Devise

Devise is the de facto standard authentication gem for Ruby on Rails, maintained by the Heartcombo GitHub org. It is built from ten pluggable modules — Database Authenticatable, Registerable, Confirmable, Recoverable, Rememberable, Trackable, Validatable, Lockable, Timeoutable, and Omniauthable — so a project can enable exactly the pieces it needs, from a bare login form to full email confirmation and account lockout.

Rails 8 added a lightweight built-in auth generator (has_secure_password-based) for teams that want something minimal, but Devise remains the dominant choice once a Rails app needs a fuller feature set: social login via OmniAuth, confirmable email, or account recovery flows, generated and wired up for you.

Underneath its generators, Devise runs on Warden, the Rack middleware that handles the actual authentication strategies — which is also why it can support multiple separate user models in one app, so an Admin and a User model can each have their own Devise configuration and session. A large extension ecosystem builds on top of it, including Devise Invitable for invite-only signup and Devise JWT for token-based auth on API-only Rails apps.