Node.js framework privacy ratings

Web and API frameworks for Node.js. Telemetry and dependencies matter for every app built on them.

19 Node.js frameworks are rated against 4 public criteria, and 19 have enough evidence for a letter grade. Our pick is Koa. Of the 5 with a known jurisdiction, 3 are based in a Five Eyes country, and 4 in the wider Fourteen Eyes.

Open-source Node.js frameworks only · Criteria for this category · Suggest an addition · Markdown

Node.js frameworks privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit
Koa Our pick Minimal web framework for Node.js from the team behind Express, built around async middleware functions.	Grade D	50	100%	–	Yes	No	Yes	No
Express Minimal web framework for Node.js that provides routing and middleware for building web applications and APIs.	Grade A	100	100%	United States Five Eyes	Yes	Yes	Yes	Yes
Fastify Web framework for Node.js focused on low overhead, with a plugin system and JSON schema based validation and serialization.	Grade A	100	100%	United States Five Eyes	Yes	Yes	Yes	Yes
Elysia TypeScript web framework designed for the Bun runtime, with end-to-end type safety and schema validation.	Grade B	80	100%	–	Yes	Yes	Yes	No
Hono Small web framework built on Web Standards that runs on Node.js, Bun, Deno, Cloudflare Workers and other JavaScript runtimes.	Grade B	80	100%	–	Yes	Yes	Yes	No
Nitro Server toolkit for building web servers and APIs in JavaScript and TypeScript, built on h3 and deployable to many hosting platforms and runtimes.	Grade B	80	100%	–	Yes	Yes	Yes	No
Oak Middleware framework for HTTP servers on Deno, Node.js, Bun and Cloudflare Workers, modeled on Koa, with a built-in router.	Grade B	80	100%	–	Yes	Yes	Yes	No
Restify Node.js web service framework for building REST APIs, with a focus on observability and correctness.	Grade B	80	100%	–	Yes	Yes	Yes	No
AdonisJS TypeScript-first MVC web framework for Node.js that includes routing, an ORM, authentication and validation.	Grade D	50	100%	–	Yes	No	Yes	No
Encore.ts TypeScript backend framework with a Rust-based runtime, where APIs and infrastructure such as databases, queues and cron jobs are declared in code.	Grade D	50	100%	Sweden Fourteen Eyes	Yes	No	Yes	No
Feathers TypeScript and JavaScript framework for building real-time applications and REST APIs on Node.js.	Grade D	50	100%	–	Yes	No	Yes	No
LoopBack TypeScript framework for Node.js for building REST APIs and microservices, with OpenAPI support, dependency injection and database connectors.	Grade D	50	100%	United States Five Eyes	Yes	No	Yes	No
Meteor Full-stack JavaScript platform for building web and mobile applications with real-time data on Node.js.	Grade D	50	100%	–	Yes	No	Yes	No
Moleculer Microservices framework for Node.js with service discovery, load balancing, fault tolerance and pluggable message transporters.	Grade D	50	100%	–	Yes	No	Yes	No
NestJS TypeScript framework for building server-side Node.js applications, using modules, dependency injection and decorators on top of Express or Fastify.	Grade D	50	100%	–	Yes	No	Yes	No
Total.js Node.js framework for building web applications, REST services and real-time apps, with no third-party dependencies in its core and built-in NoSQL storage.	Grade D	50	100%	Slovakia Outside Eyes	Yes	No	Yes	No
tRPC TypeScript library for building end-to-end type-safe APIs, sharing types between server and client without schemas or code generation.	Grade D	50	100%	–	Yes	No	Yes	No
Hapi Web framework for Node.js for building applications and services, with built-in input validation, caching and authentication support.	Grade D	40	100%	–	Yes	No	Partial	No
Sails MVC web framework for Node.js built on Express, with auto-generated REST APIs, WebSocket support and the Waterline ORM.	Grade D	40	100%	–	Yes	No	Partial	No

Questions

What is the most private option among Node.js frameworks?

Our pick is Koa. A small core built on async middleware, from the team behind Express. MIT licensed, with no telemetry.

How are Node.js frameworks rated?

Each entry answers 4 questions: open source, no trackers or telemetry, no ads or data sales and independent audit. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.