Node-RED

What Node-RED does

Node-RED is a flow-based programming tool. In a browser editor you drag nodes onto a canvas, wire them together and deploy the result to a small Node.js runtime with one click. Messages travel along the wires: an Inject node fires on a schedule, an HTTP In node waits for a webhook, an MQTT node listens to a topic, and Switch, Change and Function nodes route and reshape the data before it goes out to another service.

The project began at IBM in 2013 as a way to map MQTT topics, became a general tool for event-driven applications, and is now part of the OpenJS Foundation. The core install covers HTTP, MQTT, WebSocket, TCP, UDP, files and parsing. Anything else, from smart-home platforms to SaaS APIs, comes from the community library, which the project says holds more than 5,000 nodes.

Security

Node-RED’s documentation is direct about the default: the editor is not secured, and anyone who can reach its address can change and deploy flows. Before you expose it beyond a trusted network, enable adminAuth in the settings file, either with local users and bcrypt-hashed passwords or with an OAuth/OpenID provider, and configure HTTPS. Endpoints created with HTTP nodes and the dashboard need their own protection.

Credentials used by nodes are stored in a separate encrypted file. If you do not set your own credentialSecret, Node-RED generates a key, and the documentation warns that losing it makes the credentials unrecoverable.

Self-hosting Node-RED

There is no database to set up. You install it from npm, run the official multi-architecture Docker image, or use the install scripts for Debian-based systems (including Raspberry Pi OS) and RPM-based distributions. Node-RED 5.x needs Node.js 22 or later, and the project currently recommends Node 24. Flows, settings and installed nodes live in a user directory, so backing up that folder backs up the instance. The optional Projects feature puts flows in a Git repository and needs git and ssh-keygen on the host.

Hosted version

The OpenJS Foundation project does not run a hosted service. FlowFuse, a separate company founded in 2021 by Node-RED co-creator Nick O’Leary, sells a commercial platform for running Node-RED at scale. Node-RED’s own documentation points to it for multi-tenant setups, but it is not part of this repository.

Limitations

Node-RED is a programming tool with a friendly face. Building flows means understanding message objects and, sooner or later, writing some JavaScript. Integrations with business apps such as CRMs or accounting tools depend on community nodes whose quality and upkeep vary, or on calling the APIs yourself with HTTP nodes. It runs as a single process. Security is off until you configure it.

Who it suits

Node-RED is a strong fit for home automation, IoT and IFTTT-style “when this happens, do that” rules where you control the devices and services. It also works well as glue between APIs for people comfortable with a little code. It is fully Apache-2.0, has no paid edition, and runs on a Raspberry Pi. If you want a no-code builder with ready-made SaaS connectors, compare it with Activepieces in the workflow automation guide.