Best Guide to Secure Redis with Password and Connect from Node.js

By default, Redis doesn’t require a password, which can be risky if your server is accessible publicly. In this guide, you’ll learn how to secure Redis using a password and connect to it safely from your Node.js application.

Introduction

Redis allows you to protect your instance with a password using the requirepass directive. This ensures that only authenticated clients can execute commands. You can set it either permanently (via redis.conf) or temporarily (via command line).

1. Locate Your redis.conf File

Depending on your operating system, the configuration file is stored in different paths:

Windows (Manual Install) → C:\Program Files\Redis\redis.windows.conf
Windows (Service Install) → C:\Program Files\Redis\redis.windows-service.conf
Linux → /etc/redis/redis.conf
macOS (Homebrew) → /usr/local/etc/redis.conf
    

2. Add a Password in redis.conf

Open the redis.conf file and look for the following lines:

port 6380
requirepass mySecret123
    

Here, Redis will run on port 6380 with password mySecret123. Save the file and restart your Redis server for the changes to take effect.

3. Restart Redis Server

Once you’ve updated your configuration, restart Redis to apply the new settings:

# Windows (Redis Service)
net stop Redis
net start Redis

# Linux / macOS
sudo systemctl restart redis
    

4. Set a Temporary Password (Optional)

If you don’t want to edit redis.conf, you can start Redis with a temporary password using:

redis-server --requirepass "mySecret123"
    

This password will be active until the server is stopped. It’s a quick way to secure Redis temporarily.

5. Test Redis Authentication

Open Redis CLI and try authenticating manually:

redis-cli -p 6380
AUTH mySecret123
    

If the password is correct, you’ll get a OK response.

6. Connect Securely from Node.js

When connecting from Node.js using the official redis package, include the password in your connection URL.

import { createClient } from "redis";

// If using Redis ACL (user + password)
const client = createClient({
  url: "redis://default:MyStrongPassword123@127.0.0.1:6379",
});

// If using only requirepass (no ACL user)
const client = createClient({
  url: "redis://:mySecret123@127.0.0.1:6380",
});

await client.connect();
console.log("Connected to secure Redis!");

await client.quit();
    

Output

Once the connection is successful, you’ll see the following message:

Connected to secure Redis!