Caido — Install, Use, Optimise (2026)

Modern web application testing platform — Rust-based, lightweight Burp alternative with cleaner UX and faster startup.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Linux/macOS/Windows

Download from caido.io/releases

Cargo (CLI)

cargo install caido-cli

0

Free Community + paid Pro tiers

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Start proxy

Caido GUI → Proxy → Set browser to 127.0.0.1:8080

Install CA

http://caido/ca → download → install in browser

Replay request

Right-click → Add to Replay (Burp's Repeater equivalent)

Run automate (Intruder equivalent)

Right-click → Add to Automate → configure payloads

HTTP/2 + HTTP/3 support

Settings → Protocols (Caido has better HTTP/3 than Burp)

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Memory footprint: Caido starts at ~150MB vs Burp’s 1GB+. Much less crash-prone on long sessions.
• Startup time: Caido ~3s, Burp ~30s. Big productivity win when you restart often.
• Project file format: SQLite-backed, sub-second autosave. Burp’s Java serialization corrupts on crashes.
• Convert workflows: Caido has Burp project file import — most projects migrate cleanly.
• Workflow automation: Caido’s Workflows (visual node editor) is similar to Burp Macros but more discoverable.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Smaller plugin ecosystem than Burp’s BApp Store. Some niche plugins haven’t been ported.
• Active scanner is more limited in Pro tier than Burp’s — for full audit work Burp Pro still wins.
• Some Burp tutorials don’t map directly — Caido’s UI organization differs.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• Burp Suite Pro — gold standard, paid.
• OWASP ZAP — free alternative.
• mitmproxy — CLI-first.

India context and engagement notes

Caido has matured to be Burp’s real alternative in 2026. For solo bug-bounty hunters and consultants who don’t need Burp’s scanner, Caido Pro ($120/yr) is half Burp’s price and arguably better UX. Try a 30-day trial before recommending to the team.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.