DVWA vs juice-shop
Web application security training targets compared
DVWA and juice-shop are deliberately vulnerable web applications for practicing security testing and learning about application flaws. DVWA uses PHP and MariaDB with configurable difficulty levels, while juice-shop uses TypeScript and focuses on OWASP Top Ten coverage, CTFs, and an official companion guide.
DVWA: Practice Web Application Security in a PHP/MariaDB Lab
DVWA is a deliberately vulnerable PHP/MariaDB web application for security professionals, developers, students, and teachers to practice common web vulnerabilities. Its difficulty levels and Docker setup make it useful for controlled training, not public deployment.
juice-shop: Practice Web Application Security with OWASP
OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws.
| DVWA | juice-shop | |
|---|---|---|
| Language | PHP | TypeScript |
| License | GPL-3.0 | MIT |
| Stars | 13.9k | 14.2k |
| Forks | 5.2k | 20.2k |
| Last analyzed | Oct 24, 2026 | Oct 24, 2026 |
Key differences
- DVWA is built with PHP and MariaDB; juice-shop is built with TypeScript.
- DVWA offers challenge difficulty levels and intentionally undocumented vulnerabilities; juice-shop covers the OWASP Top Ten and other application flaws, with challenge hints and solutions in its companion guide.
- DVWA runs with Docker Compose or on a PHP and MariaDB stack; juice-shop supports setup from source, packaged distributions, and Docker.
- DVWA uses the GPL-3.0 license; juice-shop uses the MIT license, while its companion guide has a separate CC BY-NC-ND 4.0 license.
- DVWA is aimed at lab and classroom practice and warns against internet-facing deployment; juice-shop also documents use for CTFs and awareness demonstrations, and is not intended as a production shop.
- DVWA documents regular repository contributions and a release over a year old; juice-shop documents regular releases and active issue handling, with contributor activity concentrated in one person.
Choose DVWA if you…
- want a PHP and MariaDB target with adjustable challenge difficulty.
- need a controlled lab or classroom environment for practicing common vulnerabilities.
- want to investigate intentionally undocumented vulnerabilities.
Choose juice-shop if you…
- want a TypeScript application covering the OWASP Top Ten and other real-world flaws.
- need a documented target for CTFs, trainer-led exercises, or awareness demonstrations.
- want an official guide with hints, explanations, and challenge solutions.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.