We help you understand security and keep your app safe.
Start with our free OWASP toolkit to see where you stand and learn what to fix. Then add ready to use open-source libraries that do the hard work for you.
MIT licensed · OWASP aligned · Node.js 18+
Login protection: breached password checks, brute force lockout, secure hashing.
- Blocks breached passwords at signup
- Rate limiting and account lockout
- bcrypt and Argon2 hashing built in
Token security: JWT issuance, refresh rotation, and session revocation.
- Access and refresh JWT issuance
- Refresh token rotation (RTR)
- Fail shut verification and revocation
Choose your character
Security can feel hard, whether you build for clients, for a job, or for a whole business. It does not have to be. Pick the card that sounds like you and see the fixes made for your situation.
Learn by doing
Browser-based tools to measure your app against OWASP standards and see exactly where your gaps are. No sign-up, no tracking.
OWASP ASVS Explorer
All 17 chapters of the OWASP ASVS 5.0 in plain English. See what each chapter checks, why it matters, filter by level, and track your own coverage.
Explore it free →Security Checklist
Pick what you are building: login, API, file uploads, admin panel. Get a tailored OWASP-based checklist, mark what is done, and see exactly where your gaps are.
Try it free →How Secure Is Your Stack?
10 questions across authentication, sessions, and data handling. Takes 2 minutes. Get a risk score and a prioritised list of what to fix in your stack.
Try it free →Two libraries. One security standard.
OWASP-aligned, drop-in security for Node.js. Each package owns one job and traces every control to a specific OWASP standard.
owlauth
@restingowlorg/owlauthCredential stuffing prevention, breached-password detection, brute force protection, passwordless magic links and security audit logging in one consistent API.
owltokenguard
@restingowlorg/owltokenguardJWT access and refresh issuance, refresh-token rotation, fail-shut verification and session revocation, with Express and Fastify middleware.
Active Threats
Recent CVE advisories and exploit alerts from the RestingOwl security desk.
Build with the RestingOwl community
Follow the roadmap, help shape new packages, and learn security the practical way. Free and open to every developer.