Two years after the Battle of New York, Steve Rogers continues working as an agent of S.H.I.E.L.D.. While out on a morning jog in Washington, D.C., Rogers frequently passes a man who later introduces himself as Sam Wilson, a veteran United States Air Force pararescue trooper who now works as a counselor at the U.S. Department of Veterans Affairs. After the jog, Wilson and Rogers share and bond over their common experiences in adapting to life after each serving tours in the armed forces.

Natasha Romanoff arrives to take Rogers with her on a mission to rescue the hostages of the S.H.I.E.L.D. vessel Lemurian Star, which had been taken over by a group of hired pirates led by Georges Batroc. Rogers, Romanoff, and Brock Rumlow, along with other members of the STRIKE, eliminate the pirates and rescue the hostages. However, mid-mission Rogers discovers that Romanoff had gotten her own secret mission from Director Nick Fury to extract the S.H.I.E.L.D. intelligence from the ship onto a USB drive. A suspicious Rogers remarks that Romanoff's disappearance nearly jeopardized the mission.

Back at the Triskelion, Rogers is angry with Fury for lying to him. Fury, as a sign of trust, takes Rogers to the basement where he introduces Rogers to Project Insight. Project Insight consists of three next generation S.H.I.E.L.D. Helicarriers that will be launched into the air and connected to Project Insight satellites at 3000 feet in the air to neutralize enemy hostile targets. Fury tells Rogers that "S.H.I.E.L.D. takes the world as it is, not as we like it to be," but Rogers responds that, "This isn't freedom. This is fear..."

Later, Rogers visits the Captain America exhibit at the Smithsonian Institution, and also visits an elderly Peggy Carter (who is suffering from a form of dementia) in a retirement home. He also meets with Wilson again after watching him speaking during the end of a session for veterans with PTSD.

Meanwhile, Fury discovers that the data on the USB is inaccessible. He informs Alexander Pierce, who had just concluded a meeting with the World Security Council about the hijacking of the Lemurian Star. Fury asks Pierce to make a formal request to the Council to delay Project Insight due to Fury's rising suspicions.

Fury leaves the Triskelion and is in-route to meet with Maria Hill when he is attacked by assassins impersonating policemen. He gets away, suffering a broken forearm, but is then soon stopped by a masked man in the middle of the road who shoots a Disc Grenade under Nick Fury's SUV, flipping it. However, before the masked man gets to Fury, he manages to use a hi-tech device to cut through the vehicle and street and escape into the sewers.

Rogers arrives at his apartment and, after talking to his neighbor, he becomes suspicious when he hears that his stereo is still on. He sneaks in through the window and finds the injured Fury sitting in a chair in the dark. He tells Rogers that his wife kicked him out, while communicating through written text on his phone that his story is misdirection because they are being eavesdropped upon. Fury tells Rogers that S.H.I.E.L.D. has been compromised, before being shot several times by the assassin from earlier standing on the adjacent building. Fury gives the USB drive to Rogers and tells him not to trust anyone, before falling unconscious. Rogers' neighbor smashes in the door, revealing herself to be Agent 13, who had been tasked by Fury to keep an eye on Rogers.

He then pursues the masked man, jumping through the window into the next-door office building. He throws his shield at the masked man on the rooftop, but is surprised when the man is able to catch the shield with his cybernetic arm and throw it back before jumping off of the building and disappearing.

Fury is taken to a hospital in critical condition. His heart stops during surgery. After the doctors fail to revive him, his body is collected by Maria Hill. Rumlow tells Rogers he is wanted at the Triskelion for an urgent meeting. Feeling suspicious, Rogers quickly hides the USB in a vending machine and leaves. At the Triskelion, he is questioned by Pierce, who says he is one of Fury's oldest friends and wants to know who killed him. Rogers does not trust Pierce and says nothing about the USB or the circumstances of Fury's death, merely reiterating that Fury said not to trust anyone. He leaves Pierce to go to the hospital.

While in the elevator, Rogers is joined by Rumlow and several STRIKE operatives, and soon realizes that they are there to capture him. He fights the attackers and successfully knocks them all out, before jumping out of the elevator to avoid arrest. After landing, he drives away on his motorcycle and disables an attacking Quinjet. Pierce then declares Rogers a fugitive to be taken out by S.H.I.E.L.D. for withholding information on Fury's death. Later, Pierce turns out to be working with the masked man and shoots his house cleaner Renata for accidentally seeing the two men talking together in his home.

Rogers arrives later at the hospital, where he notices that the USB is gone. Romanoff appears from behind and reveals that she had taken it, and he angrily asks her what she knows about all that has happened. She tells him that the masked man is an assassin known as the Winter Soldier, and she had encountered him once before. She decides to follow Rogers. They go to an Apple store to see if they can access any of the valuable information on the USB. But they, as Fury did, find nothing. However, they are able to trace the location where the program on the USB was written. Rumlow and his team arrive and try to find them but fail to do so.

They steal a truck and drive to the location while talking about each other's past. When they arrive, Rogers realizes that they are at the Camp Lehigh where he trained during World War II. They find a secret storage room full of old computers inside an early S.H.I.E.L.D. office. There they find a more modern-looking USB slot and they put the USB in. The computers power up and someone starts to talk to them. That someone is Arnim Zola, who tells them that he was recruited by S.H.I.E.L.D. after World War II and that he helped to rebuild HYDRA inside S.H.I.E.L.D. However, in the 1970s, when he received the news that his body was dying (and with S.H.I.E.L.D. still needing his help), he had his mind transferred into computers. He had been working on an algorithm that HYDRA wanted. He told Rogers and Romanoff that some of the deaths of S.H.I.E.L.D. leaders had been due to HYDRA while showing them a picture of Howard Stark and implying that Stark's death might not have been an accident. He was also involved in the Winter Soldier program. But before Rogers and Romanoff can get any more information out of Zola, a S.H.I.E.L.D. missile shows up and destroys the bunker.

Rogers and Romanoff are able to survive the explosion and seek refuge with Sam Wilson. Wilson tells them that he can offer them assistance as he is part of a military project involving advanced personal flight suits. Rogers and Romanoff then go back to Washington D.C., to capture Jasper Sitwell, who is working for HYDRA. Sitwell had just finished a meeting with Senator Stern, another HYDRA conspirator, when Wilson calls Sitwell and forces him up on the roof of a tall building. Wilson, working with Romanoff and Rogers, gets Sitwell to inform them that Zola's algorithm could calculate if a person would be a threat in the future based on their past actions. Sitwell also tells the three that HYDRA are going to use Project Insight as a weapon to eliminate what they view as threats against themselves and the world, mentioning Tony Stark, Bruce Banner and Stephen Strange, though this would also mean that millions of innocent people would die.

The group heads towards the Triskelion, but are attacked by the Winter Soldier and his men. A battle breaks out, and as Captain America and the Winter Soldier fight, the Winter Soldier's mask is torn off, revealing himself as Roger's former comrade and best friend, Bucky Barnes who Rogers thought was killed during World War II. When Rogers calls out to him, he does not recognize the name. Barnes escapes, and Rogers, Romanoff and Wilson are taken into custody by Rumlow and his men. While in the prison van, one of the guards stuns the other guard, revealing herself to be fellow S.H.I.E.L.D Maria Hill. She then uses a Mouse Hole to cut a hole in the van and escapes with the gang.

Hill takes them to a secret facility where Fury is resting, revealing that the director didn't die, although he was severely injured. Fury had taken an anti-stress serum developed by Banner that lowered his heartbeat to only one beat per minute so that he would appear dead. Hill and Fury tell them that Project Insight is only hours away and that they have to act quickly. The Helicarriers would reach 3000 feet, connect to the Insight Satellites, and zero all their targets before firing. The only way to prevent this is to use three special chips that would take away S.H.I.E.L.D.'s control over the Helicarriers.

Later, Rogers recalls how after the death of his parents Barnes offered him a place to stay so he wouldn't have to cope alone, promising to be there 'until the end of the line'. Wilson warns Rogers that Barnes may not be able to be taken alive, but Rogers vows to save his friend. As Rogers had lost his suit earlier, he breaks into the Smithsonian and steals his old uniform.

Barnes is being prepared for battle, but he starts to ask who "Bucky" is. He sees memories showing how HYDRA found him after falling off the train. Barnes then was taken to Zola who amputated his destroyed left arm and replaced it with a cybernetic one. He also remembers how he was put in cryostasis between missions so that he would not age. Pierce decides he is beginning to remember too much about his past, and they brainwash him again.

The members of the World Security Council arrive at the Triskelion. They are each given badges to wear on their collar that will grant them access to anywhere in the Triskelion. They then meet in Pierce's office. Rogers, Wilson and Hill break into the Triskelion and take control of the communication systems. Rogers reveals to the staff that there are HYDRA infiltrators in S.H.I.E.L.D., led by Pierce, and that they cannot be allowed to initiate Project Insight.

Rumlow and his men enter the control room and threaten the Cameron Klein to launch the Helicarriers. However, Agent 13 intervenes, beginning a gunfight, but Rumlow still manages to get the Helicarriers in the air.

Pierce pulls a gun on Councilman Singh, but Romanoff, using a Photostatic Veil reveals herself to be disguised as Councilwoman Hawley, and stops him. Romanoff begins to upload all of S.H.I.E.L.D. and HYDRA's secure files to the Internet. Pierce, held at gunpoint, informs Romanoff that two Alpha Level clearance members are required to disable the encryption so the files can be uploaded, and there is only one present (Pierce).

Fury, another person with an Alpha Level clearance, arrives on the scene. Fury notes that Pierce probably erased all traces of Fury being the director of S.H.I.E.L.D., but he had made a backup retinal scan using his damaged eye instead of his normal, working eye. Fury and Pierce then scan their retina and use their two Alpha Level clearances to disable the encryption, allowing Romanoff to upload the files.

Rogers and Wilson manage to put in the chips, with some hardship, for two of the Helicarriers, but when Wilson is going for the last one his jetpack is damaged by Barnes, and he is forced to skydive down to the Triskelion. Hill notifies Wilson about Rumlow heading to the council. Wilson intercepts him and the two begin to fight. Rogers attempts to place the final chip, but he is confronted by Bucky. Rogers and the Barnes fight, and during the fight Rogers tries to convince Barnes of his past as his friend.

At Pierce's office, the upload has finished. However, Pierce refuses to be taken in and uses his mobile device to trigger a small device in the security badges on the World Security Council members' collars, instantly killing them by burning a hole in their sternums. Romanoff is spared, and Pierce uses the device on the security badge to threaten Fury and Romanoff into lowering their weapons.

During this time, the Insight Helicarriers have connected with the satellites and are beginning to run Zola's algorithm, scanning for targets. Rogers manages to place the final chip on the Helicarrier seconds before the Insight Helicarriers fire, changing their targets to each other and causing them to shoot each other down. Pierce witnesses the destruction of the Insight Helicarriers. He decides to use the device on the security badge to threaten Romanoff to fly him out of the Triskelion. Romanoff activates a Taser Disk on herself, temporarily disabling the device on the security badge and giving Fury enough time to shoot Pierce and kill him.

Wilson, still fighting with Rumlow, sees the crashing Helicarrier and jumps out of the 41st floor through the window. He is saved by Fury and Romanoff. The chamber where Rogers and Barnes are in is severely damaged by the crossfire between the Helicarriers. Before he passes out, Rogers promises Barnes to be with him 'til the end of the line, reciprocating the promise Barnes gave decades ago. Rogers then falls into the water beneath and is about to drown, when a hand grabs him and drags him from the water. It is Barnes, who then disappears.

Rumlow is buried under rubble but is later seen being attended to by doctors. When Rogers wakes up sometime later, a lot of new events have happened. S.H.I.E.L.D. is unstable at the moment due to HYDRA. Fury is officially dead and he has destroyed all evidence of being alive, even ditching the eye-patch for sunglasses. If somebody would ask what happened with Fury, he wants Rogers to answer that he was dead. Romanoff appeared in a Congressional hearing at United States Capitol with the high ranking members of the United States Department of Defense to discuss who was responsible for S.H.I.E.L.D.'s downfall.

Because all of S.H.I.E.L.D.'s secure files were uploaded to the internet, along with Romanoff's past, she sets out to find herself a new identity after handing Rogers a file with information on Barnes and his experimental origins. Rogers looks at the file. Wilson realizes that Rogers is going to look for Barnes. Rogers decided to start looking for his friend, with the help of Wilson, so that he can convince him of who he really is. Rogers tells him that he doesn't have to go with him. Wilson replies, "I know. When do we start?"

Sometime later, Baron Wolfgang von Strucker is holding the Scepter inside the HYDRA Research Base in Sokovia, stating that there are HYDRA agents worldwide. He then walks over to a pair of cells. He stops in front of them and says, "This is the age of miracles..." One of the cells contains a man who is running around at a tremendous speed. The other one contains a woman who levitates a few blocks before she causes one to explode. The two are said to be the only survivors of a group of volunteers that were subjected to Strucker's experiments.

Meanwhile, Barnes, dressed in civilian clothing, is at the Smithsonian Institution where he finds a whole section of the Captain America display dedicated to him.