v0.2 • Open Source

Rate limiting.Done right.

TypeScript rate limiting with multiple strategies,
storage engines and resilience policies.

Get StartedGitHub
120 req/s
Login
10 req/s
Checkout
30 req/s
Search
60 req/s
Upload
20 req/s
4
Strategies
Fixed Window, Sliding Window, Token Bucket and Leaky Bucket.
3
Storage Engines
Memory, Redis, PostgreSQL
Atomic
Operations
Concurrency-safe updates with consistent rate limit enforcement.
Built-in
Resilience
Retries, circuit breakers and fallback policies out of the box.
Network Resilience

Designed fornetwork resilience.

A rate limiter should stay robust when your database is under load or temporarily unreachable. RateLock includes built-in policies like retries, circuit breakers, and local memory caching to help you handle transient errors gracefully.

Deny-Only Cache Shield

Why saturate your databases checking blacklisted IPs? RateLock caches repeatedly blocked requests in local memory, instantly rejecting malicious spikes in `0.02ms` without making a single network call.

DoS mitigation activeProtected
Blocked Request IP:192.168.1.92
Local Cache State:Cached (Deny)
Database Query:Bypassed (0 queries)
Response Latency:0.02ms (Local)
Bypasses database queriesConfigurable TTL limits

Resilient Circuit Breaker

Avoid thread pool saturation when your databases fail. RateLock automatically halts queries, redirects calls to fail-safes, and probes recovery periodically.

Circuit telemetry
State:
Half-Open
Failure threshold:5 failed attempts
Probing rate:1 request / 5s

Fallback Policies

Configure your limiters with custom fallback policies to guarantee that rate limit operations never throw runtime exceptions to clients during database hiccups.

const limiter = await fixedWindow({
limit: 100,
windowMs: 60_000,
fallback: 'allow', // Fail-open
})

Adaptive Error Policies

Choose how to handle rate limiting exceptions during extreme database congestion or downtime. Swap behaviors dynamically without rewriting controller logics.

O
Fail-Open (Recommended)
Bypasses database failures. Ensures legitimate customers are never locked out of your application during downtime.
C
Fail-Closed
Blocks all requests if rate limiting state is offline. Prevents catastrophic security leakages during infrastructure congestion.
Granular retry policiesFully custom error callbacks

Try it live

Interactive rate limiting simulation running entirely in your browser. Send requests, adjust parameters, and watch the limits in action.

Infrastructure

One API,any backend.

Scale from rapid local edge nodes up to massive Postgres or Redis clusters. Swap storage backends instantly by changing a single package import.

Driver

Local

In-memory Maps, zero dependencies

Backend telemetry
Avg latency:< 0.02ms
External Deps:0
Memory model:JS Map
Recommended forEdge functions & single-process nodes
Driver

Redis

Atomic Lua script pipeline execution

Backend telemetry
Concurrency:Lua atomic
Thread-safety:Single-thread
Data structure:Sorted Sets
Recommended forHigh-traffic distributed clusters
Driver

PostgreSQL

Isolated transactional UPSERT queries

Backend telemetry
Concurrency:SQL UPSERT
Atomicity:ACID safe
Table schema:Key-value index
Recommended forEnterprise databases already in your stack
Unified Interface

Swap backends seamlessly,keeping code intact.

RateLock encapsulates the host-specific database driver logic inside the engine packages. Your core limiters, validation hooks, API configurations, and resilience policies remain 100% unchanged.

Type-safe imports
Zero logic edits
100% testable core
Zero-config MigrationNo Code Changes
1. Development (Local Memory)
import { fixedWindow } from '@ratelock/local'
// Works instantly in serverless edge/lambda functions
2. Production (Distributed Redis)
import { fixedWindow } from '@ratelock/redis'
// Swaps engine underneath. Resilience wrappers remain identical!
Integrations

Drop it intoany stack.

Dedicated middlewares for pipeline frameworks, step-by-step guides for web-standard ones. Same limiters, same resilience policies, everywhere.

Middleware

Hono

Edge-first middleware, web-standard responses

Middleware

Express

One package for Express 4 and 5

Middleware

Fastify

onRequest plugin, encapsulation-safe

Middleware

Elysia

Bun-native, pairs with our native Redis driver

Guide

Next.js

App Router route handlers

Guide

SvelteKit

+server.ts endpoints

Guide

Astro

API endpoints

Guide

Remix

Loaders and actions

Performance

Numbers, not promises

Hard, reproducible numbers from the same matrix and code paths on every supported backend. Below: throughput vs. the most popular Node.js rate-limiters, and how the deny cache shields your storage layer from abuse.

Compare Backends

Throughput Comparison

RateLock Local Fixed Window2,088,809 ops/s • 0.04ms
rate-limiter-flexible Memory744,508 ops/s • 0.11ms
RateLock throughput is 2.81x higher higher under this workload.
Matrix 4 Baseline • 80 Concurrency • Reference Hardware (AMD Ryzen 7 5800X, 32GB RAM)
Shield Inactive (DB Hit)

Spam Protection with Deny Cache

The withCache decorator stores blocked keys in a local, short-lived cache. Subsequent requests fail immediately in memory, preventing network round-trips to your database.

Spam Client
Database Server
Deny Cache
Without Cache (DB Hits):~1,200 ops/s
With Deny Cache (Shielded):0 ops/s
Verified Results

See the full benchmarks

Explore latency, throughput and memory profiles for every backend shipped with RateLock, plus the exact scripts we used to measure them.

Open benchmarks