Burp Suite

What Is Burp Suite?

When you’re testing a web app and you need to see what’s actually happening on the wire—requests, responses, cookies, redirects, weird headers, “it only breaks in production” edge cases—Burp Suite is the workbench you park in the middle of the traffic. You route a browser (or an API client) through Burp, intercept and modify requests, replay them, and build controlled attacks until you can prove what’s vulnerable (or confirm it’s not).

Burp is built for hands-on web security testing: penetration testers, bug bounty hunters, appsec engineers, and anyone doing manual verification of findings from scanners. It’s not a “set it and forget it” product. The distinctive value is how much control it gives you over HTTP traffic and workflow—capturing, searching, mutating, replaying, and correlating behavior—without forcing you into one rigid methodology. In the paid editions, it also adds an integrated web vulnerability scanner and out-of-band testing via Burp Collaborator. (portswigger.net)

There are multiple editions. The free Community Edition is a manual toolkit with a proxy and core utilities, while Burp Suite Professional adds features aimed at day-to-day commercial testing efficiency (project files, full Intruder, scanner, Collaborator, and more). (portswigger.net)

Burp Suite Features and Performance

The foundation is Burp Proxy: an HTTP(S) / WebSockets interception proxy with history, which is the center point for capturing traffic and pushing interesting requests into other tools. The Community Edition download page explicitly lists “HTTP(s) / WebSockets proxy and history” as included. (portswigger.net)

From there, the “essential tools” for manual testing are included in Community: Repeater (for replaying and iterating on individual requests), Decoder, Sequencer, and Comparer. Community also includes “Burp Intruder (demo)”—enough to understand the workflow, but intentionally limited compared to the full Intruder in Professional. (portswigger.net)

Protocol support is a real differentiator in modern Burp builds. PortSwigger’s documentation describes Burp’s HTTP/2 testing support in detail, including default behavior: Burp will speak HTTP/2 to servers that advertise it via ALPN during the TLS handshake, and it lets you toggle the protocol per request (including in Repeater and via the Inspector). The same documentation also describes “kettled” HTTP/2 requests (cases that can’t be accurately represented in HTTP/1 syntax without losing information) and how Burp handles them. This matters in practice because it affects what you can safely edit in the raw message editor versus what must be adjusted in the Inspector. (portswigger.net)

Burp Suite Professional layers in features that remove a lot of friction for real engagements: project files to save work; the full Intruder; an integrated web vulnerability scanner; a built-in search function; and “Auto and manual OAST testing (Burp Collaborator).” These are explicitly listed as Professional additions on PortSwigger’s Community download page. (portswigger.net)

Performance is workload-dependent. The software is doing several expensive things at once: terminating TLS for interception, normalizing/editing messages, maintaining history, and optionally running automation (scanner / Intruder / extensions). Burp’s own HTTP/2 documentation also makes clear that protocol negotiation is automatic by default and that connection reuse behavior can matter in Repeater (for example, some servers treat the first request per connection differently). That’s not “speed benchmarking,” but it’s a practical performance characteristic: Burp is designed to stay out of your way for typical workflows, while still giving you knobs when the target’s behavior depends on connections and protocol details. (portswigger.net)

Extensibility is another “why Burp” reason, even if you only touch it occasionally: Burp supports extensions (“BApps”), and PortSwigger explicitly notes that some “Pro-exclusive BApp extensions” are part of Professional. In other words, extension availability can depend on edition, so you can’t assume a workflow you see online will work on Community. (portswigger.net)

Specs we’re using (verified in VPNSpotter’s database): Burp Suite is under the jurisdiction of the United Kingdom, and its pricing model is freemium (free Community Edition plus paid tiers). (portswigger.net)

Pricing and Plans

Burp Suite is structured around a free tier plus paid subscriptions.

• Burp Suite Community Edition: Free to use (no fees due under the Community Edition addendum in PortSwigger’s terms).
• Burp Suite Professional: Paid subscription per user. PortSwigger’s Professional product page shows a buy price of $499 (as displayed on the page). (portswigger.net)

On PortSwigger’s “Subscribe to Burp Suite Professional” ordering page, you can select different subscription lengths (it shows options like 1 year, 3 years, and 10 years, and also reveals “more options” with additional year counts). That supports what PortSwigger documents elsewhere: they offer annual subscriptions and many customers subscribe for multiple years. (portswigger.net)

Licensing is not “one key per seat but you can pass it around.” PortSwigger states in multiple places that everyone who uses Burp Suite Professional needs a subscription, and you cannot share a single subscription between multiple users even if only one person uses it at a time. (portswigger.net)

Refund policy is not presented as a simple consumer-style “30-day money back” promise on the pages above. The EULA does describe a scenario where PortSwigger terminates due to an infringement-type claim and refunds pre-paid fees for the remainder of the terminated commitment term. That is not a general “refund window” and shouldn’t be treated like one.

Privacy and Security Assessment

First, Burp Suite isn’t a VPN, and it’s not a consumer “privacy tool” in the normal sense. It’s a security testing platform that often processes highly sensitive data (session cookies, tokens, PII in responses, internal endpoints, test credentials). Your biggest privacy risk is typically operational: how you store project data, where you export logs/reports, and what extensions you install.

Jurisdiction: PortSwigger is a UK company, and your database lists Burp Suite’s jurisdiction as the United Kingdom. For enterprise buyers, jurisdiction mainly matters for contract enforcement and legal process; for individuals, it’s usually less relevant than how you handle data locally. Either way, UK jurisdiction is not “privacy-neutral,” and you shouldn’t assume any special anonymity properties from using a UK-developed commercial tool. (If your threat model is government compulsion, talk to counsel; Burp isn’t positioned as an anonymity product.)

Logging / telemetry: PortSwigger’s legal and licensing pages establish that Burp Suite is developed and licensed by PortSwigger Ltd and governed by their terms. What we can’t confirm from the sources we pulled here is a clear, current statement about product telemetry, analytics, or what data (if any) is sent back by default. Because that’s a high-stakes privacy detail and it’s not explicitly stated in the sources above, we’re not going to guess.

Open source posture: Burp Suite is proprietary software distributed in object code form, per PortSwigger’s terms. That means you’re not getting the auditability benefits of a fully open-source proxy/scanner.

Security incidents / audits: We did not find, in the sources reviewed above, any authoritative public claim of a no-logs audit, third-party privacy audit, or a specific incident history we can responsibly summarize here. If you need that level of assurance, treat it as a procurement due diligence item and ask PortSwigger directly.

Strengths and Limitations

Strengths

• Excellent manual workflow for web testing. Community Edition already includes the proxy/history plus Repeater/Decoder/Sequencer/Comparer—enough for serious hands-on work. (portswigger.net)
• Modern protocol support (including HTTP/2 tooling). Burp’s documentation describes deep support for HTTP/2 negotiation, per-request protocol toggling, and an HTTP/2-focused Inspector view when you need it. (portswigger.net)
• Clear upgrade path for professional use. Professional adds the things that typically matter in paid work: saving projects, full Intruder, scanner, search, and Burp Collaborator (OAST). (portswigger.net)
• Per-user licensing is explicit. There’s little ambiguity: PortSwigger states you can’t share a Pro subscription across multiple users. That’s strict, but it’s at least clear. (portswigger.net)

Limitations

• Free tier is intentionally constrained. Intruder is explicitly “demo” in Community; serious automation pushes you toward Pro. (portswigger.net)
• Not open source. If your policy requires source-available tooling for inspection or internal builds, Burp won’t meet that requirement.
• Refund terms aren’t a simple consumer guarantee. The EULA includes specific refund scenarios, but we did not find an advertised general refund window in the sources used here.

Who Should Use Burp Suite?

Good fit

1. Penetration testers doing hands-on web app testing who need an interception proxy, repeatable request editing, and a workflow that scales from “one request” to “many requests.” Community already covers the core manual toolkit; Pro adds scanner/Collaborator/project files. (portswigger.net)
2. Bug bounty hunters who live in request/response minutiae and want to iterate quickly with Repeater and proxy history, then selectively bring in automation (Intruder/scanner) when it’s worth it. (portswigger.net)
3. AppSec engineers validating scanner findings and reproducing issues with precise control over HTTP/2 vs HTTP/1 behavior, redirects, and protocol-level edge cases. (portswigger.net)

Not a great fit

1. People looking for a privacy tool (like a VPN). Burp is for testing; it does not provide anonymity.
2. Teams that require fully open-source tooling for transparency or internal compliance; Burp is proprietary object code.
3. Users who want “push button scanning” for free. The free tier is a manual toolkit and Intruder is demo-limited, while scanning is a Professional feature. (portswigger.net)