Express

0, JWT management, role-based access control, and secure token storage. It gives you routing, middleware, and request handling with minimal opinions about how you structure everything else. MIT license, the most-used Node.js framework by a wide margin.

Express doesn't do much on its own. That's the point. You pick your database, your template engine, your auth strategy, your validation library. It just handles HTTP and gets out of the way. The middleware ecosystem is enormous. Passport for auth, helmet for security headers, cors, body-parser, thousands more.

Fully free. No paid tier, no hosted version, no premium features. It's a 600KB dependency in your package.json. Solo through enterprise, Express works at every scale. The catch is that at scale, 'unopinionated' becomes 'you built a custom framework without realizing it.' Every Express app over a certain size is basically a bespoke framework.

The catch: Express is showing its age. It's callback-based at its core (async/await works but isn't native). Newer frameworks like Hono, Fastify, and Elysia are faster, have better TypeScript support, and were designed for modern JS. Express 5 has been in beta since 2014. If you're starting a new project, look at the alternatives. If you're maintaining an existing Express app, it still works fine.