Menu
About OWASP Juice Shop
Description
Juice Shop is written in Node.js, Express and Angular. It was the first
application written entirely in JavaScript listed in the
OWASP VWA Directory.
The application contains a vast number of hacking challenges of varying
difficulty where the user is supposed to exploit the underlying
vulnerabilities. The hacking progress is tracked on a score board.
Finding this score board is actually one of the (easy) challenges!
Apart from the hacker and awareness training use case, pentesting
proxies or security scanners can use Juice Shop as a “guinea
pig”-application to check how well their tools cope with
JavaScript-heavy application frontends and REST APIs.
Translating “dump” or “useless outfit” into German yields “Saftladen”
which can be reverse-translated word by word into “juice shop”. Hence
the project name. That the initials “JS” match with those of
“JavaScript” was purely coincidental!
Testimonials
> The most trustworthy online shop out there.
(
@dschadow) —
The best juice shop on the whole internet!
(
@shehackspurple) —
Actually the most bug-free vulnerable application in existence!
(
@vanderaj) —
First you 😂😂then you 😢
(
@kramse) —
But this doesn’t have anything to do with juice.
(
@coderPatros’ wife)
Contributors
The OWASP Juice Shop has been created by
Björn Kimminich and is developed,
maintained and translated by a
team of volunteers.
A
live update of the project contributors
is found here.
Licensing
This program is free software: You can redistribute it and/or modify it
under the terms of the
MIT License.
OWASP Juice Shop and any contributions are Copyright © by Bjoern
Kimminich & the OWASP Juice Shop contributors 2014-2025.
Project Resources
Project Leaders
ization Cheat Sheet
Project Information
Language
JavaScript/TypeScript
License
See license
Latest Version
GitHub release
Contributors
100
GitHub Stars
12000
Requirements
- Node.js 18+ or Docker
- Modern web browser
- 2GB RAM minimum
- Internet connection for dependencies
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.