
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
Embedded JavaScript templates
$ npm install ejs
<% %><%= %> (escape function configurable)<%- %>-%> ending tag<%_ _%><? ?> instead of <% %>)<% if (user) { %>
<h2><%= user.name %></h2>
<% } %>
Try EJS online at: https://ionicabizau.github.io/ejs-playground/.
let template = ejs.compile(str, options);
template(data);
// => Rendered HTML string
ejs.render(str, data, options);
// => Rendered HTML string
ejs.renderFile(filename, data, options, function(err, str){
// str => Rendered HTML string
});
It is also possible to use ejs.render(dataAndOptions); where you pass
everything in a single object. In that case, you'll end up with local variables
for all the passed options. However, be aware that your code could break if we
add an option with the same name as one of your data object's properties.
Therefore, we do not recommend using this shortcut.
cache Compiled functions are cached, requires filenamefilename The name of the file being rendered. Not required if you
are using renderFile(). Used by cache to key caches, and for includes.root Set project root for includes with an absolute path (/file.ejs).context Function execution contextcompileDebug When false no debug instrumentation is compiledclient When true, compiles a function that can be rendered
in the browser without needing to load the EJS Runtime
(ejs.min.js).delimiter Character to use with angle brackets for open/closedebug Output generated function bodystrict When set to true, generated function is in strict mode_with Whether or not to use with() {} constructs. If false
then the locals will be stored in the locals object. Set to false in strict mode.destructuredLocals An array of local variables that are always destructured from
the locals object, available even in strict mode.localsName Name to use for the object storing local variables when not using
with Defaults to localsrmWhitespace Remove all safe-to-remove whitespace, including leading
and trailing whitespace. It also enables a safer version of -%> line
slurping for all scriptlet tags (it does not strip new lines of tags in
the middle of a line).escape The escaping function used with <%= construct. It is
used in rendering and is .toString()ed in the generation of client functions.
(By default escapes XML).outputFunctionName Set to a string (e.g., 'echo' or 'print') for a function to print
output inside scriptlet tags.async When true, EJS will use an async function for rendering. (Depends
on async/await support in the JS runtime.This project uses JSDoc. For the full public API
documentation, clone the repository and run npm run doc. This will run JSDoc
with the proper options and output the documentation to out/. If you want
the both the public & private API docs, run npm run devdoc instead.
<% 'Scriptlet' tag, for control-flow, no output<%_ 'Whitespace Slurping' Scriptlet tag, strips all whitespace before it<%= Outputs the value into the template (escaped)<%- Outputs the unescaped value into the template<%# Comment tag, no execution, no output<%% Outputs a literal '<%'%%> Outputs a literal '%>'%> Plain ending tag-%> Trim-mode ('newline slurp') tag, trims following newline_%> 'Whitespace Slurping' ending tag, removes all whitespace after itFor the full syntax documentation, please see docs/syntax.md.
Includes either have to be an absolute path, or, if not, are assumed as
relative to the template with the include call. For example if you are
including ./views/user/show.ejs from ./views/users.ejs you would
use <%- include('user/show') %>.
You must specify the filename option for the template with the include
call unless you are using renderFile().
You'll likely want to use the raw output tag (<%-) with your include to avoid
double-escaping the HTML output.
<ul>
<% users.forEach(function(user){ %>
<%- include('user/show', {user: user}) %>
<% }); %>
</ul>
Includes are inserted at runtime, so you can use variables for the path in the
include call (for example <%- include(somePath) %>). Variables in your
top-level data object are available to all your includes, but local variables
need to be passed down.
NOTE: Include preprocessor directives (<% include user/show %>) are
still supported.
Custom delimiters can be applied on a per-template basis, or globally:
let ejs = require('ejs'),
users = ['geddy', 'neil', 'alex'];
// Just one template
ejs.render('<?= users.join(" | "); ?>', {users: users}, {delimiter: '?'});
// => 'geddy | neil | alex'
// Or globally
ejs.delimiter = '$';
ejs.render('<$= users.join(" | "); $>', {users: users});
// => 'geddy | neil | alex'
EJS ships with a basic in-process cache for caching the intermediate JavaScript
functions used to render templates. It's easy to plug in LRU caching using
Node's lru-cache library:
let ejs = require('ejs'),
LRU = require('lru-cache');
ejs.cache = LRU(100); // LRU cache with 100-item limit
If you want to clear the EJS cache, call ejs.clearCache. If you're using the
LRU cache and need a different limit, simple reset ejs.cache to a new instance
of the LRU.
The default file loader is fs.readFileSync, if you want to customize it, you can set ejs.fileLoader.
let ejs = require('ejs');
let myFileLoad = function (filePath) {
return 'myFileLoad: ' + fs.readFileSync(filePath);
};
ejs.fileLoader = myFileLoad;
With this feature, you can preprocess the template before reading it.
EJS does not specifically support blocks, but layouts can be implemented by including headers and footers, like so:
<%- include('header') -%>
<h1>
Title
</h1>
<p>
My page
</p>
<%- include('footer') -%>
Go to the Latest Release, download
./ejs.js or ./ejs.min.js. Alternately, you can compile it yourself by cloning
the repository and running jake build (or $(npm bin)/jake build if jake is
not installed globally).
Include one of these files on your page, and ejs should be available globally.
<div id="output"></div>
<script src="ejs.min.js"></script>
<script>
let people = ['geddy', 'neil', 'alex'],
html = ejs.render('<%= people.join(", "); %>', {people: people});
// With jQuery:
$('#output').html(html);
// Vanilla JS:
document.getElementById('output').innerHTML = html;
</script>
Most of EJS will work as expected; however, there are a few things to note:
ejs.renderFile() won't work.includes do not work unless you use an include callback. Here is an example:let str = "Hello <%= include('file', {person: 'John'}); %>",
fn = ejs.compile(str, {client: true});
fn(data, null, function(path, d){ // include callback
// path -> 'file'
// d -> {person: 'John'}
// Put your code here
// Return the contents of file as a string
}); // returns rendered string
See the examples folder for more details.
VSCode:Javascript EJS by DigitalBrainstem
There are a number of implementations of EJS:
Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
EJS Embedded JavaScript templates copyright 2112 mde@fleegix.org.
Pug (formerly known as Jade) is a high-performance template engine heavily influenced by Haml and implemented with JavaScript for Node.js and browsers. It offers a more terse syntax compared to EJS and is whitespace-sensitive, which can lead to cleaner templates.
Handlebars is a simple templating language that uses a Mustache-like syntax. It is known for its logic-less templates, which means it encourages a separation of logic from the view, unlike EJS which allows JavaScript code in templates.
Mustache is a logic-less template syntax that can be used for HTML, config files, source code - anything. It works by expanding tags in a template using values provided in a hash or object. It is simpler than EJS and does not allow for direct execution of JavaScript code within the templates.
Nunjucks is a templating engine for JavaScript inspired by Jinja2. It is more powerful than EJS in terms of features like template inheritance and asynchronous control, but it can be more complex to use.
FAQs
Embedded JavaScript templates
The npm package ejs receives a total of 17,155,689 weekly downloads. As such, ejs popularity was classified as popular.
We found that ejs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.