Where Does OWASP ZAP Store Sessions and Configs?
Where OWASP ZAP keeps sessions and configs on Windows and computers. Exact folders are covered below.
Last updated
ZAP is attack proxy with local sessions. Your contexts, policies, and alerts live in the ZAP home folder. Each computer holds a working copy plus add ons.
Same home folder means same targets. Exact file names shift with weekly versus stable releases. Keep scans scoped to authorized targets during tests. For moves, copy the home directory whole. Partial copies miss certificates that break TLS interception on the new machine. Screenshots of settings help when support asks for reproduction steps later.
Where OWASP ZAP stores this, by platform
%userprofile%\.ZAP (sessions plus contexts, add-ons beside)
Contexts and sessions live in the ZAP home folder. Copy it whole for moves. Match releases before importing old sessions. Keep API keys out of shares.
Frequently asked questions
How do I move ZAP sessions to a new computer?
Copy the ZAP home folder with contexts plus session files to the new PC, then install the same release. Targets follow context files. Mixed releases can refuse old sessions, so match versions first. Keep API keys out of shared copies.
Does ZAP back up scan history?
Yes, in session files per scan with alerts attached. The PC holds a working copy plus add on cache. Views rebuild after import. Export HTML reports from scans for records, since the home folder alone is working state, not archiving.
Notice an outdated path? Let us know.