Authentication in Rails: the generator, Devise, Rodauth and the rest
Authentication was the first job most Rails developers handed to a plugin, and for a decade the answer was nearly always Devise. Since Rails 8, the framework ships its own starting point, and the choice is more interesting.
Release figures below are from RubyGems.org, checked in October 2026.
The Rails 8 authentication generator
Rails 8.0 added bin/rails generate authentication. It writes ordinary application code rather than adding a dependency: a User model using has_secure_password, a Session model that stores sessions in the database, a SessionsController for signing in and out, a PasswordsController and mailer for password resets, and an Authentication concern included in ApplicationController. It uses the bcrypt gem for password hashing.
What it deliberately leaves out is just as important: there is no sign-up flow, no email confirmation, no account locking and no two-factor authentication. You add those yourself, in your own code. The Rails security guide and the has_secure_password API documentation cover the underlying pieces.
Choose it when you want to understand and own every line of your login code, and your needs are close to email-and-password. Its main cost is that every feature beyond the basics is yours to write, test and secure.
Devise
Devise is an engine built on the Warden Rack middleware. Its features come as modules you enable per model: database_authenticatable, registerable, recoverable, rememberable, validatable, confirmable, lockable, timeoutable, trackable and omniauthable. Its latest release at the time of writing is 5.0.4 (May 2026).
Its strength is coverage: almost any authentication tutorial, admin framework or SaaS template assumes Devise, and extensions exist for many needs. Its weakness is the flip side: a lot of behaviour lives inside the engine, and customising flows means overriding controllers, views and the occasional internal method. Upgrades across major versions deserve a careful read of the changelog.
Choose it when you need standard flows quickly, or when other gems you rely on integrate with Devise.
Rodauth and rodauth-rails
Rodauth is an authentication framework built on Roda and Sequel, used in Rails through rodauth-rails, which handles the integration with Active Record connections, controllers, views and mailers. Its feature list is the broadest of any Ruby option, including multi-factor authentication with TOTP, SMS codes and recovery codes, WebAuthn and passkey login, account verification, password expiration, active sessions and JSON API support. Rodauth was at 2.49.0 and rodauth-rails at 2.2.3 in October 2026.
Rodauth's design is security-first: by default it stores password hashes in a separate table, and its documentation explains how to restrict access to that table with database permissions. Configuration happens in one Ruby block rather than through scattered overrides.
Choose it when you need multi-factor authentication, passkeys or an authentication API, or you value a smaller attack surface. The learning curve is steeper than Devise, and fewer third-party gems assume it.
Smaller libraries: Authlogic, Clearance, Sorcery
- Authlogic treats the session as a model-like object. It is older than Devise and still released (6.6.0 in November 2025). See our note on Authlogic for its history.
- Clearance, from thoughtbot, offers email-and-password authentication with small, overridable controllers. Latest release 2.12.0 (April 2026).
- Sorcery gives you methods rather than controllers, with submodules for activation, reset, remember-me and external providers. Latest release 0.18.0 (December 2025).
All three are reasonable for existing applications. For a new application, the Rails generator now occupies much of the space these libraries were designed for.
Social and enterprise login: OmniAuth
OmniAuth is a Rack middleware that standardises login with external providers through "strategies" packaged as separate gems, such as omniauth-google-oauth2, omniauth-github or omniauth-facebook. It works with Devise (the omniauthable module), with the Rails generator code, or on its own.
One change trips up people following old tutorials: since OmniAuth 2.0, the request phase only accepts POST requests by default, a fix for a cross-site request forgery issue. A plain link_to "Sign in with GitHub", "/auth/github" no longer works; use button_to with data: { turbo: false }, and add the omniauth-rails_csrf_protection gem so that Rails' authenticity token is checked.
For SAML single sign-on, omniauth-saml builds on the ruby-saml gem. Keep ruby-saml current: it has had several serious advisories, and bundle-audit will flag affected versions.
Facebook login, then and now
Around 2010, Rails applications integrated with Facebook through plugins such as Facebooker and devise_facebook_connect, which wrapped Facebook's old REST API and Connect JavaScript library. Facebook later replaced those interfaces with the Graph API and OAuth 2.0, and the plugins stopped being useful; Facebooker's last release on RubyGems dates from 2010. Today, login with Facebook is an ordinary OAuth flow handled by omniauth-facebook, and calls to the Graph API are usually made with the Koala gem or plain HTTP.
How to decide
| Need | Reasonable default |
|---|---|
| Email and password, full control | Rails 8 generator |
| Standard flows fast, many integrations | Devise |
| MFA, passkeys, JSON API, strict security | Rodauth with rodauth-rails |
| Google, GitHub, Facebook, SAML login | OmniAuth strategy, alongside any of the above |
| Existing app on Authlogic, Clearance or Sorcery | Stay, unless you need features they lack |
Whatever you choose, authentication answers "who is this?". Deciding what that user may do is a separate job, covered in Authorization gems.
Plugin historiesAuthlogic
What Authlogic is, how its UserSession model works, its status in 2026 (still maintained, supporting Rails 7.2 to 8.1), and how it compares with Devise, Rodauth and the Rails 8 generator.
Category guidesAuthorization
How Pundit, CanCanCan and Action Policy model permissions in a Rails application, how each handles scopes and testing, and when a hand-written approach is enough.
GuidesEvaluating a Rails gem
A practical checklist for judging a Ruby gem: maintenance signals, compatibility with Rails 7 and 8, dependencies, licence, and security advisories with bundler-audit.