OWASP Threat Dragon
OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application used to draw threat modeling diagrams and to list threats for elements in the diagram.
Threat Dragon is designed to be accessible, with an emphasis on flexibility and simplicity. It supports multiple threat modeling frameworks including STRIDE, CIA, LINDDUN, and more.
You can run Threat Dragon as a standalone desktop application or a fully featured, configurable, self-hosted web application.
Mike Goodwin is the originator, founder and leader of OWASP Threat Dragon. The first commit to the original threat dragon repository was made on 9th October 2015, so that is Threat Dragon's birthday. Cupcake, our mascot, has a birthday as well: DЯΣΛMƧVΣЯƧΣ uploaded the original artwork on 7th May 2012.
At the moment there is no Threat Dragon song ... but if you can compose one we would be most grateful.
The Threat Dragon source code can be downloaded from github, and installed using npm clean-install. If you are running off main branch then it really should install cleanly, so if you get errors along the lines of Running postinstall script failed then some package downloads my be blocked by your network. Try using a VPN, or find out if your router / network can allow the traffic. If all else fails, you can open an issue and we will do our best to support you.
Why do I get 'OWASP-Threat-Dragon-Setup isn't commonly downloaded' warnings after downloading on Windows?
This is due to the way we sign the Windows images and how Windows SmartScreen has evolved. The signature is verified by the community rather than going through a process with Microsoft. After enough installs, Windows will fully trust it ... until then we have to put up with this irritation on first install.
Click on the 'show more' and agree to keep the file. You will have to agree again 'Keep anyway' before Windows accepts that you really want to keep the file. You can then double click on the download to install Threat Dragon.
For more than 4 years Mike hosted Threat Dragon on his github, and in mid-2020 he felt that the time was right for it to migrate to the OWASP organisation github space. This was done through June and July 2020 and with version 1.3 (released September 2020) the migration was completed.
In September 2026, OWASP launched a new website that no longer uses the www-* github repositories for projects and chapters. These repositories are slated to be deleted by the end of 2026. To preserve the history of our contributors, a fork was made to serve as a public archive with a note explaining the transition at the top of the README.
We sincerely appreciate all of the contributions to our project page over the years.
Project Resources
Project Leaders
Mike Goodwin
Leader & Original Author
The original creator of Threat Dragon way back in October 2015 and selected the famous Cupcake project logo; used by Threat Dragon with the kind permission of the artist DЯΣΛMƧVΣЯƧΣ
Jon Gadsden
Project Leader
Jon is a leader for the OWASP Threat Dragon and Developer Guide projects. For some years he was an OWASP Chapter leader for Bristol, England, and still helps out with organising these chapter meetings.
Project Information
Slack