vuln-bank vs juice-shop
Security training applications compared
vuln-bank and juice-shop are intentionally insecure applications for hands-on security practice. vuln-bank centers on banking workflows and web, API, GraphQL, and AI scenarios, while juice-shop offers OWASP-focused challenges, CTF support, and a companion guide.
vuln-bank: Practice Web, API, and AI Security Testing
Vuln Bank is an intentionally vulnerable banking web app for learning application security testing and secure code review. It offers hands-on scenarios across web, API, GraphQL, and AI features, and should only run in an isolated educational environment.
juice-shop: Practice Web Application Security with OWASP
OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws.
| vuln-bank | juice-shop | |
|---|---|---|
| Language | HTML | TypeScript |
| License | MIT | MIT |
| Stars | 960 | 14.2k |
| Forks | 348 | 20.2k |
| Last analyzed | Oct 3, 2026 | Oct 24, 2026 |
Key differences
- vuln-bank models banking workflows such as transfers, loans, and bill payments; juice-shop focuses on OWASP Top Ten vulnerabilities and other application flaws.
- vuln-bank includes API, GraphQL, and AI security scenarios; juice-shop provides challenge-based practice and includes some challenges requiring an AI/LLM provider.
- vuln-bank is listed as HTML and documents Docker Compose or a local Python and PostgreSQL setup; juice-shop is TypeScript-based and supports source, packaged, and Docker deployments.
- Both projects use the MIT license, but juice-shop’s companion guide has a separate CC BY-NC-ND 4.0 license.
- vuln-bank describes use by security learners, developers, QA, and security teams; juice-shop specifically documents training, awareness demonstrations, CTFs, and security-tool testing.
- The supplied figures list 960 stars and 348 forks for vuln-bank, compared with 14.2k stars and 20.2k forks for juice-shop.
Choose vuln-bank if you…
- need a controlled target with banking, API, GraphQL, or AI security scenarios.
- want to practice testing workflows involving transfers, payment integrations, or file uploads.
- prefer a documented Docker Compose setup or a local Python and PostgreSQL installation path.
Choose juice-shop if you…
- want OWASP Top Ten challenges, CTF support, or trainer guidance.
- need an official companion guide with hints, vulnerability explanations, and challenge solutions.
- want to test security tools against a TypeScript application with source, packaged, and Docker setup options.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.