# iron-session

> MIT stateless encrypted cookie sessions for JavaScript

**Category:** Next.js  
**Pricing:** open-source  
**URL:** https://get-iron-session.vercel.app  
**GitHub:** https://github.com/vvo/iron-session  
**Added:** 2026-10-18

---

## The Hook

iron-session is a secure, stateless session library for JavaScript: session data lives in signed and encrypted cookies that your server decodes without a database or network call.

## What's Good

MIT (vvo/iron-session), release v9.0.1 (2026-08-30). Featured in the Next.js docs, it works with the App Router, route handlers, server actions, Express and other Node-style runtimes. It is the same technique Rails uses for cookie sessions. Online demo with examples. ★~4.1k.

## The Catch

v9 requires Node 22.13+ and is ESM-only, so upgrading from v8 needs code changes. Cookies cap out at about 4 KB, so store IDs, not big objects. Stateless sessions cannot be revoked server-side without extra bookkeeping. It manages sessions; login, OAuth and passwords are up to you.

## Verdict

The simplest secure session layer for a Next.js app.