What is Burp Suite?

Burp Suite is PortSwigger's toolkit for testing the security of web applications, sold as a free Community Edition, a paid Professional edition, and an organization-level DAST scanner. Professional and Community install on Windows, macOS and Linux (JAR also offered); DAST is offered as cloud-hosted, self-hosted on Windows or Linux, or on Kubernetes via a Helm chart.

Who it's for

PortSwigger lists Professional for individual users such as penetration testers, bug bounty hunters and AppSec engineers, and DAST for organizations with no limit on users per license. Community Edition is described as the manual tools to start web security testing.

Pros & cons

Strengths

PortSwigger lists Burp AI features in Professional: custom prompts in Repeater, an Explainer for highlighted messages, Explore Issue for scanner findings, false-positive filtering for broken access control checks, and AI-generated recorded logins.
The vendor says Burp AI features do not run unless you activate them, and Professional users can turn them all off under Settings > AI (DAST administrators have a separate toggle).
PortSwigger's data-handling page says its contracts bar the AI providers (OpenAI and Anthropic models) from monitoring, storing or training on your data, and that its AI is covered by its ISO 27001 certification and Data Processing Agreement.
Burp Suite DAST is listed with a Chromium-based crawler, API scanning (OpenAPI, SOAP, GraphQL, Postman), role-based access control, SAML SSO, and CI/CD integrations including Jenkins, GitHub Actions, GitLab CI and Azure DevOps.
Burp AT, a separate agentic AI feature, is in public beta; the vendor says scope and approval rules are enforced by Burp's tooling layer, with Manual, Smart and Autonomous modes and activity logged in the project.
A free trial of Professional is offered, and Community Edition is a free download with a proxy, Repeater, Decoder, Sequencer, Comparer and a demo version of Intruder.

Limitations

Burp AI needs AI credits, deducted per use and bought from My Account (a Burp AI subscription for teams is also offered); the pages read show no credit prices, credits expire 12 months after purchase, belong to one user and cannot be pooled, and AI features stop when they run out.
Community Edition leaves out the web vulnerability scanner, project files, the full Intruder, Burp Collaborator, crawling and search, and Burp AI is documented only for Professional.
PortSwigger says Burp AI does not automatically redact sensitive data (except in AI recorded logins), has no fixed deletion schedule for conversation and audit data, may use anonymized data to improve its AI features, and processes data on AWS in US-East and EU-West with no region choice.
Burp AT requires Professional 2026.7 or later plus AI credits, is in public beta with no stated general availability date, and its pricing was not found; DAST pricing is not published and is quoted by contacting PortSwigger.
The vendor's pages disagree on terms: the pricing page lists no prices, the Professional page shows $499 without a billing basis, the licensing page says subscriptions are annual, and the buy and FAQ pages mention 1 to 5 year (and 10 year) terms with prepayment.

Plans and pricing

Community Edition: $0. Free download; manual tools, Intruder demo only; no scanner or project files; Burp AI is not listed for it.
Professional: $499 (per user; billing basis not stated on the page). Per user, cannot be shared; includes the scanner and Burp AI features, which need AI credits. Terms of 1 to 5 or 10 years are offered; the licensing page says subscriptions are annual.
Burp AI subscription / credits: Not published. Team subscription added to Professional, or pay-as-you-go credit packs bought in My Account; credits expire after 12 months.
DAST: Contact sales. Licensed by scanning requirements, no per-user limit; cloud, self-hosted or Kubernetes. A demo is offered.
Burp AT: Not published. Public beta for Professional users; uses AI credits.

The $499 figure was read from the official Professional page (a Buy button); the page and the pricing page do not state a billing basis or list a price table, so the one-year per-user reading is Reported, based on the licensing page saying subscriptions are annual. Prices are in USD, and the buy page also offers euros and pounds. Confirm on the live pricing page.

Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗

Sources

This profile was compiled from these public pages. We have not run hands-on tests.

Summary

Burp Suite — at a glance

Try Burp Suite →

We couldn't find that tool

Burp Suite

At a glance