Learn Express.js
Scrimba's free Express course is taught by Tom Chant across about four hours and two projects: Startup Planet, a REST API with query and path parameter filtering, and Spiral Sounds, a SQLite-backed vinyl store with sessions and hashed passwords. It's a solid four hours if you want to understand what a backend framework does, not copy a boilerplate.
Reviewed inside the course with a Pro account, September 2026.
Quick answer
Take it if you write comfortable JavaScript (array methods, fetch, async/await); in Tom's own words you need no prior Node or Express. The one catch is that scrimba.com's own listing promises a few features the lessons do not teach. If you want Node fundamentals first, Learn Node.js is the natural prerequisite.
Learn Express.js
FreeTaught by Tom Chant (opens in a new tab)
Build a REST API and a database-backed vinyl store with sessions, bcrypt, and protected routes, in Express 4 and 5.
Start free on Scrimba (opens in a new tab)Is it worth your time?
Yes, with one caveat about the listing. The teaching is the good kind of slow: every new idea gets an "Aside" scrim that explains it on slides, then a challenge that makes you use it in the project, then Tom's solution. Middleware, the thing that makes Express confusing to newcomers, gets an eight minute aside of its own before you write app.use(express.static('public')), and by the time you get there you know why that one line works. The challenges are not token exercises either. "Filtering by Query Params" hands you three test cases and says "quite a big challenge, so take all of the time you need," and the database and login challenges come with a hint.md file because, as Tom says, "there is a lot of new syntax here" and he does not expect you to remember it by heart.
The course page on scrimba.com promises things the course does not contain. The "What you'll build" text lists task queues, real-time notifications with Server-Sent Events, file uploads, and Event Emitters. None of those appears in any of the 58 scrims. What you get is routing, middleware, static files, SQLite, sessions, hashing, validation, and protected routes: a solid syllabus, but not where SSE or uploads live. The Authentication module has an "Outro (new)" scrim and the course was modified in May 2026, so the listing may describe a longer version that was planned or trimmed.
What you'll learn
Course curriculum
3 modules · 58 lessons
- Build an Express API
- Build a Fullstack Express App
- Authentication
Lesson counts are the scrims I counted in each expanded module in September 2026: 58, 32 of them marked as challenges, plus two certificate items at the end, which is the 60 the course listing and its structured data report. Scrimba's own module headers say 10, 8, and 15; those match the number of challenge icons per module, not the number of scrims. You build Startup Planet, a JSON API with query and path parameter filtering, and then Spiral Sounds, a record shop with an Express server, a SQLite database, a genre dropdown and search, and full sign up, log in, log out, cart, and protected routes using express-session and bcryptjs.
Inside the course, module by module
1. Build an Express API (69 min, 18 scrims)
The project is Startup Planet, a REST API serving a hard-coded array of fictional startups (name, industry, founding year, founders, employees, two booleans for is_seeking_funding and has_mvp). Tom's pitch, in the second scrim: "the best way to make a quick buck is to position yourself between a dreamer and their dreams."
The sequence is npm before Express. "Setting Things Up" has you run npm init from a project_details.md file, then npm install express, then swap node server.js for npm start, with Tom explaining what package-lock.json and node_modules are for and why Scrimba does not show the latter in the editor. The package.json you end up with pins express ^5.1.0, so this half of the course is on Express 5. Then "A Basic Server," an aside on the request/response cycle, an aside on sending a response (status codes, headers, res.json), and "Serving Data."
Query parameters get an aside and then the module's biggest challenge, "Filtering by Query Params" (7:37). The brief is written as comments in server.js with three test URLs and what each should return; you read req.query, destructure the five allowed keys, and chain filter calls, converting the "true"/"false" strings with JSON.parse. Tom's warning before you start is the best line in the module: "there's a real danger you could overthink it and end up writing a load of really complicated JavaScript. I want to urge you before you start to favor simplicity, readability, and maintainability."
Path parameters follow (an aside and two build scrims), then express.Router() and "Modularise The Code," which move the routes into their own file, a catch-all 404 for "Route Not Found," and CORS via the cors package. Two short scrims close the module, one of which is a pitch for Scrimba's affiliate program that you can skip.
2. Build a Fullstack Express App (57 min, 15 scrims)
Spiral Sounds is a vinyl shop: a grid of records, a genre dropdown, and a search box, with the frontend already written and sitting in a public folder. The intro explains why SQLite: "zero setup involved and we don't need a third party server. It's going to run right here in the browser." This project's package.json is on express ^4.21.2 with "type": "module", so you write import rather than require, and both halves of the course use ES module syntax.
The aside on middleware (7:49) is the centre of the course. Tom builds two custom app.use functions that log and call next(), shows the middleware stack running top to bottom, then points back at the CORS import and the 404 handler from module one and says you were already using middleware, you "just didn't know about it at the time." His summary: "middleware is not just some extra add on with Express. It's the framework's architecture." Then express.static in one line, and a challenge to serve the shop's files.
The database section is four asides and four challenges. "Setting up the Database" has you open a connection with the sqlite and sqlite3 packages, write CREATE TABLE IF NOT EXISTS products with the right column types (REAL for price, INTEGER PRIMARY KEY AUTOINCREMENT for id), and verify it with a provided logTable.js. seedTable.js inserts the records. The remaining challenges wire the genre dropdown to SELECT DISTINCT genre and the product grid to a parameterised WHERE genre = ?.
The last challenge, search with partial matching across title, artist, and genre, is the one Tom calls "perhaps the trickiest challenge," and he says outright that the generous hint file is there because "this is an express course more than a SQL course." If your SQL is weak, Intro to SQL before this module would help.
3. Authentication (117 min, 25 scrims)
Half the course by runtime, and the reason to take it. The intro demos the finished app: welcome guest, sign up, welcome by name, log out, add records to a cart, a cart count in the header, delete from the cart, checkout ("we are not adding a payment gateway to this app"). Tom explains why sessions rather than a library: "Express session is the easiest way to add authentication to our site while getting to know how authentication works under the hood. There are plenty of other options, but they add unneeded functionality while abstracting away complexity."
The order is careful. A users table, then a /register route, then an aside on validation and a challenge using the validator package and a regex for usernames, then adding the user to the database. Only then hashing: an aside on hashes and bcrypt, a bcryptjs demo, and a two minute challenge to hash the password with a cost of 10 before the insert. Then express-session (aside, then a challenge to configure the middleware with httpOnly and sameSite cookie options), a scrim on environment variables for the session secret, and "Display a User's Name," which adds a /api/auth/me route the frontend asks to decide whether to show sign up and log in or log out.
"Login" (7:48) is the module's biggest challenge. The brief is deliberately incomplete: three requirements plus "I do want you to check out the function above and just see if there's anything which is missing," and a pointer that lastID is not available this time so you have to fetch the user's id yourself. The solution uses bcrypt.compare and returns the same 401 for a missing user and a wrong password because "we don't want to give clues away."
Logout is left to you ("it's gonna be a big challenge just for you"). Then the cart: a cart_table, adding to it, the cart count, and three consecutive "Cart Page Challenge" scrims. The module ends with an aside on protected routes and a challenge to write a requireAuth middleware that checks req.session.userId, returns a 401 if it is missing, and is mounted on every cart route. The outro suggests stretch goals (a payment gateway sandbox, a better frontend) and, more usefully, "go ahead and build your own project with Express from scratch. That is how you will consolidate the knowledge you got from this course."
The final scrim is the solo project brief, Dungeon Dice Duel, presented by Jonathan Hill rather than Tom. It is a dice battle game with a written frontend and a diceGameEngine.js already supplied; your job is the Express side, in three "epics": endpoints with hard-coded data, then a SQLite database that also records game "runs," then register, log in, and log out so each player's stats are stored. The spec lives in a linked Notion document. It is about five minutes of video and a good many hours of work.
What a lesson feels like
Scrims run from one to eight minutes, most between three and six. Concept scrims are titled "Aside:" and play as slides with Tom narrating; build scrims open on the editor with a /* Challenge: */ comment block at the top of the file, the recording stops, and you write into the same file. The scrubber shows small markers where the challenges sit, so you can see how much is you and how much is him. There is a Runner pane for node server.js, a Terminal for npm commands, and two things I had not used before: a Network tool for firing requests at your API and reading the JSON, and a mini browser for the Spiral Sounds frontend. You never leave the tab.
Every scrim has captions, a timestamped transcript panel (settings menu), subtitles in ten languages, and speed controls. Tom's tone is dry and a little self-deprecating ("okay, I am exaggerating with this GIF"). The harder challenges get a "congratulations if you did" afterwards rather than a pretence that everyone sailed through, and he solves challenges in front of you with his own reasoning, not just the answer, which is where the "favor simplicity" advice and the "don't give clues away" security point come from.
Free or Pro: exactly what is gated
All three modules, all 58 scrims, and every challenge are free. Only the first scrim carries a SAMPLE badge, and nothing in the table of contents is marked PRO. I could not test what a free account sees on the Dungeon Dice Duel solo project scrim, since I was logged in as Pro, but unlike Scrimba's Learn JavaScript course, where the solo projects are labelled "Solo Project (PRO)", this one carries no such label.
What Pro does gate is the certificate of completion at the end of the course, the two career paths this course sits in, and the Pro-only channels on Scrimba's Discord (the pricing page lists basic Discord access as a free feature). If you want the certificate on a CV, or you plan to work through the Backend or Fullstack path in order, see current plans (opens in a new tab) for what that costs where you live. If you just want to learn Express, you do not need to pay.
How long it takes
Four hours of video is a misleading number here because 32 of the 58 scrims are challenges, and several of them (query filtering, the database table, search, login, the cart pages) will take you longer than the scrim itself. Budget two and a half to three times the runtime: 10 to 12 hours, which is a week at an hour and a half a day or two focused weekends. The Authentication module alone is two hours of video and will take five or six.
The solo project is on top of that. Three epics with a database and auth is a full weekend if you are new to backend, longer if you attempt the stretch goal of rendering stats on the frontend without any frontend code provided.
Who it's for, and who should skip it
It fits frontend developers who want to see the other side of fetch, self-taught JavaScript developers who have only ever used a backend as a service, and anyone on the Fullstack Developer Path or Backend Developer Path who wants a framework they will actually meet at work. The course is also a good fit if you learn by reading code, because the finished Spiral Sounds project (controllers, routes, middleware, db folders) is a clean small example of how an Express app is laid out.
Skip it if your JavaScript is not yet solid; the intro is explicit that you should be comfortable with map, reduce, filter, fetch, and async/await, and the auth module assumes all of it. Skip it, or come back later, if you specifically want Server-Sent Events, file uploads, or job queues; despite the listing, they are not in the course. And if you already run Express in production, there is nothing new here beyond a well structured refresher.
Prerequisites
JavaScript, including array methods, promises, and async/await. Tom says in the first scrim that you need no Node or Express knowledge and the course starts "from the ground up," and that is accurate: npm init is explained. The course page on scrimba.com nevertheless recommends some Node experience, and I would agree that Learn Node.js first makes module one much faster. SQL is the other quiet prerequisite: you write CREATE TABLE, INSERT, SELECT DISTINCT, parameterised WHERE clauses and LIKE patterns, and the hint files assume you have at least seen them. Nothing needs installing; the terminal, runner, and mini browser are inside the scrim.
Where it fits
Learn Express.js is the backend framework step in two of Scrimba's paths, Backend and Fullstack, and the practical sequel to Learn Node.js, which is Tom's course too. It is the natural place to go after Learn JavaScript and Advanced JavaScript if you want to build APIs rather than interfaces, and Intro to SQL pairs with its second and third modules. After it, Learn Cybersecurity is the obvious way to harden the auth you just built.
Strengths and limits
What it does well: the aside-then-challenge rhythm makes middleware and sessions feel inevitable rather than magic; the challenges are real and sometimes deliberately under-specified; you test your API inside the scrim with a request tool and a mini browser; the auth module covers validation, hashing, sessions, and route protection in the right order and explains the security reasoning; and everything, including the solo project brief, is free.
Where it is limited: the course listing promises SSE, uploads, task queues, and Event Emitters that are not in the lessons; the two projects sit on different Express majors (5.1 for Startup Planet, 4.21 for Spiral Sounds), which none of the scrims I opened remarks on; SQL is assumed more than taught; deployment is never covered, so you finish with an app that only runs in Scrimba's sandbox; and the solo project's spec lives in an external Notion document rather than in the scrim.
Related courses and comparisons
- All JavaScript courses, the full category
- Learn Node.js, the recommended prerequisite
- Learn JavaScript, the language foundation
- Intro to SQL, for the database half of the course
- Learn Cybersecurity, to secure what you build
- Learn Firebase, an alternative when you want a backend without writing one
- Scrimba vs Boot.dev, if you are comparing backend-focused platforms
Yes. All three modules, all 58 scrims, every challenge, and the solo project brief are free, with no card required. Pro is only needed for the certificate, the career paths, and the Pro-only Discord channels.
Tom Chant, who also teaches Learn Node.js and Advanced JavaScript. The final solo project brief, Dungeon Dice Duel, is presented by Jonathan Hill.
Startup Planet, a REST API over an array of fictional startups with query and path parameter filtering, a router, a 404 handler, and CORS; then Spiral Sounds, a vinyl store with an Express server, a SQLite database, a genre dropdown and search, sign up, log in, log out, a cart, and protected routes using express-session and bcryptjs.
Tom says no, and the course does start with npm init, so a first-time Node user can follow it. The scrimba.com listing recommends some Node experience, and Learn Node.js first will make module one faster. Solid JavaScript (array methods, fetch, async/await) is the real requirement.
Both. The Startup Planet API in module one uses express ^5.1.0; the Spiral Sounds project in modules two and three uses express ^4.21.2, along with express-session 1.18, bcryptjs 3, sqlite 5, sqlite3 5, and validator 13. Everything uses ES module import syntax.
No. The course listing mentions them, but none of the 58 scrims teaches them. The content is routing, middleware, static files, SQLite, sessions, hashing, validation, and protected routes.
No. The terminal, a runner for node server.js, a request tool for hitting your API, and a mini browser for the frontend are all inside the scrim. Scrimba hides node_modules in the editor but npm install works.
About 4 hours of video, but 32 scrims are challenges, so plan for 10 to 12 hours, plus a weekend for the Dungeon Dice Duel solo project.
Yes. Every scrim has captions, a timestamped transcript panel under the settings menu, and subtitles in ten languages.
Yes, a certificate of completion at the end of the course, which requires Scrimba Pro.