OWASP Juice Shop Online: Demo, Hosted Instances & Free Access

OWASP Juice Shop is the most widely used deliberately vulnerable web application for security training — and one of the most common questions is whether it can be accessed online without installing anything locally. This guide covers every option: the official demo server, browser-based hosted environments, and the fastest local setup methods for when you need a private instance.

Can You Access OWASP Juice Shop Online?

Yes. There are several ways to use Juice Shop without a local install:

OWASP’s official demo instance — available at a rotating hosted URL maintained by the Juice Shop project
Heroku one-click deploy — if you have a Heroku account
Browser-based cloud labs — platforms like TryHackMe that host Juice Shop as a room
Gitpod / GitHub Codespaces — run Juice Shop in a cloud development environment
Your own Docker deployment — running locally in under 60 seconds

Each option has different trade-offs in terms of privacy, persistence, performance, and what you can test.

Option 1: The Official OWASP Juice Shop Demo Server

The Juice Shop project maintains an official demo instance. You can find the current demo URL at:

https://github.com/juice-shop/juice-shop#demo

Important caveats about the demo server:

Shared environment: The demo server is public and shared. Any data you enter (accounts you create, challenges you complete) is visible to other users and is wiped periodically.
No persistence: Your challenge progress is not saved between sessions.
Not suitable for DAST scanning: Running a scanner against the public demo server is prohibited — it’s a shared resource.
Rate limiting: The demo server applies rate limits that may prevent some security techniques.

Best for: Quick exploration of the Juice Shop interface, seeing what challenges exist, or demonstrating Juice Shop to stakeholders — not for serious security training or scanner benchmarking.

Option 2: TryHackMe — Juice Shop as a Hosted Lab

TryHackMe hosts OWASP Juice Shop as a dedicated room with guided challenges. This is the easiest way to access a private Juice Shop instance in the browser without any local setup:

Create a free TryHackMe account
Search for “OWASP Juice Shop” in the room library
Start the room — TryHackMe provisions a dedicated Juice Shop instance for your session
Connect via the browser-based AttackBox or your own VPN connection

Advantages of TryHackMe:

Private instance — your own Juice Shop, not shared with other users
Browser-based — no local software required
Guided — the room provides hints and structured challenges
Your progress is tracked within TryHackMe’s platform

Limitations:

Free tier has limited time — the instance shuts down after a few hours
The TryHackMe room may be running an older Juice Shop version
You cannot run your own DAST scanner against TryHackMe-hosted instances

Queries this solves: owasp juice shop tryhackme, juice shop thm, owasp juice shop thm walkthrough

Option 3: Gitpod — Run Juice Shop in the Browser

Juice Shop supports one-click deployment in Gitpod, which runs a complete development environment (including the Node.js server) in your browser without any local software:

Or go directly to: https://gitpod.io/#https://github.com/juice-shop/juice-shop

Gitpod provisions a cloud container, clones the Juice Shop repository, installs dependencies, and starts the server. The application is then accessible at a Gitpod-generated URL.

Advantages:

No local installation required
Fresh Juice Shop instance per session
Full access to the source code alongside the running application

Limitations:

Gitpod free tier has limited hours per month
The Gitpod URL is ephemeral — it changes each session
Running DAST scanners against a Gitpod instance requires additional configuration

Option 4: GitHub Codespaces

If you have a GitHub account with Codespaces access, you can run Juice Shop in GitHub’s cloud development environment:

# In the GitHub repository (github.com/juice-shop/juice-shop)
# Click the "Code" button → "Codespaces" → "Create codespace on main"

Once the codespace is running:

npm install
npm start

GitHub will automatically detect the running server on port 3000 and offer to open it in the browser. The URL is a randomly generated *.github.dev URL that only you can access.

Advantages:

Private — only you have access to your codespace URL
Persistent for the duration of your session
Full source code access alongside the running application
60 hours/month free on GitHub personal accounts

Option 5: Run Juice Shop Locally in 60 Seconds (Recommended)

For anything beyond casual exploration — security training, DAST benchmarking, CTF events, learning specific exploit techniques — running a local Juice Shop instance is the best approach. It gives you full control, privacy, and the ability to run any tools you want against it.

With Docker (Fastest)

docker run --rm -p 3000:3000 bkimminich/juice-shop

Open http://localhost:3000/ in your browser. That’s the entire setup. The --rm flag removes the container when you stop it, keeping your system clean.

Persistent mode (saves your challenge progress):

# Start in detached mode with a named container
docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop

# Stop when done
docker stop juice-shop

# Restart later (resumes where you left off)
docker start juice-shop

Reset to a clean state:

docker stop juice-shop
docker rm juice-shop
docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop

Without Docker (Node.js)

If you don’t have Docker but do have Node.js (v18+) installed:

# Clone the repository
git clone https://github.com/juice-shop/juice-shop.git
cd juice-shop

# Install dependencies
npm install

# Start the application
npm start

# Open http://localhost:3000/

The Node.js setup takes longer on first run (npm install downloads ~150MB of dependencies) but starts quickly on subsequent runs.

Checking That Juice Shop Is Running

After starting, verify Juice Shop is accessible:

curl -I http://localhost:3000/
# Should return: HTTP/1.1 200 OK

Then navigate to the scoreboard at http://localhost:3000/#/score-board — finding the scoreboard is actually the first Juice Shop challenge.

Platform Comparison: Online vs. Local

Method	Setup Time	Privacy	DAST Scanning	Progress Saved	Best For
Official demo server	None	❌ Shared	❌ Not allowed	❌ No	Quick demos
TryHackMe room	5 min	✅ Private	❌ Limited	✅ Platform	Guided learning
Gitpod	3 min	✅ Mostly	⚠️ Limited	❌ Ephemeral	Source + runtime
GitHub Codespaces	5 min	✅ Yes	⚠️ Possible	✅ Per session	Source access
Docker (local)	< 1 min	✅ Fully	✅ Yes	✅ Optional	Security training, DAST testing
Node.js (local)	5–10 min	✅ Fully	✅ Yes	✅ Yes	Full source access, SAST

Setting Up Juice Shop for DAST Scanner Testing

If you want to run a DAST scanner against Juice Shop — to benchmark the scanner or learn what a DAST scan looks like in practice — you need a local instance (not the public demo server).

Authenticated Scanning Setup

Most of Juice Shop’s interesting attack surface is behind authentication. To run an authenticated DAST scan:

Start your local Juice Shop instance
Register a test account at http://localhost:3000/#/register
Configure your DAST scanner to log in with those credentials before scanning
Run the authenticated scan targeting http://localhost:3000/

An unauthenticated scan only covers ~20% of Juice Shop’s attack surface. Authenticated scanning reaches the basket API (IDOR), user profile (IDOR), admin panel (access control), and all JWT-protected endpoints.

Minimum Findings a DAST Scanner Should Report

A production-ready DAST scanner should automatically find these Juice Shop vulnerabilities:

Vulnerability	Location	Severity
SQL injection	Login form (`/rest/user/login`)	Critical
Reflected XSS	Search bar, order tracking URL	High
Missing Content-Security-Policy	All pages	Medium
Missing X-Content-Type-Options	All pages	Low
Directory listing enabled	`/ftp/` directory	Medium
Sensitive file exposure	`/ftp/acquisitions.md`	High

If your DAST scanner misses the unobfuscated SQL injection in the login form — the most basic SQL injection test case in any vulnerable application — it is not ready for production use.

Offensive360 DAST is benchmarked against Juice Shop on every release. To verify scanner performance against your own codebase:

Book a demo — authenticated scanning, results in minutes
Book a demo — live demonstration against Juice Shop or your own application

Running Juice Shop for a Security Training Event

For corporate security training events or university security courses, a locally deployed Juice Shop instance (or a private cloud deployment) is the right choice:

Docker Compose with Multiple Instances

When running Juice Shop for a team, you may want separate instances per team to avoid interference:

# docker-compose.yml — deploy multiple Juice Shop instances
version: '3'

services:
  juice-shop-team1:
    image: bkimminich/juice-shop
    ports:
      - "3001:3000"

  juice-shop-team2:
    image: bkimminich/juice-shop
    ports:
      - "3002:3000"

  juice-shop-team3:
    image: bkimminich/juice-shop
    ports:
      - "3003:3000"

docker-compose up -d
# Team 1: http://your-server:3001/
# Team 2: http://your-server:3002/
# Team 3: http://your-server:3003/

CTF Mode for Competitive Events

Juice Shop supports CTF mode where each solved challenge generates a unique flag string:

# Run with CTF mode enabled
docker run -d -p 3000:3000 \
  -e CTF_KEY=your_shared_secret \
  bkimminich/juice-shop

In CTF mode, participants submit flag strings to a central CTF platform (CTFd is the standard choice). The Juice Shop CTF CLI generates the corresponding CTFd challenge configuration:

npm install -g juice-shop-ctf-cli
juice-shop-ctf
# Follow the prompts to configure your CTFd export

Common Setup Issues and Fixes

Port 3000 Already in Use

# Check what's using port 3000
lsof -i :3000  # macOS/Linux
netstat -ano | findstr :3000  # Windows

# Use a different port
docker run --rm -p 3001:3000 bkimminich/juice-shop
# Then access at http://localhost:3001/

Docker Not Installed

If you don’t have Docker, use the Node.js method:

# Check if Node.js is installed
node --version  # Need v18 or higher

# If not installed, get it from https://nodejs.org/
# Then use the Node.js setup method above

Apple Silicon (M1/M2/M3) Mac

The official Docker image (bkimminich/juice-shop) supports both AMD64 and ARM64. No special flags needed on Apple Silicon:

docker run --rm -p 3000:3000 bkimminich/juice-shop
# Works natively on M1/M2/M3 Macs

Juice Shop Starts But Challenges Don’t Resolve

If challenge notifications aren’t appearing when you complete challenges, check that you’re accessing the application at the exact URL http://localhost:3000/ (not via a proxy or hostname alias). Some challenge triggers are URL-sensitive.

Frequently Asked Questions

Is there a hosted version of Juice Shop I can use without installing anything?

Yes — the official Juice Shop demo server (URL on the GitHub page) provides temporary access. TryHackMe also hosts private Juice Shop instances as a guided lab room. However, for anything beyond a quick look — training, practice, or scanner benchmarking — a local Docker instance is recommended.

Can I run Juice Shop challenges on a phone or tablet?

Juice Shop is a web application, so you can browse it on a phone or tablet browser. However, most challenges require browser developer tools (DevTools) for intercepting requests, examining local storage, or modifying API calls — which are not available in mobile browsers. Challenges that can be completed without DevTools (finding the scoreboard, basic navigation challenges) work on mobile, but the majority require a desktop browser.

Is OWASP Juice Shop safe to run?

Juice Shop is safe to run in an isolated environment (your laptop, a private VM, a private Docker container). It is intentionally vulnerable — so it should never be exposed to the internet, run on a shared network with production systems, or deployed on a server accessible to unauthorized parties. Run it locally for personal use, or on an isolated private network for team training.

What port does Juice Shop run on?

By default, Juice Shop runs on port 3000. You can map it to any available port using Docker: docker run --rm -p 8080:3000 bkimminich/juice-shop would make it accessible at http://localhost:8080/.

Does Juice Shop work offline?

Yes. Once the Docker image is pulled (docker pull bkimminich/juice-shop), Juice Shop runs completely offline with no internet connection required. This is useful for air-gapped training environments or use on laptops without reliable internet.

Summary

Goal	Recommended Method
Quick demo or first look	Official demo server or TryHackMe
Guided learning with no setup	TryHackMe Juice Shop room
Security training or practice	Docker local (`docker run --rm -p 3000:3000 bkimminich/juice-shop`)
DAST benchmarking	Docker local — required for scanner testing
Corporate training event (team)	Docker Compose with per-team instances
CTF competition	Docker with `CTF_KEY` environment variable
Source code access alongside runtime	Gitpod or GitHub Codespaces

OWASP Juice Shop is free, open-source, and available for any of these use cases. The fastest path to hands-on security practice: docker run --rm -p 3000:3000 bkimminich/juice-shop — then open http://localhost:3000/#/score-board.

For a full challenge walkthrough, challenge solutions, and DAST benchmarking details, see our complete OWASP Juice Shop guide. For alternatives to Juice Shop by language stack, see OWASP Juice Shop alternatives.