Guide · Open source

How to use Juice Shop: install, run and start hacking safely

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

OWASP Juice Shop is a web application with deliberate security flaws, built so you can attack it legally and learn how common vulnerabilities work. This guide is for people who want hands-on practice with web security, such as students, trainers, CTF players and teams testing security tools. By the end you will know the install options listed in the project README and how to start the app on your own machine.

Juice Shopjuice-shop/juice-shop · ★ 14.3k · MIT Install options & downloads

Quick start

1Install Node.js. Install a supported LTS version of Node.js. Check the README compatibility table if you are unsure.
2Clone the repository. Run git clone with --depth 1 to fetch the source, then cd into the juice-shop folder.
3Install dependencies. Run npm install before the first start, or again after changing the source code.
4Start the app. Run npm start in the project folder.
5Open the app. Browse to http://localhost:3000 in your web browser.

What you need before you install Juice Shop

Juice Shop is set up with Node.js, so you need a supported LTS version of Node.js. The README links to a compatibility table that lists which versions are supported and tested, so check it before you install. Git is needed if you clone from source. Docker is optional and only required for the container option.

You should also be comfortable with basic web concepts and the command line, because setup is done in a terminal.

Node.js (a supported LTS version, see the README compatibility table)
Git, for cloning the repository from source
Docker, optional, for the container option

Install and run Juice Shop from source

The README's source install has five steps: install Node.js, clone the repository, move into the folder, install dependencies and start the app. Run the dependency install only before the first start or after you change the source code.

When the app is running, open http://localhost:3000 in your browser.

git clone https://github.com/juice-shop/juice-shop.git --depth 1
cd juice-shop
npm install
npm start

Run Juice Shop with Docker

If you have Docker installed, you can skip the source setup. Pull the image, then run it with port 3000 published to your own machine only. The README binds the port to 127.0.0.1, which keeps the app reachable from your computer rather than the wider network.

On macOS and Windows with docker-machine instead of native Docker, the README says to use http://192.168.99.100:3000 instead of localhost.

docker pull bkimminich/juice-shop
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop

Use a packaged distribution instead

The project also publishes packaged distributions on its latest release page. Install a 64-bit Node.js, download the archive for your system (a .zip or .tgz file), unpack it, change into the folder, then run npm start. The browse address is the same as for the source install.

The README notes that each packaged distribution includes binaries for sqlite3 and libxmljs2 built for the OS and Node.js version used during npm install.

Download the .zip or .tgz file attached to the latest release
Unpack it and cd into the folder
Run npm start and open http://localhost:3000

Vagrant and other setups

The README also describes a Vagrant option. You install Vagrant and VirtualBox, clone the repository, then run the Vagrant command from the vagrant folder and browse to 192.168.56.110. The README points to the companion guide for less common setups, including cloud providers, and for configuring AI providers, since some challenges need one.

cd vagrant && vagrant up

Know the limits before you use it

Juice Shop is intentionally insecure. Do not run it as a real online shop. The README describes the public demo at demo.owasp-juice.shop as a deployment-test and sneak-peek instance, with no guaranteed uptime. Practise on your own local copy instead.

For learning, the project's official companion guide and project page at owasp-juice.shop cover the features and architecture in more depth.

Run it locally, not on a public server
Do not treat the demo instance as a practice environment
Read the official companion guide for challenge details

What people use it for

Security students practising web vulnerabilities hands-on
Trainers running awareness workshops or live demos
CTF players working through practice challenges
Teams testing their own security scanning tools against a known-vulnerable target

Frequently asked questions

Is Juice Shop free to use?

The project is released under the MIT licence, as listed on its repository page. The README does not list any price, so you can get the source from GitHub and run it yourself.

What do I need to run Juice Shop?

You need Node.js, a supported LTS version, plus Git if you clone from source. Docker is optional and only needed for the container option.

Can I use Juice Shop as a real online store?

No. The project is intentionally insecure and is built to be attacked. The README says the demo instance is for deployment tests only and has no guaranteed uptime.

Why does the Docker command use 127.0.0.1?

The command publishes port 3000 only to your own machine, so the app is reachable from localhost rather than the wider network. This is the form the README gives.

What are the alternatives to Juice Shop?

The project's comparison list includes DVWA, WebGoat, Damn Vulnerable Web Application and OWASP NodeGoat. All are deliberately vulnerable apps for learning or testing, and you can pick one based on the stack and features you need.

Do all Juice Shop challenges work out of the box?

Not necessarily. The README says some challenges require an AI or LLM provider, and it links to setup instructions for local or cloud-based providers.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Juice Shop suits security students, trainers, CTF players and teams testing scanners who are comfortable with Node.js or Docker and the command line. If you need a real shop, a hosted demo you can rely on, or no command-line setup, choose a different tool.

Install options & downloads