# express-brute

express-brute is an API Security product. It runs on-premises. Pricing is free.

A brute-force protection middleware for express routes that rate-limits incoming requests.

Checked October 2026.

## What is express-brute?

A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence. Installation via npm: $ npm install express-brute

A Simple Example
var ExpressBrute = require('express-brute');
// stores state locally, don't use this in production
var store = new ExpressBrute.MemoryStore();
var bruteforce = new ExpressBrute(store);
app.post('/auth', bruteforce.prevent, // error 429 if we hit this route too often
function (req, res, next) {
res.send('Success!');
});

Classes
ExpressBrute(store, options)
store An instance of ExpressBrute.MemoryStore or some other ExpressBrute store (see a list of known stores below).
options
freeRetries The number of retries the user has before they need to start waiting (default: 2)
minWait The initial wait time (in milliseconds) after the user runs out of retries (default: 500 milliseconds)
maxWait The maximum amount of time (in milliseconds) between requests the user needs to wait (default: 15 minutes). The wait for a given request is determined by adding the time the user needed to wait for the previous two requests.
lifetime The length of time (in seconds)

Tags: Brute Force

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [API Security](https://cybersectools.com/categories/api-security)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 568
- Website: github.com

## Where it ranks

express-brute is not a pick on the current [Best API Security Solutions for Business](https://cybersectools.com/shortlists/best-api-security-solutions).

## express-brute FAQ

### What is express-brute?

express-brute is a product in the API Security category. It covers Brute Force.

### What is the pricing for express-brute?

express-brute is free. Download and setup instructions are at https://github.com/AdamPflug/express-brute/.

### What are alternatives to express-brute?

Alternatives to express-brute listed on CybersecTools:

1. [CloudMatos MatosSphere API Security](https://cybersectools.com/tools/cloudmatos-matossphere-api-security) - API security platform for SMBs with threat detection and vulnerability mgmt. (Commercial)
2. [Operant AI API Threat Protection](https://cybersectools.com/tools/operant-ai-api-threat-protection) - Runtime API threat protection for Kubernetes environments with discovery (Commercial)
3. [Prophaze API Security](https://cybersectools.com/tools/prophaze-api-security) - AI-powered API security platform with threat detection and discovery (Commercial)
4. [Corsha Automated Machine Trust](https://cybersectools.com/tools/corsha-automated-machine-trust) - Zero trust API security platform with automated MFA for machine identities (Commercial)
5. [SecureLayer7 BugDazz API Security Scanner](https://cybersectools.com/tools/securelayer7-bugdazz-api-security-scanner) - API security scanner for automated vulnerability detection in CI/CD pipelines (Commercial)

Compare all express-brute alternatives at [https://cybersectools.com/alternatives/express-brute](https://cybersectools.com/alternatives/express-brute)

### What deployment and organization size does express-brute fit?

express-brute is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare express-brute with similar solutions

- [express-brute vs CloudMatos MatosSphere API Security](https://cybersectools.com/compare/cloudmatos-matossphere-api-security-vs-express-brute)
- [express-brute vs Operant AI API Threat Protection](https://cybersectools.com/compare/express-brute-vs-operant-ai-api-threat-protection)
- [express-brute vs Prophaze API Security](https://cybersectools.com/compare/express-brute-vs-prophaze-api-security)

All alternatives to express-brute: [/alternatives/express-brute](https://cybersectools.com/alternatives/express-brute)

---

Source: https://cybersectools.com/tools/express-brute

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on express-brute: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md