Rails admin panels: ActiveAdmin, Avo, Administrate and others
Every application eventually needs a back office: a place where staff can find a customer, fix a record or refund an order. Admin frameworks generate most of it for you, at the price of living inside their conventions.
Release figures are from RubyGems.org, October 2026.
What to compare
- Configuration style: a DSL, Ruby resource classes, or generated controllers and views you edit directly.
- Dependencies: some frameworks pull in a substantial stack of gems, each with its own upgrade cycle.
- Customisation ceiling: how hard it is to build a screen that does not map to one model.
- Authorization: whether it integrates with your Pundit or CanCanCan policies.
- Licence: most are MIT; Avo has paid tiers.
ActiveAdmin
ActiveAdmin (3.5.2, July 2026) is the long-standing reference. You register resources with a DSL:
ActiveAdmin.register Order do
permit_params :status, :notes
filter :status
filter :created_at
index do
selectable_column
column :id
column :customer
column :status
actions
end
end
Its runtime dependencies show its heritage: Arbre for views, Formtastic for forms, Inherited Resources for controllers, Ransack for filters, Kaminari for pagination and jquery-rails. That stack works, but each piece is another dependency to keep compatible with new Rails versions. A 4.0 line, with a substantially reworked front end, has been in beta for a long time (4.0.0.beta23 in September 2026); check its status before starting a new project.
ActiveAdmin has authorization adapters for CanCanCan and Pundit, batch actions, CSV export and comments.
Choose it when you want a mature, widely documented admin and are comfortable with its DSL.
Avo
Avo (4.3.5, October 2026) configures the admin through Ruby resource classes that declare fields, filters and actions. It has a modern interface built with Hotwire, dashboards, custom tools and a large field library. The gem is published under LGPL-3.0 with commercial licences; several features are reserved for paid tiers, so check the current pricing page against your requirements before committing. Releases are frequent.
Choose it when you want a polished admin with little front-end work and are willing to pay for advanced features.
Administrate
Administrate, from thoughtbot, reached 1.0.0 in October 2025 after many years in the 0.x series. It generates a dashboard class per model and uses ordinary Rails controllers and views, which you customise by overriding them as you would in your own application. Its philosophy is that admin code should look like the rest of your code, without a DSL to learn.
Choose it when you prefer plain Rails conventions and expect to customise heavily.
RailsAdmin and Madmin
RailsAdmin (3.3.1, October 2026) builds an interface automatically from your models with almost no configuration, which makes it quick for internal tools. Madmin (3.3.0, October 2026) takes an approach similar to Administrate, generating resources you can edit, with a lighter footprint.
Building your own
An admin is, in the end, a set of authenticated CRUD screens. With Rails scaffolding, a namespaced Admin:: set of controllers and a shared layout, a small team can build exactly the screens it needs, and nothing else. This works best when the back office is small or highly specific to the business, such as refund workflows or moderation queues, which frameworks handle awkwardly anyway. A common pattern is to use a framework for generic record editing and hand-written screens for the critical workflows.
Old admin plugins
Rails 2 and early Rails 3 applications often used ActiveScaffold, which generated AJAX CRUD interfaces, or smaller tools such as admin_data for browsing records. ActiveScaffold still exists as a gem, but applications being modernised usually move to one of the frameworks above, or to plain controllers.
Security reminders
- Mount the admin behind authentication and an explicit role check; a route constraint in
config/routes.rbis a good extra layer. - Restrict which attributes can be edited (
permit_paramsor the equivalent). An admin that can change any column can change the password digest or the role. - Keep an audit trail of admin changes; gems such as PaperTrail or Audited record who changed what.
- Treat admin search and filter features as attack surface: Ransack, for example, requires you to allow-list searchable attributes since version 4.0.
Summary
| Framework | Configuration | Licence | Notes |
|---|---|---|---|
| ActiveAdmin | DSL | MIT | Mature; heavier dependency stack |
| Avo | Resource classes | LGPL-3.0 / commercial | Polished UI, paid tiers |
| Administrate | Dashboards plus plain controllers | MIT | 1.0 since October 2025 |
| RailsAdmin | Mostly automatic | MIT | Fast to set up |
| Madmin | Generated resources | MIT | Lightweight |
Category guidesAuthorization
How Pundit, CanCanCan and Action Policy model permissions in a Rails application, how each handles scopes and testing, and when a hand-written approach is enough.
Category guidesPagination
Comparing Rails pagination gems — Pagy, Kaminari and will_paginate — and when to use offset or keyset pagination for large tables and infinite scrolling.
Category guidesSearch
Filtering versus full-text search in Rails: Ransack for filter forms, pg_search for PostgreSQL full-text search, and Searchkick, Meilisearch or Thinking Sphinx for a dedicated search engine.