Licence
modest-auth is free software under the MIT License, copyright © 2026 Modest Industries Ltd. You may use, copy, change, and share it, as long as you keep the copyright notice and the licence with it.
No warranty
As the licence says:
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
modest-auth has not been independently audited. Nothing on this site or in the repository promises that it is secure, free of faults, or right for your needs.
Your responsibility
If you use modest-auth, you are responsible for:
- deciding whether it is suitable for what you are building;
- testing it, keeping it up to date, and running it securely;
- the accounts, passwords, and other data your app stores, and any loss or breach of them; and
- meeting the laws that apply to you, such as data protection law.
Liability
As far as the law allows, the authors and contributors are not liable for any loss or damage arising from your use of modest-auth or of this site, including loss of data, revenue, or profit, security breaches, or any indirect or consequential loss. Nothing here limits liability that cannot be limited by law.
Not advice
The docs and the security page describe how modest-auth works. They are not security, legal, or compliance advice.
Other people's work
- The list of common passwords comes from SecLists (MIT License), including a list published by the UK National Cyber Security Centre.
- The site is styled with modest-ui (MIT License).
- Node.js is a trademark of the OpenJS Foundation. Express, Fastify, Bun, Deno, and other names belong to their owners. Naming them doesn't mean they endorse modest-auth.
- Links to other sites are for convenience. We aren't responsible for what they contain.
This site and your data
This site sets no cookies, runs no scripts, and has no analytics. It is hosted on GitHub Pages, and GitHub may log visitors' IP addresses; see GitHub's privacy statement.
Contact
Open an issue on GitHub. To report a vulnerability, please follow the security page instead.