Interactive reference for OWASP Top 10 vulnerabilities with descriptions, examples, mitigations, and code samples.
This is a browsable reference to the OWASP Top 10 categories, not a scanner: it never touches your code or network. Pick a category and it opens the OWASP ID and name, a plain-language description of the underlying weakness, a short illustrative attack scenario, and a mitigation checklist with vulnerable-versus-fixed code snippets. The thing people most often assume wrongly is that browsing the list is itself a security review of their app; it is background reading and vocabulary for a review, not a substitute for static analysis, dynamic testing, or a manual pentest against your actual code.
Each of the ten entries renders as a self-contained card: OWASP ID and name, a description of the weakness, a short scenario showing how it gets exploited, and a mitigation list. Selecting a card expands it in place. Because the content is bundled with the page rather than fetched per click, the same cards display identically once the page has loaded, even offline.
Most cards pair a vulnerable snippet with a corrected version, typically in a mainstream web language, so you can compare the flawed pattern against the fix line by line. These are static teaching examples written to illustrate one idea clearly, not linted against your own codebase or exhaustive of every framework's idioms - treat them as a starting point to adapt, not code to paste in unchanged.
No. It only displays reference text, example scenarios, and sample code; it never reads your files, repository, or network traffic. To find out whether a given category actually applies to your app, use a SAST/DAST tool or a manual code review - this page is preparation for that work, not a replacement for it.
I'm not certain without checking the page itself, and I'd rather say so than guess. OWASP has published several editions with different category names and rankings, so before citing a category ID in a report, confirm the edition against OWASP's own site rather than assuming this reference tracks the newest release.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.