
Hono review
Small web framework built on Web Standards that runs the same code on Cloudflare Workers, Bun, Deno, Node.js and AWS Lambda
Verdict
Hono is a good fit for APIs that must run on Cloudflare Workers, Bun, Deno, Lambda and Node.js from one codebase, with JWT, CORS and other middleware in the core and typed RPC and OpenAPI through official packages. The catch is that it is a router and middleware toolkit rather than a full framework, and its middleware and adapters had a steady run of security advisories over the past year, so stay on recent patch releases.
Best for
Teams building APIs for edge runtimes, serverless functions or more than one JavaScript runtime
Not for
Teams that want a structured framework with modules, dependency injection and a data layer
Pros
- Same code runs on Workers, Bun, Deno, Lambda and Node.js
- Auth, CORS, caching and security headers are built in
- Typed client from server routes without code generation
- No runtime dependencies
Cons
- Many security fixes in middleware and adapters over the past year
- No project structure or data layer, you assemble those yourself
- Version 5 is in release candidate with breaking changes
“de-facto new express with proper typescript support”
Hacker News, Jul 2026“setting up my context types is slightly more of a pain”
Hacker News, Nov 2025
Is Hono right for your project?
Describe what you need and AI will check the fit against this review.
Hono features and capabilities
One codebase for many runtimes
Hono uses the Web Standard Request and Response, so the same app can move between Cloudflare Workers, Lambda, Bun and Node.js with only the entry file changing.
Middleware in the core
JWT, bearer and basic auth, CORS, body limits, caching, ETag and secure headers ship with the hono package, so a typical API needs few extra dependencies.
Schema validation
Bodies, queries, params and headers can be checked with Zod, Valibot, ArkType or any Standard Schema library through official validator packages, and the types flow into handlers.
RPC client
Exporting the app type lets the hc client call routes with typed inputs and outputs, which suits teams that own both the front end and the API.
OpenAPI from Zod schemas
The @hono/zod-openapi package defines routes with Zod schemas and produces an OpenAPI document, and @hono/swagger-ui serves it.
- TypeScript firstWritten in TypeScript or ships its own types, with typed routes or handlers
- Yes
- Request validationValidates bodies, params or queries against a schema, in the core or an official package
- YesBuilt-in validator plus official Zod and Standard Schema packages
- OpenAPI docsGenerates an OpenAPI spec or Swagger UI from routes
- YesOfficial @hono/zod-openapi package
- Beyond Node.jsOfficially runs on Bun, Deno or edge runtimes such as Cloudflare Workers
- YesBun, Deno, Cloudflare Workers, Fastly, Lambda, Vercel, Netlify
- WebSocketsBuilt in or through an official plugin
- YesWebSocket helper per runtime; Node.js via @hono/node-server
- Project structureModules, dependency injection or a fixed layout, not only routing
- PartlyOptional @hono/tsyringe DI middleware, no fixed layout
- Database layerAn official ORM, query builder or data layer
- No
- AuthenticationAn official auth module, plugin or strategy system
- YesBuilt-in basic, bearer, JWT and JWK middleware
At a glance
- Type
- Multi-runtime web framework
- Stack
- TypeScript / Node.js 20+, Bun, Deno, Cloudflare Workers
Free vs paid editions
What you get when you self-host, and what needs a paid plan.
Hono and its middleware packages are free and have no paid edition or official hosting.
Running Hono
Hono needs Node.js 20 or later with the @hono/node-server adapter, or Bun, Deno or a Workers-style runtime; the coming version 5 needs Node.js 22.12.
New cloud server to ready
2 s
Memory in use at idle
80 MB of 4 GB
Reads per second
18,397
Writes per second
10,867
Startup
0.40 s
Version tested
4.13.14 · Oct 31, 2026
- Hono itself has no dependencies, so the whole install was Hono, its Node.js adapter, the Zod validator and Zod: 4 packages, 13 MB, 2 seconds.
- It started fastest, in 0.40 seconds, and reads had a 4.3 ms latency at the 99th percentile.
- The default validation error puts Zod's issue list inside a string, so clients get escaped JSON. A hook on zValidator can return a cleaner body.
- Malformed JSON returned a plain-text error rather than JSON.
import { Hono } from "hono";
import { serve } from "@hono/node-server";
import { zValidator } from "@hono/zod-validator";
import { z } from "zod";
// 100 items kept in memory, so the test measures the framework, not a database.
const items = new Map();
for (let i = 1; i <= 100; i++) items.set(i, { id: i, name: `Item ${i}`, price: i * 1.5, tags: ["sample"] });
let nextId = 101;
const Item = z.object({ name: z.string().min(1).max(100), price: z.number().min(0), tags: z.array(z.string()).max(10).optional() });
const app = new Hono();
app.get("/health", (c) => c.json({ status: "ok" }));
app.get("/items/:id", (c) => {
const item = items.get(Number(c.req.param("id")));
if (!item) return c.json({ error: "Not found" }, 404);
return c.json(item);
});
app.post("/items", zValidator("json", Item), (c) => {
const item = { id: nextId++, ...c.req.valid("json") };
items.set(item.id, item);
return c.json(item, 201);
});
serve({ fetch: app.fetch, port: Number(process.env.PORT ?? 3000), hostname: "127.0.0.1" });{
"success": false,
"error": {
"name": "ZodError",
"message": "[\n {\n \"origin\": \"string\",\n \"code\": \"too_small\",\n \"minimum\": 1,\n \"inclusive\": true,\n \"path\": [\n \"name\"\n ],\n \"message\": \"Too small: expected string to have >=1 characters\"\n },\n {\n \"origin\": \"number\",\n \"code\": \"too_small\",\n \"minimum\": 0,\n \"inclusive\": true,\n \"path\": [\n \"price\"\n ],\n \"message\": \"Too small: expected number to be >=0\"\n }\n]"
}
}What you can do with Hono
APIs on Cloudflare Workers
Build an edge API on Workers with JWT auth and CORS from the core package, and keep the option to run it on Node.js later.
Express replacement on Node.js
Move an Express API to Hono through @hono/node-server to get typed routes, Zod validation and an OpenAPI document.
Serverless functions
Run the same router in AWS Lambda, Vercel or Netlify functions using the official adapters.