Where Does OWASP ZAP Store Data and Config?
ZAP home directory on Linux with config.xml, session databases and add-ons.
Last updated
OWASP ZAP keeps configuration, session databases and downloaded add-ons in a .ZAP directory in your home folder, versioned per release. Sessions record every proxied request for later analysis.
Version upgrades create fresh versioned folders instead of migrating. Copy sessions and config forward explicitly or history stays behind.
Where OWASP ZAP stores this, by platform
~/.ZAP
Holds config.xml, session .session databases and add-ons per versioned subfolder. Copy sessions and config with ZAP closed to migrate findings. The folder grows with large scans, so prune old sessions.
Frequently asked questions
Where are ZAP scan sessions?
As .session files inside the versioned folders under .ZAP above. Open them from the welcome screen to resume analysis.
How do I back up ZAP config?
Copy config.xml plus any custom scripts from the .ZAP tree. Sessions travel separately in the same folders.
Notice an outdated path? Let us know.