS, plus quick checks and headless/CI tips.

Latest version right now: ZAP 2.16.1 (stable). (ZAP)

1) Pick your install method (per OS)

Windows

Easiest (Winget)

winget install --id=ZAP.ZAP -e

To update later:

winget upgrade ZAP.ZAP
Code language: CSS (css)

(ZAP)

Alternative (Scoop)

scoop install zaproxy

(ZAP)

Traditional installer

1. Download the Windows Installer for 2.16.1.
2. Double-click, accept license, finish.
   (Windows builds require Java 17+; see step 2.) (ZAP)

macOS

Homebrew (recommended)

brew install --cask zap

(2.16.1 as of today.) (Homebrew Formulae)

Direct installer

• Download the macOS (Intel/Apple Silicon) installer and run it.
  (Mac installers include Java 17.) (ZAP)

Linux (Ubuntu/Debian/Fedora/…)

Snap (simple & maintained by ZAP team)

sudo snap install zaproxy --classic
# later:
sudo snap refresh zaproxy
Code language: PHP (php)

Then run:

zaproxy

(ZAP)

Flatpak

flatpak install flathub org.zaproxy.ZAP
flatpak run org.zaproxy.ZAP
Code language: CSS (css)

(ZAP)

Official Linux repos (RPM/DEB via openSUSE Build Service)

• Follow the repo instructions for your distro on the “Linux Repos” link, then install the zap/zaproxy package. (ZAP)

Docker (great for CI/CD or zero-Java setup)

Pull a prebuilt image:

docker pull ghcr.io/zaproxy/zaproxy:stable
# or docker pull zaproxy/zap-stable
Code language: PHP (php)

(ZAP)

2) Pre-req: Java (when needed)

• Required for Windows/Linux installers and cross-platform zip: Java 17+.
• Not needed for Docker; bundled on macOS installer.
  Get Java 17 (Temurin) if you don’t have it. (ZAP)

3) Verify the install & version

Desktop / CLI

• Start ZAP from Start Menu (Win), Applications (macOS), or zaproxy (Linux).
• Or print version via script: # macOS /Applications/ZAP.app/Contents/Java/zap.sh -version # Linux zap.sh -version # Windows "C:\Program Files\ZAP\Zed Attack Proxy\zap.bat" -version (ZAP)

(Optional) Verify checksums
Checksums are listed on the 2.16.1 release—compare after download. (ZAP)

4) First run tips (TLS & Add-ons)

• If you’ll proxy HTTPS traffic through ZAP, install the ZAP Root CA in your browser (Options → Network → Server Certificates; generate/save, then import to your browser’s trusted roots). (ZAP)
• Extend ZAP via Marketplace (Manage Add-ons). (ZAP)

5) Headless / automation (CI quick wins)

Start ZAP headlessly with API key

zap.sh -daemon -host 127.0.0.1 -port 8090 -config api.key=YOUR_SECRET_KEY

(Use zap.bat on Windows.) API key is required by default for security. (ZAP)

Packaged Docker scans

• Baseline (passive, prod-safe) docker run -t ghcr.io/zaproxy/zaproxy:stable \ zap-baseline.py -t https://example.com -r report.html (Mount -v $(pwd):/zap/wrk to save reports.) (ZAP)
• Full scan (includes active attacks) docker run -t ghcr.io/zaproxy/zaproxy:stable \ zap-full-scan.py -t https://example.com -r full.html (ZAP)

Automation Framework (YAML plans)

zap.sh -cmd -autogenmin zap-plan.yaml
zap.sh -cmd -autorun zap-plan.yaml
Code language: CSS (css)

(ZAP)

Quick “happy path” per OS (copy/paste)

• Windows (winget) winget install --id=ZAP.ZAP -e Launch “ZAP” from Start Menu. (ZAP)
• macOS (brew) brew install --cask zap open -a ZAP (Homebrew Formulae)
• Linux (snap) sudo snap install zaproxy --classic zaproxy (Snapcraft)
• Docker (baseline scan) docker run -t ghcr.io/zaproxy/zaproxy:stable \ zap-baseline.py -t https://example.com -r report.html (ZAP)

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.