dalao.ai

Hono

Web framework for any JavaScript runtimeOpen source

About Hono

Hono is a TypeScript web framework built only on Web Standard APIs, so the same code runs on Cloudflare Workers, Deno, Bun, AWS Lambda, Node.js and more, with zero runtime dependencies. As of 2026-10-25 it has 32,679 GitHub stars, v4.13.14 is the latest stable release, and v5 is in release candidates; MIT, no paid tier. Good for edge functions, cross-runtime APIs and typed clients; not a fit for projects that depend on Express middleware or must stay on CommonJS or old Node.

EditorialUpdated 10 min read

What it is

Hono is a web framework written in TypeScript. Its GitHub description is a single line: a web framework built on Web Standards. Requests and responses are the standard Request and Response objects; a route handler receives a context object c and returns the result of c.text(), c.json() or c.html(). Because it uses only Web Standard APIs, the README lists Cloudflare Workers, Fastly Compute, Deno, Bun, Vercel, AWS Lambda, Lambda@Edge and Node.js as targets, and the docs sidebar adds getting-started pages for Netlify, Azure Functions, Google Cloud Run, Supabase Functions and others. Node.js needs one extra adapter package, @hono/node-server.

Web Standards here means the Fetch family of interfaces: Request, Response, URL, URLSearchParams, Headers and so on. Cloudflare Workers, Deno and Bun are built on these interfaces, so a Hono app can be exported directly as a fetch handler there; the docs also say Hono runs on WebAssembly through WASI's wasi:http. Node.js is the opposite case: the Node.js getting-started page says Hono was not designed for Node.js at first and relies on an adapter to turn node:http requests into standard objects.

The README sums up the pitch in four words: ultrafast, lightweight, multi-runtime, batteries included. The core package has no runtime dependencies and ships a router, middleware, JSX rendering, static site generation and a type-safe RPC client. The docs list users including cdnjs, Cloudflare D1 and Workers KV, Unkey, OpenStatus, Clerk's API server and PostHog's MCP server, as reported by the vendor.

As of 2026-10-25 the repository has 32,679 stars and 1,427 forks; main has 2,892 commits, the latest at 2026-10-25 15:17 (UTC+8). The latest stable release, v4.13.14, shipped at 2026-10-25 15:19 (UTC+8). The next major, v5, has two release candidates; the newer, v5.0.0-rc.1, came out at 2026-10-10 20:34 (UTC+8). The npm downloads API shows 48,012,759 downloads of the hono package in the week of 2026-10-16 to 2026-10-22, counted in UTC.

Hono is a small, simple, and ultrafast web framework built on Web Standards. It works on any JavaScript runtime.

Hono README

Core capabilities

First, the router is swappable. Hono ships five routers: RegExpRouter compiles every route into one large regular expression ahead of time and avoids linear loops when matching; TrieRouter uses a prefix tree and supports every route pattern; SmartRouter picks, at startup, whichever candidate router can handle the current route table; LinearRouter has cheap registration and suits environments that initialize the app on every request; PatternRouter is the smallest. Three presets combine them: the default hono wraps RegExpRouter and TrieRouter in SmartRouter, hono/quick targets frequent cold starts, and hono/tiny aims for size, which the README puts under 12kB.

Second, built-in middleware and helpers. Built-in middleware covers Basic and Bearer auth, JWT and JWK, CORS, CSRF protection, IP restriction, body limits, caching, compression, ETag, logging, secure headers, timeouts, request IDs and more; helpers include cookies, streaming, WebSocket, proxying, static site generation and connection info. Integrations for GraphQL, Sentry and various auth services live in third-party middleware maintained by the community.

Third, type inference and RPC. Parameters in route paths are inferred as literal types; once inputs are declared with a validator (Zod works), the server exports its app type and the frontend's hc client gets typed calls without a separate API description or code generation. v4.12.0 added $path() to the client and ApplyGlobalResponse, which infers response types from global middleware.

Fourth, it has grown from APIs toward full-stack. The v4.0.0 release notes are headlined "Going to full-stack" and add static site generation, client components and file-based routing; hono/jsx renders HTML on the server and also has a browser-side DOM implementation. On performance, v4.13.0 rewrote RegExpRouter; the notes say registration plus first match is about 20% faster and the official JSON benchmark is up to 1.25x faster than the previous release (Bun 1.4.0, Apple Silicon). The same release made the HTTP QUERY method (RFC 10008) first-class and added a Method Not Allowed middleware.

Who it's for / Not for

Good fit: developers writing APIs on Cloudflare Workers or other edge function platforms. The motivation page says the author first wanted to build apps on Workers and could not find a suitable framework; cold starts, bundle size and standard APIs were design constraints from the start.

Good fit: teams that move or deploy the same code across Deno, Bun, Node.js, AWS Lambda and other runtimes. Business code only touches Request, Response and the context object, so switching runtimes mostly means switching the entry file and adapter.

Good fit: teams using TypeScript on both ends who want type-safe calls without maintaining an OpenAPI generation pipeline. The RPC client reuses server types directly, so changing an endpoint breaks the frontend build.

Not a fit: older projects that lean on Express middleware or manipulate Node.js req/res objects directly. Inference: Hono's middleware signature and request object differ, Express middleware cannot be carried over, and migrating means rewriting that layer.

Not a fit: large monoliths with many routes that put the whole app into one RPC type. The RPC docs' known-issues section says more routes mean more type instantiation and a slower editor; mismatched Hono versions between frontend and backend also break the types.

Not a fit: projects that must stay on CommonJS or on Node.js below 22.12 for the long term. The v5 migration guide says hono ships ESM only and requires Node.js 22.12 or later on Node.

Not a fit: outside developers who want to contribute code directly. Since 2026-10-05 the contribution guide asks outside contributors to open issues only; pull requests are limited to maintainers.

How it compares

Express is a long-standing Node.js web framework: 69,577 stars as of 2026-10-25, MIT, latest release v5.3.0 at 2026-10-09 20:50 (UTC+8), and 93,967,835 npm downloads in the same week. The Hono docs compare Express's 572KB install size with hono/tiny, a vendor-side comparison. Inference: for Node-only projects with lots of Express middleware, switching frameworks pays off little; for new projects aimed at edge platforms or multiple runtimes, Hono is the smoother choice.

Fastify also targets Node.js: 37,298 stars, MIT, latest release v5.12.7 at 2026-10-13 16:06 (UTC+8), and 10,082,280 downloads that week. Hono's benchmark page lists find-my-way, the router Fastify uses, among the routers compared, but shows the results only as screenshots. Inference: Fastify's plugin system and Node-specific optimizations are more mature and suit long-running services; Hono's edge is portability and bundle size.

A middle path for migration: the hono/mount middleware added in v4.13.13 mounts another framework's handler under a path of a Hono app, with itty-router as the example in the release notes. Inference: as long as the other framework can expose a handler that takes a standard Request, migration can proceed path by path instead of rewriting everything at once.

Elysia is a TypeScript framework: 19,295 stars, MIT, latest release 1.4.30 at 2026-08-27 00:53 (UTC+8), and 949,712 downloads that week. Inference: Elysia treats Bun as its main runtime and also stresses end-to-end types; both fit a Bun-only team, while Hono covers more ground when Workers and Node.js also matter.

For Workers, the Hono benchmark compares itty-router, sunder and worktop: Hono at 402,820 ops/sec, itty-router 212,598, sunder 297,036 and worktop 197,345. These numbers come from versions around Hono 3.0.0 on M1 Pro hardware and are the vendor's own tests.

Getting started

The official scaffolder is npm create hono@latest my-app (yarn, pnpm, bun and deno have equivalents), which prompts for a runtime template. A minimal app is a few lines: new Hono() creates the app, app.get('/', (c) => c.text('Hono!')) registers a route, and export default app hands it to the Workers, Bun or Deno entry point.

On Node.js the template pulls in @hono/node-server and starts with serve(app). The v4 docs require Node.js 18.14.1 or later; serve() wraps node:http and returns the underlying server, so graceful shutdown means the app listens for SIGINT and SIGTERM itself and calls close().

v5 is available early as hono@next, and the migration guide lists the code changes. The main changes: ESM only, with Node.js 22.12 or later; runtime adapters such as hono/bun, hono/deno, hono/cloudflare-workers, hono/aws-lambda and hono/vercel become separate @hono/* packages, and hono/cloudflare-pages is removed; onError() takes a (c, next) signature and reads the error from c.error, and thrown non-Error values also reach onError; c.req.query() may return undefined, c.req.json() returns unknown, and c.json() throws on values that cannot be serialized to JSON; wildcards match the same way in every router. v4.13.13 already deprecated app.mount() in favor of the hono/mount middleware, so that change can already be made on v4.

The contribution guide says development uses pnpm and Bun, and problems and ideas go in issues. The guide also has an AI usage policy: AI may be used, but it must not waste maintainers' time; regardless of whether AI was actually used, a maintainer may close an issue without notice and block the account.

Pricing & license

Hono is entirely free, with no paid edition or hosted service. The LICENSE is MIT, with the copyright holders given as "Yusuke Wada and Hono contributors".

The license history is short: LICENSE arrived on the day the repository was created, in commit fbafc6e at 2021-12-15 04:06 (UTC+8); commit c696953 at 2023-01-02 18:18 (UTC+8) widened the copyright holders from the author alone to the author and all contributors, without changing the license type. The @hono/* adapter packages split out for v5 are also MIT.

Funding comes through GitHub Sponsors; the contribution guide asks supporters to sponsor the two core maintainers, yusukebe and usualoma. Inference: for companies, no commercial support contract means problems are solved through the community and in-house skills.

Risks & limits

Security advisories. As of 2026-10-25, the repository's high-severity advisories include JWT middleware algorithm confusion (unsafe HS256 default, CVSS 8.2, fixed in 4.11.4) published 2026-01-13; client IP spoofing behind AWS Lambda ALB that bypasses restrictions (8.2, fixed in 4.12.2) published 2026-02-23; arbitrary file access via serveStatic (7.5, fixed in 4.12.4) published 2026-03-03; and the CORS middleware reflecting any origin with credentials (7.1, fixed in 4.12.25) published 2026-06-09. Others involve middleware bypasses, cookie and SSE injection, JSX escaping and cross-request cache leaks. The latest, a serveStatic double-decoding issue, was published at 2026-09-29 14:18 (UTC+8) and fixed in 4.13.11. All published advisories list a patched version.

Vulnerabilities are reported through the private reporting button on GitHub's security page.

Maintenance centers on the core maintainers. As of 2026-10-25 the GitHub contributors API shows 1,772 commits from Yusuke Wada, with Taku Amano second at 246. Inference: the core maintainers' time and interest directly set the project's pace, and the contribution guide itself says the project is written for fun.

The benchmarks are dated. The Workers and Deno benchmarks in the docs are based on Hono 3.0.0 and Deno 1.22 on the vendor's own laptop; the v4.13.0 speedups compare only with the previous release.

The major-version switch has costs. ESM only, the adapter split and several API return-type changes in v5 are breaking. The editor performance issue with RPC in large apps is documented officially as a known limitation.

How it got here

The first commit, 4a68b0d, is dated 2021-12-15 03:26 (UTC+8), and the GitHub repository was created the same day at 04:05 (UTC+8). The motivation page says the author wanted to write apps on Cloudflare Workers but lacked a good framework, and used the chance to learn how to build a router with a trie; later a friend contributed RegExpRouter, another wrote the Basic auth middleware, and Deno and Bun support followed.

The first release object, v0.0.7, is from 2022-01-01 14:38 (UTC+8). Later majors: v1.0.0 at 2022-04-22 08:23 (UTC+8), v2.0.0 at 2022-07-16 17:19 (UTC+8), v3.0.0 at 2023-02-18 22:54 (UTC+8). On 2023-01-02 the copyright holders became the author and all contributors. v4.0.0 shipped at 2024-02-09 19:27 (UTC+8) with static site generation, client components and file-based routing.

In 2026, v4.12.0 shipped at 2026-02-19 19:46 (UTC+8); the contribution guide added the AI usage policy at 2026-05-25 05:17 (UTC+8); v4.13.0 shipped at 2026-08-04 05:55 (UTC+8), focused on performance and the HTTP QUERY method. On 2026-09-24 the development package manager moved from Bun to pnpm; commit d4542ee at 2026-10-05 15:49 (UTC+8) limited pull requests to maintainers. From 2026-09-28 separate release objects for @hono/* adapters appeared on GitHub; at 2026-10-08 13:15 (UTC+8) the @hono/* adapters published patch releases at once so hono@next installs cleanly, and at 13:56 (UTC+8) v5.0.0-rc.0 was released on GitHub, followed by rc.1 at 2026-10-10 20:34 (UTC+8). The v4 line is still maintained: v4.13.14 shipped at 2026-10-25 15:19 (UTC+8), with fixes including serveStatic serving only GET and HEAD and adapters accepting v5 prereleases.

Our verdict

Hono sticks to "Web Standards only": a zero-dependency core, swappable routers, broad middleware and a type-safe client without code generation let the same API move between edge functions, Bun, Deno and Node.js. The official docs list usage by Cloudflare and other vendors. Inference: part of the npm downloads come from other tools pulling Hono in as a dependency, so they are not a count of projects using it directly.

Three costs belong in the decision: 2026 has already brought several high-severity advisories that call for prompt upgrades; there is no commercial support; and maintenance sits with a few people, with the outside pull-request channel now closed.

Why it stands out

Hono is a web framework built only on web standards, so the same code runs on Cloudflare Workers, Deno, Bun, and Node.

Yusuke Wada started it to build on Workers and kept it simple as it grew: middleware, typed routes, JSX on the server, and an RPC layer that shares types between server and client.

It has zero dependencies, and its smallest preset, hono/tiny, is under 12 kB.

Sources

Official

  1. honojs/hono on GitHubGitHub · Accessed Oct 25, 2026
  2. Hono READMEGitHub · Accessed Oct 25, 2026
  3. Hono LICENSEGitHub · Accessed Oct 25, 2026
  4. Hono commit c696953: update license, contributors as the copyright holdersGitHub · Accessed Oct 25, 2026
  5. Hono commit 4a68b0d: Initial commitGitHub · Accessed Oct 25, 2026
  6. Hono Contribution GuideGitHub · Accessed Oct 25, 2026
  7. Hono commit d4542ee: docs(contributing): ask for issues instead of PRsGitHub · Accessed Oct 25, 2026
  8. Hono commit 0265a54: docs(contribution): add AI Usage PolicyGitHub · Accessed Oct 25, 2026

Updates & reading