If you already know which language your team writes, here is the short answer. TypeScript: Hono. Python: FastAPI for APIs, Django when you need an admin and auth on day one. Go: the standard library net/http. Rust: Axum. PHP: Laravel 13. Java and Kotlin: Spring Boot 4. C#: ASP.NET Core 10 Minimal APIs. Ruby: Rails 8.1. Elixir: Phoenix 1.8.
Each pick comes with a runner-up and the case where I would reject it. Most of my client work is a Next.js front end talking to an existing backend, so I judge frameworks by what they cost a team after launch, not by a hello-world benchmark.
How I ranked them
Five questions decided each pick:
- Can a new developer deploy it on a plain VPS or container without a platform team?
- Does it check input at the boundary with types you already use?
- Does it have a first-party answer for background jobs?
- Can you hire for it? The 2025 Stack Overflow Developer Survey puts Express at 19.9% usage, ASP.NET Core at 19.7%, FastAPI at 14.8% (up about five points in a year), Spring Boot at 14.7%, Django at 12.6%, Laravel at 8.9%, NestJS at 6.7%, and Rails at 5.9%.
- When the framework is wrong for one endpoint, how easy is it to go one level lower?
Raw requests per second did not make the list. On the projects I have audited, a database query or an external API call set the latency, not the router.
TypeScript and Node: Hono
Hono uses Web Standard Request and Response, so one app runs on Node (through @hono/node-server), Bun, Deno, Cloudflare Workers, and Vercel. Validation plugs in through @hono/zod-validator, and the hc client gives a Next.js front end typed calls without a code generator. My Zod vs Valibot comparison covers the schema choice.
Runner-up: Fastify, for Node services that want JSON Schema for validation and fast serialization, plus a mature plugin set.
Reject Hono when a team of ten or more needs enforced structure. There NestJS earns its decorators and dependency injection, and it can run on the Fastify adapter. For the runtime question, see Bun vs Node for Next.js tooling.
Python: FastAPI, or Django when you need the batteries
FastAPI is my default for JSON APIs, ML-adjacent services, and anything behind a separate front end. Type hints drive validation and the OpenAPI docs. One upgrade trap: FastAPI 0.128.0 removed the temporary pydantic.v1 bridge, so current versions require Pydantic v2 models. Budget a migration pass on older code.
Pick Django when the product needs an admin panel, auth, an ORM, and migrations in week one. Django 6.0 (December 2025) added a built-in Tasks framework with @task and .enqueue(). Read the fine print: Django ships no worker, and its two built-in backends target development and tests. Production still needs a separate worker backend.
Reject FastAPI when the "API" is a content-heavy app with staff users. You will rebuild Django admin badly.
Go: the standard library first
Since Go 1.22, net/http routing understands methods and wildcards. mux.HandleFunc("GET /posts/{id}", h) plus r.PathValue("id") covers most REST routing, and a wrong method gets 405 Method Not Allowed with an Allow header. That removed the main reason teams added a router on day one.
Runner-up: chi, when you want grouped middleware and nested routers with plain http.Handler types. I avoid Gin and Echo on new code because their custom context types make shared middleware harder.
Reject Go when the team needs server-rendered pages with forms, sessions, and an admin. You will write a framework yourself.
Rust: Axum
Axum sits on Tokio, Hyper, and Tower, so timeouts, tracing, and rate limits come from Tower middleware instead of a framework plugin API. Extractors make handler signatures read like the request contract. On upgrade, note that Axum 0.8 changed path syntax from /:id to /{id} and /*path to /{*path}. Old patterns panic at startup.
Runner-up: Actix Web, if the team knows it. Reject Rust when the service is CRUD over Postgres and nobody writes Rust daily. Compile times and hiring cost more than the memory you save.
PHP: Laravel 13
Laravel 13 shipped on March 17, 2026, requires PHP 8.3 or newer, and gets security fixes until March 2028. Queues, scheduling, mail, auth starter kits, and testing come from one vendor with one set of docs. That keeps it ahead for small teams shipping business apps. More in PHP in 2026 feels interesting again.
Runner-up: Symfony, for long-lived enterprise code that favors explicit components over convention. Reject Laravel for a thin JSON proxy in front of another service; give that to Go or Hono.
Java and Kotlin: Spring Boot 4
Spring Boot 4.0 (November 2025) sits on Spring Framework 7, keeps a Java 17 baseline, and supports up to Java 25. Two additions matter day to day: first-class API versioning in Spring MVC and WebFlux, and built-in @Retryable and @ConcurrencyLimit in spring-core, which replace the spring-retry library. Jackson 3 became the default and Spring dropped Undertow, so check both before upgrading.
Runner-up: Ktor for small Kotlin services, Quarkus when container startup time matters most. Reject Spring for three people building one API; the configuration surface is real.
C#: ASP.NET Core 10 Minimal APIs
.NET 10 is the current LTS (November 2025, supported into November 2028). Minimal APIs now check query, header, and body parameters against DataAnnotations once you call builder.Services.AddValidation(), and return a 400 with details. One gotcha from the issue tracker: call it from the assembly that maps the endpoints, or the metadata never gets generated.
Runner-up: MVC controllers, for large teams that want filters and conventions. Reject .NET when nobody on the team knows it; the platform is one of the safest picks here.
Ruby: Rails 8.1
Rails 8 made Solid Queue and Solid Cache the database-backed defaults. Rails 8.1 (October 2025) added Active Job Continuations, so a long job resumes from its last step after a deployment. Kamal 2.8 deploys simple setups without a remote registry. For a solo developer or small team, that is the shortest path from rails new to a paid product on one VPS.
Reject Rails for heavy in-process CPU work or real-time fan-out to tens of thousands of sockets; move that part to Go or Elixir.
Elixir: Phoenix 1.8
Phoenix 1.8 (August 2025) ships with LiveView 1.1, magic-link auth in the generators, and an AGENTS.md in new apps. It stands out for presence, chat, and live dashboards, because the BEAM keeps idle connections cheap. My post on WebSockets vs SSE vs WebRTC covers transports.
Reject Phoenix when hiring speed matters more than runtime properties. The talent pool is small.
If you also get to pick the language
- Next.js front end plus a JSON API, small team: Hono in the same monorepo, or FastAPI if the team writes Python.
- Business app with staff users, admin, and billing: Laravel, Rails, or Django, whichever your team already reads.
- High-traffic internal service or proxy: Go with
net/http. - Enterprise with JVM or .NET staff: Spring Boot 4 or ASP.NET Core 10.
- Real-time product as the core feature: Phoenix.
Decide the API shape before the framework; see GraphQL vs REST vs tRPC.
FAQ
Is Express dead? No. Express led Node frameworks in the 2025 survey. I would not start a new service on it when Hono or Fastify give you validation and types with less glue.
Should every TypeScript team use NestJS? No. Use it when team size makes enforced modules worth the ceremony.