Install Express.js
Installing Express.js takes one command. Once you have Node.js and npm ready from the previous setup, you add Express to your project in seconds. This topic covers the installation command, what happens during installation, how to verify it worked, and what each generated file means.
The Installation Command
Open your terminal, navigate to your project folder, and run:
npm install express
npm connects to the internet, downloads Express and all of its dependencies, and saves everything inside a folder called node_modules. The entire process usually takes under 30 seconds.
What Happens During Installation
Think of npm like a delivery service. You place an order for Express, and npm goes to the warehouse (the npm registry online), picks up the package, and delivers it to your project folder. Express itself depends on other smaller packages, so npm automatically fetches those too.
You run: npm install express
│
▼
npm Registry (online warehouse)
│
┌─────┴─────────────────────────────────┐
│ Downloads: │
│ • express (the main package) │
│ • body-parser (reads request data) │
│ • path-to-regexp (matches URLs) │
│ • accepts (handles content types) │
│ • ... and more sub-dependencies │
└──────────────────┬────────────────────┘
│
▼
Your project / node_modules /
You only asked for Express, but npm installed all the smaller packages that Express itself relies on. This chain of dependencies is normal in JavaScript development.
Changes to Your Project After Installation
After running the install command, two things change in your project:
1. node_modules Folder Appears
This folder holds Express and every sub-package it depends on. You never need to open this folder or edit anything inside it. npm manages it entirely.
2. package.json Gets Updated
Open your package.json file. You will now see a new section called dependencies:
{
"name": "my-express-app",
"version": "1.0.0",
"main": "index.js",
"dependencies": {
"express": "^4.18.2"
}
}
The dependencies section records every package your project needs to run. The ^ symbol before the version number means npm will accept minor updates but not major version changes when someone reinstalls the project.
3. package-lock.json Appears
This file records the exact version of every single package installed, including all sub-dependencies. It guarantees that every developer on your team installs the exact same versions, preventing bugs caused by version differences.
┌──────────────────────────────────────────────────────┐ │ Project Files After Installation │ ├────────────────────┬─────────────────────────────────┤ │ node_modules/ │ All downloaded package files │ │ package.json │ Lists "express" as dependency │ │ package-lock.json │ Locks exact versions of all pkgs│ └────────────────────┴─────────────────────────────────┘
Verifying the Installation
Check that Express installed correctly with this command:
npm list express
You should see output like this:
my-express-app@1.0.0 └── express@4.18.2
This confirms Express is available in your project. Alternatively, look inside node_modules and confirm an express folder exists there.
Installing a Specific Version
Sometimes a project requires a specific Express version. Add the version number after the package name using the @ symbol:
npm install express@4.18.0
This installs exactly version 4.18.0 rather than the latest available version. Teams use this approach to keep all developers on the same version.
The --save Flag (Historical Context)
In older tutorials, you may see the command written as:
npm install express --save
The --save flag used to be required to record the package in package.json. Modern npm (version 5 and above) adds packages to package.json automatically without this flag. You do not need --save anymore, but you will still see it in older code examples.
Dev Dependencies vs Regular Dependencies
Some packages only assist during development and should not be part of the production build. Install those with the --save-dev flag:
npm install nodemon --save-dev
Nodemon is a popular development tool that automatically restarts your server when you save changes to a file. You use it while coding but never need it when deploying to production.
┌──────────────────────────────────────────────────────────┐ │ Regular vs Dev Dependencies │ ├────────────────────────┬─────────────────────────────────┤ │ dependencies │ Used in production │ │ (npm install pkg) │ Example: express, mongoose │ ├────────────────────────┼─────────────────────────────────┤ │ devDependencies │ Used during development only │ │ (npm install pkg -D) │ Example: nodemon, jest │ └────────────────────────┴─────────────────────────────────┘
After installing nodemon as a dev dependency, your package.json shows both sections:
{
"dependencies": {
"express": "^4.18.2"
},
"devDependencies": {
"nodemon": "^3.0.1"
}
}
Reinstalling All Dependencies
When you clone a project from GitHub or receive code from a teammate, the node_modules folder is missing. Run this single command inside the project folder to install everything listed in package.json:
npm install
npm reads the package.json file and downloads every listed package. Your project is then ready to run.
New developer gets the project: ↓ Clone or copy the project folder (no node_modules — it's in .gitignore) ↓ cd my-express-app ↓ npm install ← installs everything from package.json ↓ Project ready to run
Updating Express
To update Express to the latest compatible version based on your package.json range:
npm update express
To update to the absolute latest version regardless of your current range:
npm install express@latest
Always test your application after an update to make sure nothing changed that affects your code.
Summary
Run npm install express inside your project folder to install Express. npm downloads Express and its sub-dependencies into the node_modules folder and records Express in package.json. A package-lock.json file locks exact versions for consistency across machines. Use npm install without a package name to reinstall everything from package.json. Install development-only tools like nodemon with the --save-dev flag so they stay out of your production build.