Burp Suite review

Burp Suite is a web security testing toolkit from PortSwigger. It is software used by security professionals to test web security, rather than a hosted API, language library or command-line service. Its interface brings together tools including Proxy, Intruder, Repeater, Collaborator, Sequencer and Decoder.

In a web application stack, Burp sits in the testing workflow: security professionals use its tools to inspect and work with web traffic and test applications. The homepage shows request and response views alongside its tool interface. It also points users to community extensions and Web Security Academy labs, which provide an education and extension path around the core toolkit.

The product has distinct offerings for manual testing and application scanning. Community Edition is the free manual-testing option; Professional is priced per user; Burp Suite DAST is aimed at teams scanning web applications. DAST can be cloud-hosted or self-hosted, per the pricing facts.

Burp Suite is primarily a user-facing security testing toolkit, not an API-first service that an application calls at runtime. PortSwigger’s homepage names tools such as Proxy, Intruder, Repeater, Collaborator, Sequencer and Decoder, and highlights community extensions. That gives teams a visible workflow for manual testing and a way to extend the toolkit through its community.

The homepage also points to Web Security Academy, with online labs for learning about vulnerabilities. It does not present an integration surface such as a REST API, webhooks or CLI in the homepage text. Nor does it name SDKs or programming languages. Teams planning to automate Burp Suite or build extensions should confirm the supported extension interfaces, SDKs and language versions in PortSwigger’s documentation before committing to an integration.

For an application team, the practical distinction is important: Burp can support security testing around a web application, but it should not be treated as a library or service endpoint without verifying the relevant vendor documentation.

Community Edition is free and includes manual testing tools, but it has no project saving and no automated web vulnerability scanner. Its Intruder feature is a rate-throttled demo. That makes it useful for manual work, but it is not a free route to the full scanning workflow.

Professional is listed at $499 per user per year, or $41.58 per user per month when the annual price is divided across 12 months. The listed billing term is annual; a monthly price is not published. Each subscription covers one named user, multi-year terms are available, and a free trial is offered with no credit card required. The trial duration is not published.

Burp Suite DAST is custom-quoted for teams. Its price depends on the number of websites or applications and scanning capacity; the plan includes unlimited users and cloud-hosted or self-hosted deployment. Burp AI credits can be purchased, but their prices and overage fees are not published. Ask PortSwigger for a quote that includes the planned scan capacity and any AI-credit usage.

PortSwigger presents Burp Suite as commercial software and offers a free Community Edition. The homepage does not state an open-source licence or provide source-availability terms; teams that need to audit or modify the source should ask PortSwigger about those terms before adopting it.

The DAST pricing facts list both cloud-hosted and self-hosted deployment. That option applies to Burp Suite DAST; it does not establish that every Burp Suite component can be self-hosted. The homepage does not describe data-export formats or migration tools, so ask the vendor how findings and project data can be exported and retained.

Migration effort will depend on how much a team relies on Burp-specific workflows, extensions and saved project data. Before standardizing on those workflows, confirm what can be exported and how extensions or testing procedures would transfer to another tool.

Burp Suite DAST is the product option aimed at teams scanning web applications. Its pricing depends on websites or applications and scanning capacity, so teams should get a quote against their expected scope. The pricing facts list unlimited users and cloud-hosted or self-hosted deployment. PortSwigger’s homepage says it is ISO 27001 certified; confirm which service and controls that certification covers when reviewing the security requirements for a deployment.

Community Edition has specific constraints: no project saving, no automated web vulnerability scanner and a rate-throttled demo of Intruder. Those limits matter if a team expects repeatable projects, automated coverage or unrestricted Intruder use. The published pricing facts do not give request rates or scanning limits for paid plans, so teams should ask about capacity and operational limits before relying on them.

Reddit users report that Community Edition can be enough for basic interception and request editing, while commenters say Professional features can justify its price for some use cases. Those reports are opinions, not a substitute for checking plan capabilities and scan capacity against your production workload.