Skip to content
Get packs

Guide · Open source

How to use Devise: set up Rails user accounts step by step

Updated · written with AI from the project's own documentation and checked against our catalogue data

Devise is a Ruby gem that adds user accounts to a Rails web application, covering sign up, sign in, password resets and email confirmation so you don't have to write those parts yourself. This guide explains what Devise is built from, what it requires, and how to decide which of its ten optional modules your app needs. By the end you'll know where to start and when a different tool may be a better fit.

Deviseheartcombo/devise · ★ 24.4k · MIT

Quick start

  1. 1Decide if Devise fits. Confirm your project is a Rails app and that you understand basic Rails authentication. If not, learn that first.
  2. 2Pick your modules. List the account features you need, such as confirmation, password reset or locking, and map them to Devise's modules.
  3. 3Add the gem. Add Devise to your Rails project following the current instructions on the Devise wiki.
  4. 4Set up your user model. Attach the modules you chose to your user model so each one adds its behaviour.
  5. 5Customize views and routes. Adjust the views, controllers, routes and strong parameters to match your app.
  6. 6Test sign in and sign up. Use Devise's test helpers to check the flows in your controller and integration tests.

Check whether Devise fits your project

Devise is built for Rails. It is a code library you integrate into your own application, not a hosted login service you can switch on without code. Its prerequisites are Ruby and Rails.

The project's own README recommends that people building their first Rails app do not start with Devise. Devise requires a good understanding of the Rails framework, so if you are new to Rails, learn basic authentication from scratch first.

  • Good fit: Rails developers who need standard email-and-password login quickly.
  • Good fit: teams that want email confirmation, password reset and account locking without building them.
  • Good fit: apps that need more than one kind of user model signed in at once.
  • Poor fit: non-Rails projects.
  • Poor fit: projects that need a hosted login service with no code.

Understand the ten Devise modules

Devise is based on modularity: you use only the parts you really need. Each module is attached to a model and adds one piece of account behaviour. The main modules are Database Authenticatable (stores and checks a hashed password), Confirmable (sends confirmation emails), Recoverable (resets passwords), Registerable (sign up, plus editing and deleting an account), Rememberable (remember-me cookie), Trackable (sign in count, timestamps and IP address), Timeoutable (expires idle sessions), Validatable (email and password validations), Lockable (locks an account after failed sign-in attempts) and Omniauthable (OmniAuth support).

  • Database Authenticatable: password hashing and sign in through POST requests or HTTP Basic Authentication.
  • Confirmable: emails confirmation instructions and checks whether an account is confirmed at sign in.
  • Lockable: locks after a set number of failed attempts, unlockable by email or after a time period.
  • Validatable: email and password validations, which you can customize.

Add Devise to a Rails app

Devise is distributed as a gem and is used through your Rails project's dependency setup. The README in the source does not give a full install walkthrough, so follow the current instructions on the Devise wiki for adding the gem, running its generators and creating a user model.

To look at the source code or contribute, you can clone the repository. The README gives this command for that purpose.

git clone https://github.com/heartcombo/devise

Configure models, controllers, views and routes

Devise is a complete MVC solution built on Rails engines. The README lists separate guides for configuring models, strong parameters, views, controllers and routes, so you can customize each layer as needed.

Devise also supports multiple models signed in at the same time, which is useful when you have, for example, separate customer and admin accounts. Its built-in OmniAuth support is available through the Omniauthable module.

  • Configuring Models
  • Strong Parameters
  • Configuring views
  • Configuring controllers
  • Configuring routes
  • Configuring multiple models

Test your authentication

Devise includes test helpers for controller tests and integration tests, so you can check sign in and sign up behaviour in your own test suite.

If you contribute to Devise itself, the README says the test suite uses minitest and is run with bin/test after running bundle install. You can run all tests, a single file, or a specific line.

  • Running all tests: bin/test
  • Running one file: bin/test test/models/trackable_test.rb
bin/test test/models/trackable_test.rb:16

Find help and further reading

The Devise Wiki has how-to articles and answers to frequent questions, and the README recommends browsing it after finishing the README. Questions should go to StackOverflow using the devise tag rather than the GitHub issue tracker. Security-related bugs should be reported by email, not in public issues.

RDoc documentation is available online, and the README notes that you can run gem server after installing the gem to read the documentation that matches your installed version.

  • Wiki: github.com/heartcombo/devise/wiki
  • Questions: StackOverflow, tag devise
  • Security bugs: email heartcombo.oss@gmail.com

What people use it for

  • Adding email and password sign up and sign in to a Rails web app.
  • Sending confirmation emails before a new account can be used.
  • Letting users reset a forgotten password by email.
  • Locking an account after repeated failed sign-in attempts.
  • Running separate sign-in flows for different user types, such as customers and admins.

Frequently asked questions

Is Devise free to use?

Devise is released under the MIT licence, as stated in the project's listing. Check the LICENSE file in the repository for the full terms before using it in your product.

What do I need to use Devise?

Devise requires Ruby and Rails. It is a Ruby gem built specifically for Rails web applications, so it will not work on its own in non-Rails projects.

Is Devise good for beginners?

The Devise README recommends that people building their first Rails app not use Devise yet. It suggests learning Rails and authentication from scratch first, then using Devise.

What are the alternatives to Devise?

Comparable projects listed for this tool are Rodauth, Sorcery, Clearance and Authlogic. Each targets Ruby authentication, so compare them on the features you need.

Can Devise send password reset and confirmation emails?

Yes. The Recoverable module resets passwords and sends reset instructions, and the Confirmable module sends confirmation instructions and checks whether an account is confirmed during sign in.

Where can I get help if Devise breaks?

Ask on StackOverflow using the devise tag, and read the Devise Wiki for frequently asked questions. Report security bugs by email rather than on the GitHub issue tracker.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Devise is a strong choice for Rails developers who want standard email-and-password accounts with confirmation, reset and locking already built. Skip it if you are new to Rails, work outside Rails, or want a hosted login service you can use without writing code.

Install options & downloads