# @hapi/crumb

@hapi/crumb is an API Security product. It runs on-premises. Pricing is free.

CSRF crumb generation and validation tool for hapi framework.

Checked October 2026.

## What is @hapi/crumb?

CSRF crumb generation and validation for hapi. Crumb is part of the hapi ecosystem and was designed to work seamlessly with the hapi web framework and its other components. It works great on its own or with other frameworks. For tutorials, documentation, and support, visit the hapi.dev Developer Portal.

Tags: Validation, CSRF

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [API Security](https://cybersectools.com/categories/api-security)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 170
- Website: github.com

## Where it ranks

@hapi/crumb is not a pick on the current [Best API Security Solutions for Business](https://cybersectools.com/shortlists/best-api-security-solutions).

## @hapi/crumb FAQ

### What is @hapi/crumb?

@hapi/crumb is a product in the API Security category. It covers Validation and CSRF.

### What is the pricing for @hapi/crumb?

@hapi/crumb is free. Download and setup instructions are at https://github.com/hapijs/crumb/.

### What are alternatives to @hapi/crumb?

Alternatives to @hapi/crumb listed on CybersecTools:

1. [CloudMatos MatosSphere API Security](https://cybersectools.com/tools/cloudmatos-matossphere-api-security) - API security platform for SMBs with threat detection and vulnerability mgmt. (Commercial)
2. [Operant AI API Threat Protection](https://cybersectools.com/tools/operant-ai-api-threat-protection) - Runtime API threat protection for Kubernetes environments with discovery (Commercial)
3. [Prophaze API Security](https://cybersectools.com/tools/prophaze-api-security) - AI-powered API security platform with threat detection and discovery (Commercial)
4. [Corsha Automated Machine Trust](https://cybersectools.com/tools/corsha-automated-machine-trust) - Zero trust API security platform with automated MFA for machine identities (Commercial)
5. [SecureLayer7 BugDazz API Security Scanner](https://cybersectools.com/tools/securelayer7-bugdazz-api-security-scanner) - API security scanner for automated vulnerability detection in CI/CD pipelines (Commercial)

Compare all @hapi/crumb alternatives at [https://cybersectools.com/alternatives/hapicrumb](https://cybersectools.com/alternatives/hapicrumb)

### What deployment and organization size does @hapi/crumb fit?

@hapi/crumb is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

## Compare @hapi/crumb with similar solutions

- [@hapi/crumb vs CloudMatos MatosSphere API Security](https://cybersectools.com/compare/cloudmatos-matossphere-api-security-vs-hapicrumb)
- [@hapi/crumb vs Operant AI API Threat Protection](https://cybersectools.com/compare/hapicrumb-vs-operant-ai-api-threat-protection)
- [@hapi/crumb vs Prophaze API Security](https://cybersectools.com/compare/hapicrumb-vs-prophaze-api-security)

All alternatives to @hapi/crumb: [/alternatives/hapicrumb](https://cybersectools.com/alternatives/hapicrumb)

---

Source: https://cybersectools.com/tools/hapicrumb

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on @hapi/crumb: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md