1 
2For years, picking a JavaScript web framework meant accepting a tradeoff: Express was universal but slow and Node-bound, Fastify was fast but Node-only, Next.js was full-featured but heavy. When edge runtimes arrived - Cloudflare Workers, Deno Deploy, Bun, Vercel Edge - those frameworks showed their limits: incompatible dependencies, huge bundles, APIs tied to Node's `req`/`res`.
3 
4[Hono](https://hono.dev) (Japanese for "flame" 🔥) is the modern answer. It's a sub-14KB framework built entirely on Web Standards (`Request`, `Response`, `fetch`) that runs anywhere a JavaScript runtime exists. The same code deploys to Cloudflare Workers, Bun, Deno, Node.js, Vercel, Netlify, and AWS Lambda - without changes.
5 
6## Why Hono
7 
8Hono does three things better than anyone else:
9 
101. **Performance.** The `RegExpRouter` compiles every route pattern into a single regex, avoiding the linear loops of traditional routers. Benchmarks show over 400,000 ops/s, putting Hono among the fastest routers in the JavaScript ecosystem.
112. **Portability.** Web Standards means zero Node dependencies. The same `app.fetch` is exported as the default in a Cloudflare Worker, passed to `Bun.serve`, mounted in a Deno server, or adapted with `@hono/node-server`.
123. **TypeScript-first DX.** Path parameters typed as literals, end-to-end type-safe RPC client, validators that infer input and output types. Autocomplete is almost telepathic.
13 
14```mermaid
15graph LR
16    Client[Client] -->|Request| App[app.fetch]
17    App --> MW1[Middleware 1]
18    MW1 --> MW2[Middleware 2]
19    MW2 --> Router[RegExpRouter]
20    Router --> Handler[Route Handler]
21    Handler --> Context[c.json / c.text]
22    Context -->|Response| Client
23    App -.->|deploy| CF[Cloudflare Workers]
24    App -.->|deploy| Bun[Bun]
25    App -.->|deploy| Deno[Deno]
26    App -.->|deploy| Node[Node.js]
27    App -.->|deploy| Vercel[Vercel]
28```
29 
30## Getting Started
31 
32The fastest path is the official starter, which scaffolds the project for your chosen runtime.
33 
34```bash
35npm create hono@latest my-api
36cd my-api
37npm install
38npm run dev
39```
40 
41The starter prompts for a template: `cloudflare-workers`, `bun`, `deno`, `nodejs`, `vercel`, `aws-lambda`, `nextjs`, and more. It picks the right config and deploy scripts. To try it on the fly, you can also start from a single file:
42 
43```typescript
44// src/index.ts
45import { Hono } from 'hono'
46 
47const app = new Hono()
48 
49app.get('/', (c) => c.text('Hello Hono!'))
50 
51export default app
52```
53 
54On Cloudflare Workers this is enough. On Bun: `Bun.serve({ fetch: app.fetch, port: 3000 })`. On Node: `serve({ fetch: app.fetch })` from `@hono/node-server`. The surface is identical.
55 
56## Routing
57 
58Routes are declared with HTTP verb methods and support parameters, wildcards, and regex.
59 
60```typescript
61import { Hono } from 'hono'
62 
63const app = new Hono()
64 
65app.get('/', (c) => c.text('Home'))
66app.get('/posts/:id', (c) => {
67  const id = c.req.param('id') // string, typed
68  return c.json({ id })
69})
70app.get('/posts/:id/comments/:commentId', (c) => {
71  const { id, commentId } = c.req.param()
72  return c.json({ id, commentId })
73})
74app.get('/files/*', (c) => c.text('Wildcard'))
75app.post('/posts', async (c) => {
76  const body = await c.req.json()
77  return c.json({ created: body }, 201)
78})
79```
80 
81Parameters are inferred as literal types: TypeScript knows `c.req.param('id')` returns a `string` only if you declared `:id` in the pattern. Misspelling it is a compile-time error.
82 
83### Grouping routes
84 
85`app.route()` lets you compose sub-applications as modules, each with its own prefix.
86 
87```typescript
88// routes/posts.ts
89import { Hono } from 'hono'
90 
91const posts = new Hono()
92posts.get('/', (c) => c.json({ posts: [] }))
93posts.get('/:id', (c) => c.json({ id: c.req.param('id') }))
94export default posts
95 
96// src/index.ts
97import { Hono } from 'hono'
98import posts from './routes/posts'
99 
100const app = new Hono()
101app.route('/posts', posts)
102```
103 
104Nested routes inherit the base path and the type of the root app, so the RPC client sees the entire structure.
105 
106## The Context object
107 
108Every handler receives a `c` - the Context for the current request. It's the only API you need to learn to read inputs and produce outputs.
109 
110```typescript
111app.post('/echo', async (c) => {
112  // Read
113  const userAgent = c.req.header('User-Agent')
114  const page = c.req.query('page')
115  const body = await c.req.json()
116  const env = c.env // bindings (KV, D1, secrets on Cloudflare)
117 
118  // Variables shared between middleware and handler
119  c.set('requestId', crypto.randomUUID())
120  const id = c.get('requestId')
121 
122  // Response
123  c.header('X-Request-Id', id)
124  c.status(200)
125  return c.json({ userAgent, page, body, id })
126})
127```
128 
129The main response methods are `c.text`, `c.json`, `c.html`, `c.body` (raw), and `c.redirect`. All accept a status code as a second argument.
130 
131## Middleware: the onion model
132 
133Middleware are `(c, next) => ...` functions that can run code before and after the handler. Composed, they form the classic onion model: the first registered middleware is the first to start and the last to finish.
134 
135```typescript
136import { Hono } from 'hono'
137import { logger } from 'hono/logger'
138import { cors } from 'hono/cors'
139import { secureHeaders } from 'hono/secure-headers'
140 
141const app = new Hono()
142 
143app.use('*', logger())
144app.use('*', secureHeaders())
145app.use('/api/*', cors({ origin: 'https://spinny.dev' }))
146 
147app.use('*', async (c, next) => {
148  const start = performance.now()
149  await next()
150  c.header('X-Response-Time', `${performance.now() - start}ms`)
151})
152```
153 
154`await next()` yields control to the next middleware. Anything after it runs on the response phase, after the handler has produced a result. Returning a `Response` before `next()` short-circuits the chain.
155 
156### Built-in middleware
157 
158Hono ships with a rich set of production-ready middleware, importable from `hono/...`:
159 
160| Middleware | Purpose |
161|-----------|---------|
162| `logger` | Structured logs of method, path, status, duration |
163| `cors` | CORS configurable by origin, methods, headers |
164| `csrf` | Origin-based CSRF protection |
165| `secureHeaders` | Sets CSP, HSTS, X-Frame-Options |
166| `bearerAuth` / `basicAuth` | Out-of-the-box Bearer/Basic auth |
167| `jwt` | JWT verify/sign with `jose` |
168| `etag` | Generates ETag and handles 304 |
169| `cache` | Web Cache API caching |
170| `compress` | gzip/deflate response |
171| `bodyLimit` | Reject bodies above a threshold |
172| `timing` | Server-Timing header for profiling |
173 
174### Type-safe custom middleware
175 
176To extend the `Context` with typed variables, use `createMiddleware`:
177 
178```typescript
179import { createMiddleware } from 'hono/factory'
180 
181type AuthVars = { userId: string; role: 'user' | 'admin' }
182 
183export const requireAuth = createMiddleware<{ Variables: AuthVars }>(
184  async (c, next) => {
185    const token = c.req.header('Authorization')?.replace('Bearer ', '')
186    if (!token) return c.json({ error: 'Unauthorized' }, 401)
187 
188    const payload = await verifyJwt(token)
189    c.set('userId', payload.sub)
190    c.set('role', payload.role)
191    await next()
192  }
193)
194 
195// Usage
196app.get('/me', requireAuth, (c) => {
197  const userId = c.var.userId // string, typed
198  return c.json({ userId })
199})
200```
201 
202Downstream of the middleware, `c.var.userId` is typed without any cast. This propagates through the entire chain.
203 
204## Validation with Zod
205 
206`@hono/zod-validator` plugs Zod into the request cycle. You define a schema, apply it to the route, and get already-validated, typed inputs.
207 
208```typescript
209import { Hono } from 'hono'
210import { zValidator } from '@hono/zod-validator'
211import { z } from 'zod'
212 
213const createPost = z.object({
214  title: z.string().min(1).max(200),
215  body: z.string().min(1),
216  tags: z.array(z.string()).default([]),
217})
218 
219app.post(
220  '/posts',
221  zValidator('json', createPost),
222  (c) => {
223    const data = c.req.valid('json') // typed by the schema
224    return c.json({ ok: true, post: data }, 201)
225  }
226)
227```
228 
229If the body fails validation, Hono replies 400 with the Zod error before even calling the handler. You can also validate `query`, `param`, `header`, `cookie`, and `form`.
230 
231## RPC: end-to-end type-safe client
232 
233The feature that truly sets Hono apart is **RPC mode**. Export your app's type from the server, the `hc` client imports it, and you get full autocomplete - including paths, query, body, headers, and response - with no codegen or OpenAPI.
234 
235```typescript
236// server.ts
237import { Hono } from 'hono'
238import { zValidator } from '@hono/zod-validator'
239import { z } from 'zod'
240 
241const app = new Hono()
242  .get('/posts/:id', (c) =>
243    c.json({ id: c.req.param('id'), title: 'Hello' })
244  )
245  .post(
246    '/posts',
247    zValidator('json', z.object({ title: z.string(), body: z.string() })),
248    (c) => c.json({ ok: true }, 201)
249  )
250 
251export type AppType = typeof app
252export default app
253```
254 
255```typescript
256// client.ts
257import { hc } from 'hono/client'
258import type { AppType } from './server'
259 
260const client = hc<AppType>('https://api.spinny.dev')
261 
262const res = await client.posts[':id'].$get({ param: { id: '42' } })
263if (res.ok) {
264  const data = await res.json() // { id: string, title: string }
265  console.log(data.title)
266}
267 
268const created = await client.posts.$post({
269  json: { title: 'Hello', body: 'Hono is a flame' }, // validated
270})
271```
272 
273Rename a route on the server and the client TypeScript breaks immediately in CI. Same advantage as tRPC, but over standard HTTP, with no specific middleware, and a tiny bundle.
274 
275### Discriminating status codes
276 
277If you return different statuses, the client discriminates them automatically.
278 
279```typescript
280.get('/posts/:id', (c) => {
281  const post = findPost(c.req.param('id'))
282  if (!post) return c.json({ error: 'not found' }, 404)
283  return c.json({ post }, 200)
284})
285```
286 
287```typescript
288const res = await client.posts[':id'].$get({ param: { id } })
289if (res.status === 404) {
290  const { error } = await res.json() // { error: string }
291}
292if (res.status === 200) {
293  const { post } = await res.json() // { post: Post }
294}
295```
296 
297## Routers and performance
298 
299Hono offers five routers with different tradeoffs. The default is `SmartRouter`, which on startup measures which router serves your routes best and locks in.
300 
301| Router | Strengths | When to use |
302|--------|-----------|-------------|
303| `RegExpRouter` | Top speed, compiled regex | Default for most APIs |
304| `TrieRouter` | Supports every pattern | Complex patterns RegExp can't handle |
305| `SmartRouter` | Picks the best automatically | Recommended default |
306| `LinearRouter` | Ultra-fast registration | One-shot workers, cold-start critical |
307| `PatternRouter` | Smallest bundle (<15KB) | Extreme size constraints |
308 
309For stateless workers with frequent cold starts, `LinearRouter` skips the initial compilation cost and is 33x faster than `find-my-way` when measuring registration plus matching.
310 
311```typescript
312import { Hono } from 'hono'
313import { LinearRouter } from 'hono/router/linear-router'
314 
315const app = new Hono({ router: new LinearRouter() })
316```
317 
318## Multi-runtime deployment
319 
320The same `export default app` changes target by swapping only the entry file.
321 
322### Cloudflare Workers
323 
324```typescript
325// src/index.ts
326import { Hono } from 'hono'
327 
328type Bindings = { MY_KV: KVNamespace; DB: D1Database }
329const app = new Hono<{ Bindings: Bindings }>()
330 
331app.get('/cache/:key', async (c) => {
332  const value = await c.env.MY_KV.get(c.req.param('key'))
333  return c.json({ value })
334})
335 
336export default app
337```
338 
339Deploy: `npx wrangler deploy`. KV/D1/R2/Queues bindings are native.
340 
341### Bun
342 
343```typescript
344import { Hono } from 'hono'
345const app = new Hono()
346app.get('/', (c) => c.text('Bun + Hono'))
347 
348Bun.serve({ fetch: app.fetch, port: 3000 })
349```
350 
351### Node.js
352 
353```typescript
354import { serve } from '@hono/node-server'
355import { Hono } from 'hono'
356 
357const app = new Hono()
358app.get('/', (c) => c.text('Node + Hono'))
359 
360serve({ fetch: app.fetch, port: 3000 })
361```
362 
363### Deno
364 
365```typescript
366import { Hono } from 'jsr:@hono/hono'
367const app = new Hono()
368app.get('/', (c) => c.text('Deno + Hono'))
369Deno.serve(app.fetch)
370```
371 
372### Vercel
373 
374```typescript
375// api/[[...route]].ts
376import { Hono } from 'hono'
377import { handle } from 'hono/vercel'
378 
379const app = new Hono().basePath('/api')
380app.get('/hello', (c) => c.json({ msg: 'Hello from Vercel' }))
381 
382export const GET = handle(app)
383export const POST = handle(app)
384```
385 
386Same business code, same routing, same middleware. Only the adapter changes.
387 
388## Real-world example: REST API with auth and DB
389 
390Putting it together. A blog API on Cloudflare Workers + D1, with JWT auth, validation, and RPC.
391 
392```typescript
393import { Hono } from 'hono'
394import { jwt } from 'hono/jwt'
395import { logger } from 'hono/logger'
396import { cors } from 'hono/cors'
397import { zValidator } from '@hono/zod-validator'
398import { z } from 'zod'
399 
400type Bindings = { DB: D1Database; JWT_SECRET: string }
401type Variables = { jwtPayload: { sub: string } }
402 
403const app = new Hono<{ Bindings: Bindings; Variables: Variables }>()
404 
405app.use('*', logger())
406app.use('/api/*', cors({ origin: 'https://spinny.dev', credentials: true }))
407 
408const auth = (c: any, next: any) =>
409  jwt({ secret: c.env.JWT_SECRET })(c, next)
410 
411const api = app.basePath('/api')
412 
413api.get('/posts', async (c) => {
414  const { results } = await c.env.DB
415    .prepare('SELECT id, title, created_at FROM posts ORDER BY created_at DESC LIMIT 50')
416    .all()
417  return c.json({ posts: results })
418})
419 
420api.post(
421  '/posts',
422  auth,
423  zValidator('json', z.object({
424    title: z.string().min(1).max(200),
425    body: z.string().min(1),
426  })),
427  async (c) => {
428    const { title, body } = c.req.valid('json')
429    const userId = c.var.jwtPayload.sub
430    const result = await c.env.DB
431      .prepare('INSERT INTO posts (title, body, author_id) VALUES (?, ?, ?) RETURNING id')
432      .bind(title, body, userId)
433      .first<{ id: number }>()
434    return c.json({ id: result?.id }, 201)
435  }
436)
437 
438api.onError((err, c) => {
439  console.error(err)
440  return c.json({ error: 'Internal error' }, 500)
441})
442 
443export type AppType = typeof api
444export default app
445```
446 
447A React client consumes it with full type safety:
448 
449```typescript
450import { hc } from 'hono/client'
451import type { AppType } from '../api/src/index'
452 
453const api = hc<AppType>(import.meta.env.VITE_API_URL)
454 
455const res = await api.posts.$post({
456  json: { title: 'Hono in 2026', body: '...' },
457}, {
458  headers: { Authorization: `Bearer ${token}` },
459})
460```
461 
462## Testing
463 
464`app.request()` lets you test routes without spinning up an HTTP server. It's the same path you'd run in production, executed in-memory.
465 
466```typescript
467import { describe, it, expect } from 'vitest'
468import app from '../src/index'
469 
470describe('GET /api/posts', () => {
471  it('returns the list of posts', async () => {
472    const res = await app.request('/api/posts')
473    expect(res.status).toBe(200)
474    const body = await res.json()
475    expect(body.posts).toBeInstanceOf(Array)
476  })
477})
478```
479 
480On Cloudflare Workers, `@cloudflare/vitest-pool-workers` runs the same tests inside a real Worker with mock bindings - maximum realism, zero deploy.
481 
482## Best practices
483 
484### 1. Chain route definitions
485 
486```typescript
487const app = new Hono()
488  .get('/posts', handler1)
489  .post('/posts', handler2)
490  .get('/posts/:id', handler3)
491```
492 
493Chaining keeps `app`'s type up to date with every route, which is essential for the RPC client. Defining them separately as `app.get(...)` on distinct lines breaks inference.
494 
495### 2. Export the type, not the implementation
496 
497The client must import `AppType`, not the app. `import type` ensures the frontend build doesn't include backend code.
498 
499### 3. One router per domain
500 
501A sub-app for `posts`, one for `users`, one for `webhooks`. Compose them with `app.route()` and each owns its middleware. The structure scales without mega-files.
502 
503### 4. Validate at the edge, always
504 
505Every external input (body, query, header) must go through `zValidator`. Don't trust data downstream: even a TypeScript cast without runtime validation is a bug waiting to happen.
506 
507### 5. Lean on bindings, not global clients
508 
509On Cloudflare, access KV/D1/R2 via `c.env`. No global singletons, no connections persisting across Workers. The stateless model is a feature, not a limitation.
510 
511### 6. Measure before optimizing the router
512 
513The default `SmartRouter` is fine for 95% of cases. Switch routers only after profiling and seeing a real bottleneck.
514 
515## Conclusion
516 
517Hono has become the de facto standard in 2026 for building edge-ready APIs in TypeScript. The combination of Web Standards, performance, type safety, and portability solves exactly the problems that held back traditional frameworks: runtime lock-in, heavy bundles, fragile type system between client and server.
518 
519You'll use it for microservices on Cloudflare Workers, to replace Express in a Node monolith, for a function on Vercel, or for an API on Bun. The same knowledge transfers everywhere - and that's what makes it a solid investment for the next few years.
520 
521> **Getting Started Checklist:**
522>
523> - [x] `npm create hono@latest` and pick your runtime template
524> - [x] Define routes with chaining (`.get(...).post(...)`)
525> - [x] Add `logger`, `cors`, `secureHeaders` as global middleware
526> - [x] Validate every input with `@hono/zod-validator`
527> - [x] Export `AppType` and consume the API with the type-safe `hc` client
528> - [x] Write tests with `app.request()` - no HTTP server needed
529> - [x] Deploy with `wrangler deploy` (CF), `vercel deploy`, or your runtime's bundler
530