Interactive reference for OWASP Top 10 vulnerabilities with examples, mitigations, and code snippets.
This is a static browsable reference for the OWASP Top 10 web application security risks: ten categories such as Injection, Broken Access Control, and Cryptographic Failures. Selecting or searching a category shows its definition, common attack scenarios, a short vulnerable-code snippet paired with a corrected version, and a mitigation checklist. It does not accept or analyze your own code - people often paste a code sample expecting a scan, but the tool only displays pre-written reference material for the category you pick, not a security review of pasted input.
A concrete input and expected output from the current implementation.
Input
Select category: A03:2021 - Injection
Expected output
Injection flaws (SQL, NoSQL, OS command, LDAP) occur when untrusted input is sent to an interpreter as part of a command or query. Vulnerable example shown: query = "SELECT * FROM users WHERE name = '" + input + "'". Fixed example shown: cursor.execute("SELECT * FROM users WHERE name = %s", (input,)). Mitigation checklist: use parameterized queries or prepared statements, validate input server-side, prefer an allow-list, escape special characters when parameterization isn't possible. This is the fixed reference content bundled for the Injection category (OWASP Top 10:2021, A03) - the tool displays it verbatim, it does not analyze any code the user actually has.
Each of the ten OWASP Top 10 entries is a fixed card or page. Clicking a category name, or typing part of it (e.g. 'injection'), filters the list and opens that entry's description, CWE references, an example attack, and a before/after code pair. Nothing is computed from user input beyond filtering which pre-written entry is visible.
Descriptions, examples, and mitigation notes are pre-written content bundled with the page, structured to mirror the official OWASP Top 10 document's category breakdown. There is no live fetch to owasp.org and no code execution or static analysis - the tool never reads or evaluates anything a user submits.
No. This reference has no input field for code analysis - it only displays pre-written descriptions and examples for whichever category you select. For actual scanning, use a SAST tool such as Semgrep or Bandit, or a DAST scanner against a running instance.
Check the category numbering and titles shown against the current official OWASP Top 10 page - editions have changed before (2017 to 2021 renamed and reordered several categories, adding Insecure Design and Server-Side Request Forgery), and this static copy may not track a newly released edition immediately.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.