Passport
Express-compatible authentication middleware for Node.js that uses pluggable strategies.
- Stars
- 23.5k
- Forks
- 1.2k
- Licence
- MIT
- Language
- JavaScript
- Last update
- 2.2 years ago
- Type
- Library
No commits in over a year — check for forks or alternatives before adopting.
What it is
Passport is authentication middleware for Node.js that works with Express. It handles checking who a request is from, using a set of plugins called strategies, such as username and password or OAuth logins. It does not create routes or dictate how user data is stored; your app decides those details and tells Passport what to do when login succeeds or fails.
- Add a username and password login with the local strategy
- Let users sign in with a third-party provider using an OAuth strategy
- Keep users logged in across requests by serializing them to the session
- Protect Express routes with passport.authenticate() middleware
Great for
- Node.js and Express developers who need to add login to an existing app
- Teams that want to choose their own user database and session logic
- Projects that need social login, OAuth, OpenID, or SAML through an existing strategy
- Developers who want a small, unopinionated authentication layer
Not ideal for
- Non-developers or people looking for a ready-made login page, since it is a code library that must be wired into an app
- Projects not using Node.js, since the library is written for it
- Teams wanting a fully managed identity service, since Passport only handles request authentication and leaves user management to you
How to get it
- 1
Install with a package manager
You'll need: Node.js · npm
Install Passport
$ npm install passport - 2
Run it
- Install passport with npm
- Configure a strategy such as LocalStrategy using passport.use()
- Set up passport.initialize() and passport.session() middleware in your Express app
- Add a route protected by passport.authenticate('local', ...)
- 3
Get the most out of it
- Browse the strategy search on passportjs.org to find integrations for your provider
- Implement serializeUser and deserializeUser for persistent login sessions
- Use failureRedirect and success hooks in authenticate() to control post-login behavior
Downloads
Strengths
- Simple API: pass a request to authenticate and hook into success or failure
- Large ecosystem, with the README citing over 480 strategies
- Does not force a route structure or database schema on your app
Trade-offs
- Strategies are separate packages with varying maintenance, so each must be evaluated individually
- You are responsible for user storage, session security, and other surrounding decisions
- The README is brief on security guidance and details live on the external site
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| passport (this) | 23.5k | Library | intermediate | 2.2 years ago | Node.js and Express developers who need to add login to an existing app |
| lucia | 10.5k | Library | intermediate | 3 months ago | TypeScript developers adding login to a web app |
| better-auth | 30.6k | Library | intermediate | 5 days ago | TypeScript developers who need login and access control in their own app |
| django-allauth | 10.4k | Library | intermediate | 6 days ago | Django developers who need signup and login for a web project |
| fiber | 40.2k | Library | intermediate | 4 days ago | Go developers building REST APIs or web backends |
| hackathon-starter | 35.3k | Library | intermediate | 7 days ago | Developers starting a hackathon project who want a working login system quickly |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.