Server-Side Template Engines for Node.js
These libraries render dynamic HTML on the server by combining templates with data. They help separate view logic from application code, enabling cleaner maintenance and faster page loads. Each engine offers a different balance of syntax style, logic capabilities, and security features.
Npm Package Weekly Downloads Trend
Github Stars Ranking
Stat Detail
Server-Side Template Engines: Syntax, Logic, and Security Compared
These seven libraries solve the same core problem — rendering HTML on the server using dynamic data. However, they differ sharply in syntax, logic capabilities, and security models. Understanding these differences helps you pick the right tool for your team and project constraints.
📝 Syntax Style: HTML-like vs Whitespace vs JS-like
The syntax defines how you write templates. Some look like HTML with tags, while others use indentation or JavaScript delimiters.
ejs uses standard HTML with JavaScript embedded in special tags.
<!-- ejs -->
<h1><%= title %></h1>
handlebars uses double mustaches for output within standard HTML.
<!-- handlebars -->
<h1>{{ title }}</h1>
liquidjs separates logic tags from output variables using different brackets.
<!-- liquidjs -->
<h1>{{ title }}</h1>
mustache uses double mustaches similar to Handlebars but with fewer features.
<!-- mustache -->
<h1>{{ title }}</h1>
nunjucks uses Jinja-style syntax with distinct brackets for logic and output.
<!-- nunjucks -->
<h1>{{ title }}</h1>
pug uses indentation and whitespace instead of closing HTML tags.
<!-- pug -->
h1= title
twig uses syntax very similar to Nunjucks and Liquid, derived from PHP.
<!-- twig -->
<h1>{{ title }}</h1>
⚙️ Logic and Conditionals: Full JS vs Logic-less
Some engines let you run any JavaScript code, while others restrict you to safe, predefined helpers.
ejs allows full JavaScript logic inside <% %> tags.
<!-- ejs -->
<% if (user.isAdmin) { %>
<p>Admin Panel</p>
<% } %>
handlebars uses block helpers for logic without raw JavaScript.
<!-- handlebars -->
{{#if user.isAdmin}}
<p>Admin Panel</p>
{{/if}}
liquidjs uses specific tags for control flow to ensure safety.
<!-- liquidjs -->
{% if user.isAdmin %}
<p>Admin Panel</p>
{% endif %}
mustache relies on sections and truthy values for logic.
<!-- mustache -->
{{#user.isAdmin}}
<p>Admin Panel</p>
{{/user.isAdmin}}
nunjucks supports powerful control structures similar to Python.
<!-- nunjucks -->
{% if user.isAdmin %}
<p>Admin Panel</p>
{% endif %}
pug uses indentation to define logic blocks.
<!-- pug -->
if user.isAdmin
p Admin Panel
twig provides robust control structures with a focus on filters.
<!-- twig -->
{% if user.isAdmin %}
<p>Admin Panel</p>
{% endif %}
🧩 Reusing Code: Partials and Includes
All engines support breaking templates into smaller files, but the syntax varies.
ejs uses a function-like include statement.
<!-- ejs -->
<%- include('header') %>
handlebars uses a greater-than sign for partials.
<!-- handlebars -->
{{> header}}
liquidjs uses the render tag for isolated partials.
<!-- liquidjs -->
{% render 'header' %}
mustache uses the same partial syntax as Handlebars.
<!-- mustache -->
{{> header}}
nunjucks uses an include tag similar to Python.
<!-- nunjucks -->
{% include 'header' %}
pug uses a simple keyword for includes.
<!-- pug -->
include header
twig uses an include tag consistent with its PHP roots.
<!-- twig -->
{% include 'header' %}
🔒 Security and Sandboxing
Security is critical when templates accept user input. Engines that execute JavaScript are riskier than those that sandbox logic.
ejs and pug execute JavaScript directly. This means a user could potentially run server-side code if they control the template.
// ejs: Risky with user input
ejs.render('<%= process.env.SECRET %>', {}); // Could leak secrets
handlebars, liquidjs, mustache, nunjucks, and twig are logic-less or sandboxed. They prevent arbitrary code execution by default.
// liquidjs: Safe with user input
liquid.parse('{{ process.env.SECRET }}'); // Renders literally, does not execute
If you allow users to upload templates, avoid ejs and pug. Choose liquidjs or nunjucks instead to keep your server safe.
📊 Summary Table
| Feature | ejs | handlebars | liquidjs | mustache | nunjucks | pug | twig |
|---|---|---|---|---|---|---|---|
| Syntax | HTML + JS | HTML + {{ }} | HTML + {% %} | HTML + {{ }} | HTML + {% %} | Indentation | HTML + {% %} |
| Logic | Full JS | Helpers | Sandboxed | Logic-less | Advanced | Full JS | Sandboxed |
| Security | Low | High | High | High | High | Low | High |
| Async | Yes | Yes | Yes | No | Yes | Yes | Yes |
💡 Final Recommendation
ejs and pug are powerful but risky for user input. Use them when your team controls all templates and you want full JavaScript power.
liquidjs is the safest choice for customer-facing template editors. It balances features with strict security.
handlebars and nunjucks are great middle grounds for internal tools. They offer strong features without the risks of raw JavaScript execution.
mustache and twig serve specific niches — portability and PHP migration respectively. Pick them if those specific needs match your project.
Choose based on who writes the templates — developers or users. That decision dictates your security requirements more than any other factor.
How to Choose: ejs vs handlebars vs liquidjs vs mustache vs nunjucks vs pug vs twig
- ejs:
Choose
ejsif you want to use plain JavaScript inside your templates without learning a new syntax. It is ideal for simple Node.js apps where you trust the template source and want maximum flexibility. However, avoid it for user-generated templates due to security risks. - handlebars:
Choose
handlebarsif you need a balance between logic-less safety and extensible helpers. It works well for projects requiring a large ecosystem of pre-built helpers and strong community support. It is a solid default for many Express.js applications. - liquidjs:
Choose
liquidjsif you need a safe, sandboxed environment for user-editable templates. It is the best choice for e-commerce platforms or SaaS products where customers design their own views. The syntax is clean and prevents dangerous code execution. - mustache:
Choose
mustacheif you want the simplest possible logic-less syntax that works across many languages. It is suitable for lightweight projects needing maximum portability and minimal configuration. Be aware it lacks built-in helpers compared to Handlebars. - nunjucks:
Choose
nunjucksif you come from Python or Django and want powerful inheritance and macros. It is great for complex sites needing async template rendering and advanced control structures. The syntax is robust and highly expressive. - pug:
Choose
pugif you prefer whitespace-sensitive syntax and want to write less code. It is best for teams comfortable with indentation-based structures over standard HTML tags. It compiles to functions for fast performance but has a steeper learning curve. - twig:
Choose
twigif you are migrating from PHP Symfony or want a robust filter system. It is suitable for projects needing strong typing and extensive built-in filters. The feature set is very close to the original PHP implementation.
Popular Comparisons
README for ejs
Embedded JavaScript templates
Security
Security professionals, before reporting any security issues, please reference the SECURITY.md in this project, in particular, the following: "EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results."
In short, DO NOT submit 'vulnerabilities' that include this snippet of code:
app.get('/', (req, res) => {
res.render('index', req.query);
});
Installation
$ npm install ejs
Import or require
Supports both CommonJS and ES Modules.
import ejs from 'ejs';
// Or
const ejs = require('ejs');
Compatibility
Server: CommonJS approach (require) supports Node versions at least
back to v0.12, likely older versions too. ES Modules approach (import)
requires a Node version that supports ESM.
CLI: Requires Node v8 or newer.
Browser: EJS supports all modern browsers, but is very likely to work even in very, very old browsers. Your mileage may vary.
Bundlers and alternate runtimes: as of v6.0, the published package imports
cleanly under Rollup, Rolldown, tsdown, esbuild, Webpack, Vite, Browserify,
Bun, and Deno. Earlier versions emitted module.exports = ejs; from inside
the ESM source as a dual-mode shim; modern ESM-aware bundlers and Bun
treated this as malformed ESM. The shim has been removed from
lib/esm/*.js and moved into the lib/cjs/* compile step, so the
published CJS surface (require('ejs')) is unchanged. For Browserify,
pass --node so it picks the main entry instead of the prebuilt UMD
bundle pointed to by the browser field.
Features
- Control flow with
<% %> - Escaped output with
<%= %>(escape function configurable) - Unescaped raw output with
<%- %> - Newline-trim mode ('newline slurping') with
-%>ending tag - Whitespace-trim mode (slurp all whitespace) for control flow with
<%_ _%> - Custom delimiters (e.g.
[? ?]instead of<% %>) - Includes
- Client-side support
- Static caching of intermediate JavaScript
- Static caching of templates
- Complies with the Express view system
Example
<% if (user) { %>
<h2><%= user.name %></h2>
<% } %>
Basic usage
const template = ejs.compile(str, options);
template(data);
// => Rendered HTML string
ejs.render(str, data, options);
// => Rendered HTML string
ejs.renderFile(filename, data, options, function(err, str){
// str => Rendered HTML string
});
It is also possible to use ejs.render(dataAndOptions); where you pass
everything in a single object. In that case, you'll end up with local variables
for all the passed options. However, be aware that your code could break if we
add an option with the same name as one of your data object's properties.
Therefore, we do not recommend using this shortcut.
Important
You should never give end-users unfettered access to the EJS render method, If you do so you are using EJS in an inherently un-secure way.
Options
cacheCompiled functions are cached, requiresfilenamefilenameThe name of the file being rendered. Not required if you are usingrenderFile(). Used bycacheto key caches, and for includes.rootSet template root(s) for includes with an absolute path (e.g, /file.ejs). Can be array to try to resolve include from multiple directories.viewsAn array of paths to use when resolving includes with relative paths.contextFunction execution contextcompileDebugWhenfalseno debug instrumentation is compileddelimiterCharacter to use for inner delimiter, by default '%'openDelimiterCharacter to use for opening delimiter, by default '<'closeDelimiterCharacter to use for closing delimiter, by default '>'debugOutputs generated function bodystrictWhen set totrue, generated function is in strict mode_withWhether or not to usewith() {}constructs. Iffalsethen the locals will be stored in thelocalsobject. Set tofalsein strict mode.unsafePrototypeLocalsWhentrue, allows templates to resolve identifiers through the prototype chain of the locals object. Required if you pass class instances orObject.create(...)results as locals and rely on inherited properties at the top level. Defaults tofalse; enabling it disables the v6 prototype-pollution mitigation.destructuredLocalsAn array of local variables that are always destructured from the locals object, available even in strict mode.localsNameName to use for the object storing local variables when not usingwithDefaults tolocalsrmWhitespaceRemove all safe-to-remove whitespace, including leading and trailing whitespace. It also enables a safer version of-%>line slurping for all scriptlet tags (it does not strip new lines of tags in the middle of a line).escapeThe escaping function used with<%=construct. (By default escapes XML).outputFunctionNameSet to a string (e.g., 'echo' or 'print') for a function to print output inside scriptlet tags.asyncWhentrue, EJS will use an async function for rendering. (Depends on async/await support in the JS runtime).includerCustom function to handle EJS includes, receives(originalPath, parsedPath)parameters, whereoriginalPathis the path in include as-is andparsedPathis the previously resolved path. Should return an object{ filename, template }, you may return only one of the properties, wherefilenameis the final parsed path andtemplateis the included content.
This project uses JSDoc. For the full public API
documentation, clone the repository and run jake doc. This will run JSDoc
with the proper options and output the documentation to out/. If you want
the both the public & private API docs, run jake devdoc instead.
Tags
<%'Scriptlet' tag, for control-flow, no output<%_'Whitespace Slurping' Scriptlet tag, strips all whitespace before it<%=Outputs the value into the template (escaped)<%-Outputs the unescaped value into the template<%#Comment tag, no execution, no output<%%Outputs a literal '<%'%%>Outputs a literal '%>'%>Plain ending tag-%>Trim-mode ('newline slurp') tag, trims following newline_%>'Whitespace Slurping' ending tag, removes all whitespace after it
For the full syntax documentation, please see docs/syntax.md.
Includes
Includes either have to be an absolute path, or, if not, are assumed as
relative to the template with the include call. For example if you are
including ./views/user/show.ejs from ./views/users.ejs you would
use <%- include('user/show') %>.
You must specify the filename option for the template with the include
call unless you are using renderFile().
You'll likely want to use the raw output tag (<%-) with your include to avoid
double-escaping the HTML output.
<ul>
<% users.forEach(function(user){ %>
<%- include('user/show', {user: user}) %>
<% }); %>
</ul>
Includes are inserted at runtime, so you can use variables for the path in the
include call (for example <%- include(somePath) %>). Variables in your
top-level data object are available to all your includes, but local variables
need to be passed down.
NOTE: Include preprocessor directives (<% include user/show %>) are
not supported in v3.0+.
Custom delimiters
Custom delimiters can be applied on a per-template basis, or globally:
import ejs from 'ejs';
const users = ['geddy', 'neil', 'alex'];
// Just one template
ejs.render('<p>[?= users.join(" | "); ?]</p>', {users: users}, {delimiter: '?', openDelimiter: '[', closeDelimiter: ']'});
// => '<p>geddy | neil | alex</p>'
// Or globally
ejs.delimiter = '?';
ejs.openDelimiter = '[';
ejs.closeDelimiter = ']';
ejs.render('<p>[?= users.join(" | "); ?]</p>', {users: users});
// => '<p>geddy | neil | alex</p>'
Caching
EJS ships with a basic in-process cache for caching the intermediate JavaScript
functions used to render templates. It's easy to plug in LRU caching using
Node's lru-cache library:
import ejs from 'ejs';
import { LRUCache } from 'lru-cache';
ejs.cache = LRUCache({max: 100}); // LRU cache with 100-item limit
If you want to clear the EJS cache, call ejs.clearCache. If you're using the
LRU cache and need a different limit, simple reset ejs.cache to a new instance
of the LRU.
Custom file loader
The default file loader is fs.readFileSync, if you want to customize it, you can set ejs.fileLoader.
import ejs from 'ejs';
const myFileLoad = function (filePath) {
return 'myFileLoad: ' + fs.readFileSync(filePath);
};
ejs.fileLoader = myFileLoad;
With this feature, you can preprocess the template before reading it.
Layouts
EJS does not specifically support blocks, but layouts can be implemented by including headers and footers, like so:
<%- include('header') -%>
<h1>
Title
</h1>
<p>
My page
</p>
<%- include('footer') -%>
Client-side support
Go to the Latest Release, download
./ejs.js or ./ejs.min.js. Alternately, you can compile it yourself by cloning
the repository and running jake build (or npx jake build if jake is
not installed globally).
Include one of these files on your page, and ejs should be available globally.
Example
<div id="output"></div>
<script src="ejs.min.js"></script>
<script>
let people = ['geddy', 'neil', 'alex'],
html = ejs.render('<%= people.join(", "); %>', {people: people});
// With jQuery:
$('#output').html(html);
// Vanilla JS:
document.getElementById('output').innerHTML = html;
</script>
Caveats
Most of EJS will work as expected; however, there are a few things to note:
- Obviously, since you do not have access to the filesystem,
ejs.renderFile()won't work. - For the same reason,
includes do not work unless you use aninclude callback. Here is an example:
let str = "Hello <%= include('file', {person: 'John'}); %>",
fn = ejs.compile(str);
fn(data, null, function(path, d){ // include callback
// path -> 'file'
// d -> {person: 'John'}
// Put your code here
// Return the contents of file as a string
}); // returns rendered string
See the examples folder for more details.
CLI
EJS ships with a full-featured CLI. Options are similar to those used in JavaScript code:
-o / --output-file FILEWrite the rendered output to FILE rather than stdout.-f / --data-file FILEMust be JSON-formatted. Use parsed input from FILE as data for rendering.-i / --data-input STRINGMust be JSON-formatted and URI-encoded. Use parsed input from STRING as data for rendering.-m / --delimiter CHARACTERUse CHARACTER with angle brackets for open/close (defaults to %).-p / --open-delimiter CHARACTERUse CHARACTER instead of left angle bracket to open.-c / --close-delimiter CHARACTERUse CHARACTER instead of right angle bracket to close.-s / --strictWhen set totrue, generated function is in strict mode-n / --no-withUse 'locals' object for vars rather than usingwith(implies --strict).-l / --locals-nameName to use for the object storing local variables when not usingwith.-w / --rm-whitespaceRemove all safe-to-remove whitespace, including leading and trailing whitespace.-d / --debugOutputs generated function body-h / --helpDisplay this help message.-V/v / --versionDisplay the EJS version.
Here are some examples of usage:
$ ejs -p [ -c ] ./template_file.ejs -o ./output.html
$ ejs ./test/fixtures/user.ejs name=Lerxst
$ ejs -n -l _ ./some_template.ejs -f ./data_file.json
Data input
There is a variety of ways to pass the CLI data for rendering.
Stdin:
$ ./test/fixtures/user_data.json | ejs ./test/fixtures/user.ejs
$ ejs ./test/fixtures/user.ejs < test/fixtures/user_data.json
A data file:
$ ejs ./test/fixtures/user.ejs -f ./user_data.json
A command-line option (must be URI-encoded):
./bin/cli.js -i %7B%22name%22%3A%20%22foo%22%7D ./test/fixtures/user.ejs
Or, passing values directly at the end of the invocation:
./bin/cli.js -m $ ./test/fixtures/user.ejs name=foo
Output
The CLI by default send output to stdout, but you can use the -o or --output-file
flag to specify a target file to send the output to.
IDE Integration with Syntax Highlighting
VSCode:Javascript EJS by DigitalBrainstem
Related projects
There are a number of implementations of EJS:
- TJ's implementation, the v1 of this library: https://github.com/tj/ejs
- EJS Embedded JavaScript Framework on Google Code: https://code.google.com/p/embeddedjavascript/
- Sam Stephenson's Ruby implementation: https://rubygems.org/gems/ejs
- Erubis, an ERB implementation which also runs JavaScript: http://www.kuwata-lab.com/erubis/users-guide.04.html#lang-javascript
- DigitalBrainstem EJS Language support: https://github.com/Digitalbrainstem/ejs-grammar
License
Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
EJS Embedded JavaScript templates copyright 2112 mde@fleegix.org.