Is preview.owasp-juice.shop safe?

An intentionally insecure training application, not a storefront

The page itself states that OWASP Juice Shop is a web application with a vast number of intended security vulnerabilities and is supposed to be the opposite of a best-practice or template application for web developers. That is the defining characteristic of the project: the flaws are the product, not an accident.

Independent documentation from the ZAP project describes the online Juice Shop as a shared instance where visitors should register a unique user because other people may change the default user. This confirms the site is a public, multi-user training environment rather than a commercial service.

The registrable domain owasp-juice.shop is 3269 days old, consistent with a long-running project rather than a recently created shell. The subdomain host itself may be newer, but the parent domain's history supports the project's established identity.

Technical caveats versus operator risk

The scanned address was served over plain HTTP with no redirect to HTTPS, so the connection to it was not encrypted even though a valid TLS certificate exists for the host. For a training site where users are told to register accounts, this is a real but minor technical weakness: credentials typed into the demo could travel unencrypted.

One saved antivirus observation reported an adverse result from a single engine. This is a stale, partial record rather than a fresh submission, so it should be treated as a historical detection to confirm rather than a current verdict on the site.

The browser threat feed returned no threat warning for the host, which is consistent with a known educational project rather than a malicious distribution point.

What happens when you use the demo

A visitor who registers an account on the public Juice Shop instance is told to use a unique username because other people may change the default user. The exposure is to other learners on a shared, deliberately broken application, not to a commercial operator.

Because the scanned address was served over plain HTTP without a redirect to HTTPS, anything typed into the demo travels unencrypted. The practical takeaway is to avoid reusing real passwords on this training instance.