Authentication and authorisation

12-month change compares the average of the last 4 weeks of downloads with the first 4 weeks of the 52-week series. Gzip size is for the whole package, as measured by Bundlephobia. "-" means the value has not been fetched.

• socketio-jwtauthenticate socket.io connections using JWTs
• zxcvbn-typescriptrealistic password strength estimation, updated and ported to Typescript from Dan Wheeler's zxcvbn
• node-sp-authUnattended SharePoint http authentication with nodejs
• @castlenine/svelte-qrcodeQR Code generator component for Svelte & SvelteKit, with no dependencies
• google-oauth-jwtImplementation of Google OAuth 2.0 for server-to-server interactions, allowing secure use of Google APIs without interaction from an end-user.
• @sagi.io/workers-jwtGenerate JWTs on Cloudflare Workers using the WebCrypto API
• passport-dropbox-oauth2Dropbox OAuth 2.0 authentication strategy for Passport.
• @outlinewiki/passport-azure-ad-oauth2Passport strategy for authenticating with Azure AD using the OAuth 2.0 protocol.
• htpasswdNode.js package for HTTP Basic Authentication password file utility.
• passport-localapikey-updateUpdated version of local api key authentication strategy for Passport originally created by Sudhakar Mani.
• @tinytars/frameDomain-neutral Svelte app-shell: session/auth controllers, account chrome, and menu/card/modal primitives built on @tinytars/vault.
• @oxy.so/coreOxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities
• expo-passkeyPasskey authentication for Expo apps with Better Auth integration
• role-aclRole, Attribute and Condition based Access Control for Node.js
• @askalf/darioUse your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic fa
• pusher-js-authPusher plugin for batching auth requests in one HTTP call
• @unisim/sdkShared React SDK for the Universal Suite — auth, entitlements, usage telemetry, changelog, org admin.
• @stacksjs/authA more simplistic way to authenticate.
• remix-auth-okta  # OktaStrategy
• @coji/remix-auth-google<!-- Description -->
• passport-vkontakteVK.com authentication strategy for Passport.
• 2faTOTP + HOTP library, with nice utilities for handing 2FA
• @adobe/aio-lib-core-authAdobe I/O Core Authentication Library
• react-auth-kitAuthentication Library for React, which makes Token based auth very easy
• socketio-authAuthentication for socket.io
• nuxt-vue3-google-signin[](https://github.com/wavezync/nuxt-vue3-google-signin/actions/workflows/build.yaml) [](https:/
• @access-tokens/expressExpress routes and middleware for personal access token authentication
• express-oauth-serverOAuth provider for express
• js-pkceA package that makes using the OAuth2 PKCE flow easier
• passport-okta-oauthPassport strategy for authenticating with Okta using OAuth 2.0.
• angular2-jwtHelper library for handling JWTs in Angular 2+
• next-firebase-authSimple Firebase authentication for all Next.js rendering strategies
• @workos/authkit-astroOfficial WorkOS AuthKit SDK for Astro
• google-services-mcpMCP server for Google consumer services — Gmail, Calendar, Meet, Drive, Contacts, Tasks, Sheets, Docs, Slides, YouTube, Forms — with multi-account OAuth support.
• @commercelayer/js-authA JavaScript library designed to simplify authentication when interacting with the Commerce Layer API.
• @blamejs/coreThe Node framework that owns its stack.
• @auth/upstash-redis-adapterUpstash adapter for Auth.js.
• passport-google-tokenGoogle token authentication strategy for Passport.
• node-ntlm-clientA node.js NTLM client with support for NTLM and NTLMv2 authentication
• pouchdb-authA PouchDB plug-in that simulates CouchDB's authentication daemon. Includes a users db that functions like CouchDB's.
• @accounts/serverFullstack authentication and accounts-management
• @happyvertical/smrt-svelteSvelte 5 components for SMRT user management - auth, users, tenants, roles, permissions, groups
• @mcpjam/cliTest, debug, and validate MCP servers — health checks, OAuth conformance, tool-surface diffing, and structured triage from the terminal or CI
• @dramaorg/delectus-culpa-reprehenderit[![github actions][actions-image]][actions-url] [![coverage][codecov-image]][codecov-url] [![dependency status][deps-svg]][deps-url] [![dev dependency status][dev-deps-svg]][dev-deps-url] [![License][license-image]][license-url] [![Downloads][downloads-im
• git-workspace-serviceGit workspace provisioning and credential management service with OAuth device flow authentication
• react-native-fingerprint-scannerReact Native Biometrics Scanner for Android and iOS
• mask-sensitive-dataMask sensitive data, eg. credit card numbers, phone numbers, emails, UUIDs, JWT tokens.
• @constructive-io/express-contextExtractable Express middleware for Constructive tenant context — domain resolution, JWT auth, pgSettings, and withPgClient
• hypertune[Hypertune](https://www.hypertune.com/) is the most flexible platform for feature flags, A/B testing, analytics, and app configuration. Built with full end-to-end type safety, Git-style version control and local, synchronous, in-memory flag evaluation. Op
• mcp-google-multiLocal MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.

• bcryptjs vs bcrypt
• zxcvbn vs @zxcvbn-ts/core
• next-auth vs @clerk/nextjs
• @clerk/nextjs vs auth0-js