What stands out about Burp Suite is how reliably it works as my main control point. I use it to intercept and modify https traffic. I like that I can pause a request midflight, change headers or payloads, and immediately view the server’s raw response. This has made manual security testing much easier for me.

Also, BApp Store is extremely useful, even in the free/community edition. I like the wide range of community extensions expand the usefulness. It is nice that the added extensions appear as tabs at the top of the app. Id say overall that I am very satisfied with Burp Suite! Review collected by and hosted on G2.com.

While capable, the Community Edition has a few friction points, mainly performance throttling.

For example, aggressive rate limiting on the Intruder tool. I understand separating free and paid tiers but forced, increasing delays make fuzzing or testing moderate parameter sets impractical and slow. This bottlenecks performance and adds time to my manual testing, which to me is counter productive in ways because I use this tool in order to save time! I think increasing the baseline thread allowance slightly or adding a limited burst mode would improve usability without undermining Burp Suites paid versions.

Additionally, it feels like any internal app support/onboarding is essentially absent. While I know that PortSwigger offers the “Web Security Academy” online (which is nice), the desktop client drops you into a complex interface with no interactive tutorials or guided setup. This creates a steep learning curve for less experienced analysts. Adding a guided UI tour or contextual tooltips would be a major upgrade.

All in all, the community version depends entirely on manual discovery and lacks any AI assistance. Most modern tools now provide a basic AI agent, Burp Suite should too. Without it, I think Burp Suite is behind their competitors, such as Yakit, OWASP ZAP, or Caido. Review collected by and hosted on G2.com.