Guide · Open source

How to use Passport: add login to a Node.js and Express app

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

Passport is an authentication library for Node.js that works with Express. It checks who is making a request by using plugins called strategies, such as username and password or OAuth logins. This guide shows a developer how to install it, configure a strategy, set up sessions and protect a login route.

Passportjaredhanson/passport · ★ 23.5k · MIT Install options & downloads

Quick start

1Install Node.js and npm. Make sure Node.js and npm are available on your machine, since Passport is a Node.js library.
2Install Passport. Run npm install passport in your project folder.
3Configure a strategy. Register a strategy such as Local with passport.use and write a verify function that calls done with the user or false.
4Set up serialization. Add serializeUser and deserializeUser so the logged-in user can be stored in and restored from the session.
5Add Passport middleware. Call passport.initialize() and, for persistent sessions, passport.session() in your Express app.
6Protect the login route. Use passport.authenticate with the strategy name and options such as failureRedirect on your login route.

What Passport does and what it leaves to you

Passport's sole purpose is to authenticate requests. It does not mount routes or assume any particular database schema, so your app decides how users are found and stored.

You give Passport a request to authenticate, and Passport provides hooks for what happens when authentication succeeds or fails.

Passport handles request authentication through strategies.
Your app defines routes, user storage and session logic.
It is not a ready-made login page or a managed identity service.

Install Passport with npm

Passport is installed with a package manager. You need Node.js and npm. Run the install command in your project folder.

$ npm install passport

Configure a strategy

Before authenticating requests, the strategy or strategies your app uses must be configured. The example below uses the Local strategy, which verifies a username and password. The verify function looks up the user and returns the result through the done callback.

Passport has over 480 strategies. Use the Strategy Search at passportjs.org to find others. Commonly used ones include Facebook and Google for OAuth-based login.

Local: username and password via an HTML form.
OpenID: federated authentication.
Facebook and Twitter: delegated authentication using OAuth.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.verifyPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

Set up persistent sessions

Passport can keep users logged in across requests. For this, the authenticated user must be serialized into the session and deserialized on later requests. Passport does not restrict how your user records are stored, so you provide these two functions.

In a typical app, serialize the user ID and find the user by ID when deserializing.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Add the middleware to Express

To use Passport with Express or Connect, add the passport.initialize() middleware. If your app uses persistent login sessions, which the README calls recommended but not required, also add passport.session(). The example also includes cookie parsing, body parsing and express-session, which you set up for your own app.

Replace the placeholder session secret with your own value before you use this in production.

var app = express();
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

Passport provides an authenticate() function that you use as route middleware. In this example, a POST to /login runs the Local strategy. On failure, the user is redirected back to /login. On success, the handler redirects to the home page.

Passport does not create this route for you. You write it, which keeps the behaviour in your control.

app.post('/login',
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

What people use it for

Adding username and password login to an existing Express app.
Adding social login such as Facebook or Google through an OAuth strategy.
Using federated login through OpenID with a strategy from the Passport list.
Letting your team choose its own user database and session logic while Passport checks each request.

Frequently asked questions

Is Passport free to use?

Passport is released under the MIT licence, and its source is published on GitHub. Check the licence file in the repository for the full terms before you use it in a commercial project.

What do I need to install Passport?

The README lists Node.js and npm as prerequisites. Install Passport with npm install passport.

Does Passport come with a login page?

No. Passport is a code library that must be wired into your app. It does not create routes or a login page, so you build those yourself.

Does Passport work without Express?

The README describes Passport as Express-compatible middleware and mentions Connect-based applications. The library is written for Node.js, so projects not using Node.js are not a fit.

Where do I find strategies for Google, Facebook or other providers?

Passport has over 480 strategies. Use the Strategy Search at passportjs.org, or check the table of commonly used strategies in the README, which links to each strategy's repository.

How does Passport compare with Auth.js, Lucia or Keycloak?

Passport is a small, unopinionated authentication layer for request checking, and you manage users and storage yourself. Keycloak is a separate identity service. Auth.js, Lucia and Better Auth are other options for Node.js projects, and you should compare them against your needs.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Passport suits Node.js and Express developers who want to add login to an existing app and keep control of their own user database and sessions. If you want a ready-made login page or a fully managed identity service, pick a different tool such as Keycloak or a hosted provider.

Install options & downloads