Web development · 5 stages · about 46 weeks
Backend developer (Node.js) roadmap
0/28 tasks done (ticks are kept on this device)
- 1
Beginner · about 6 weeks
JavaScript on the server and how the web talks
What to learn
JavaScript basics: Node.js runs JavaScript, so you need the language first.
Learn variables, if/else, loops, functions, arrays and objects. Write small programs and run them with the node command in a terminal. If you already know some frontend JavaScript, you can move through this part quickly.
What a backend does: You need a clear picture of where your code runs.
The frontend runs in the user's browser or phone. The backend runs on a server: it checks the login, reads and saves data in a database, and sends back an answer. A food delivery app, for example, uses the backend to store orders, menus and payments.
HTTP basics: HTTP is the language the browser and the server use to talk.
A request has a method (GET to read, POST to create, PUT or PATCH to change, DELETE to remove), a URL, headers and sometimes a body. The server answers with a status code like 200 (OK), 404 (not found) or 500 (server error). Learn to read these in Chrome DevTools, in the Network tab.
Node.js and npm: Node.js lets JavaScript run outside the browser, on a server.
Install the current LTS (long-term support) version of Node.js. npm installs packages, which are ready-made code from other developers, and package.json lists them. Learn the difference between ES modules (import) and the older CommonJS (require).
Async JavaScript: Servers wait for databases and networks all the time.
A promise is a value that will arrive later, like a result from the database. async/await lets you write this waiting code in a simple top-to-bottom style. Node.js handles many users at once because it does not sit still while it waits.
The command line: Servers are run and fixed from a terminal, not with a mouse.
Learn to move between folders, create and delete files, read logs and set environment variables. Most servers run Linux, so practise basic Linux commands too. On Windows you can use Git Bash or WSL (Linux inside Windows).
Git and GitHub: Git saves every version of your code; GitHub shows your work to employers.
Git records changes as commits, so you can go back when something breaks. Push every practice project to GitHub with a short README that explains how to run it. Recruiters often look at your GitHub profile.
Tasks
Project
A command-line expense tracker in Node.js: add an expense with an amount in rupees and a category, list all expenses, and show the monthly total, saved in a JSON file.
📘 Learn it here, free: Backend Development course
Free resources
- 2
Beginner · about 10 weeks
REST APIs with Express, TypeScript and databases
What to learn
Express or Fastify: These frameworks make it easy to build web servers in Node.js.
A framework gives you routes (which code runs for which URL) and middleware (code that runs before every request, for example to log it). Express is the most common in Indian job posts. Fastify is newer and faster, and the ideas are the same.
REST API design: Most backends talk to apps through a REST API.
In REST, each thing is a resource with its own URL, like /products or /orders/42. You use HTTP methods to read, create, change and delete them, and send data as JSON. Good APIs use clear names, the right status codes and helpful error messages.
TypeScript: Most new Node.js jobs ask for TypeScript.
TypeScript is JavaScript with types: you say a price is a number and an email is a string. The editor then warns you before you run broken code. Start by adding types to your request bodies and database results.
SQL and PostgreSQL: Most business data lives in SQL databases.
A SQL database keeps data in tables with rows and columns, like a strong spreadsheet. Learn SELECT, INSERT, UPDATE, DELETE, WHERE, JOIN and GROUP BY. PostgreSQL is free, reliable and very common in new companies.
Database design: A good table design prevents many bugs later.
Give every table a primary key (a unique id) and link tables with foreign keys, for example each order belongs to one customer. Avoid storing the same fact in two places. Add indexes on columns you search often, so lookups stay fast.
An ORM (Prisma or Drizzle): An ORM lets you work with the database from TypeScript safely.
An ORM (object-relational mapper) turns your tables into TypeScript objects and writes much of the SQL for you. It also handles migrations, which are saved steps that change the database structure. Still learn plain SQL, because you will need it to fix slow queries.
MongoDB: Many Indian startups and MERN projects use MongoDB.
MongoDB stores data as JSON-like documents instead of tables. It is easy to start with and fits data that changes shape often. Learn when SQL is a better fit, for example for money and orders that must always add up.
Input validation: Never trust data that comes from the user.
Check every request body before you use it: required fields, types, lengths and formats like email or phone number. Libraries such as Zod let you write these rules once. Send back a clear 400 error that says what is wrong.
Tasks
Project
A REST API for a local kirana shop: products, stock, customers and orders, with GST added to each bill, stored in PostgreSQL, written in TypeScript, with a README that lists every route.
📘 Learn it here, free: Backend Development course
Free resources
- 3
Intermediate · about 10 weeks
Auth, testing, caching and Docker
What to learn
Password hashing: If your database leaks, plain passwords put every user at risk.
Never store a password as it is typed. Store a hash instead, made with a slow algorithm like bcrypt or argon2, so it is very hard to reverse. When the user logs in, you hash what they typed and compare.
Sessions and JWT: After login, the server must remember who the user is.
With sessions, the server stores the login and gives the browser a cookie with a random id. With JWT (JSON Web Token), the server gives a signed token that the app sends with each request. Learn both, when each fits, and why short expiry times and HTTP-only cookies matter.
Authorization: Logging in is not enough; users must only reach their own data.
Authentication asks "who are you?" and authorization asks "what are you allowed to do?". Check on every route that the user owns the record or has the right role, like admin or staff. Many real data leaks come from a missing check here.
Automated testing: Tests let you change code without fear of breaking it.
Unit tests check small functions, like a GST calculator. Integration tests call your real API routes with a test database, using a tool like Supertest. Run tests with Vitest or Jest on every change.
Redis and caching: A cache makes slow or repeated work fast.
Redis is a very fast in-memory store for keys and values. You can save a slow database result in Redis for a few minutes, so the next request is quick. Redis is also used for rate limiting, sessions and simple queues.
Docker: Docker makes your app run the same way on every computer and server.
A Docker image packs your app with the exact Node.js version and packages it needs. A container is a running copy of that image. Docker Compose starts your API, PostgreSQL and Redis together with one command.
Environment variables and config: Secrets and settings must not live inside your code.
Database passwords, API keys and ports go in environment variables, often loaded from a .env file in development. Never commit .env files to GitHub. Follow the twelve-factor app rules for clean config.
API documentation with OpenAPI: Frontend and mobile developers need to know how to use your API.
OpenAPI (also called Swagger) is a standard way to describe every route, its inputs and its outputs. Tools turn this file into a web page where people can try your API. Many teams generate it from their code.
Tasks
Project
A booking API for a clinic or salon: sign-up and login, time slots, bookings, staff and admin roles, Redis rate limiting on login, tests in CI, and a docker-compose setup anyone can run.
📘 Learn it here, free: Backend Development course
Free resources
- 4
Intermediate · about 8 weeks
Queues, real-time features and deployment
What to learn
Background jobs and queues: Slow work like emails and reports should not make the user wait.
A queue is a waiting list of jobs. Your API adds a job, such as "send invoice email", and a separate worker process does it later. BullMQ (on Redis) is common in Node.js; bigger systems use RabbitMQ or Kafka.
Webhooks and third-party APIs: Real apps connect to payments, SMS and email services.
A webhook is a call that another service makes to your server when something happens, like "payment done". Payment gateways used in India, such as Razorpay, send webhooks for UPI and card payments. Always check the webhook signature and handle the same event arriving twice.
Real-time with WebSockets: Chats, live order tracking and dashboards need instant updates.
A normal HTTP request ends after one answer. A WebSocket keeps a connection open, so the server can push new data any time. Libraries like Socket.IO make this easier.
Logging and error handling: When something breaks in production, logs are how you find out why.
Use one central error handler, so every error returns a clean message and is logged with details. Write structured logs (JSON) with a tool like Pino, including a request id. Never log passwords, tokens or full card numbers.
Deploying to the cloud: Your API is only useful when others can reach it.
You can start on platforms like Render, Railway or Fly.io, or on a small Linux server (VPS). Learn to set environment variables, run migrations, and put the app behind HTTPS. Use a managed PostgreSQL service so backups are handled for you.
CI/CD: Automatic checks and deploys stop mistakes from reaching users.
CI (continuous integration) runs lint, type-check and tests on every pull request. CD (continuous delivery) deploys the app when the main branch passes. GitHub Actions is free for public repos and common in jobs.
Tasks
Project
A food-order backend for a small restaurant: menu, cart, orders, a test-mode payment webhook, live order status by WebSocket, a queue for SMS or email receipts, logs, and automatic deploys.
📘 Learn it here, free: Backend Development course
Free resources
- 5
Expert · about 12 weeks
System design, scale and reliability
What to learn
System design basics: Senior interviews and real work ask how you would build a large system.
Learn the building blocks: load balancers, many app servers, a database with read copies, a cache, a queue and object storage for files. Practise drawing a design for something like a URL shortener or a ticket booking site. Always talk about trade-offs, not just one "right" answer.
Database performance: The database is usually the first thing to slow down as users grow.
Use EXPLAIN in PostgreSQL to see how a query runs and add the right indexes. Avoid the "N+1" problem, where one page makes hundreds of small queries. Learn transactions, so a payment and an order are saved together or not at all.
Scaling Node.js: One Node.js process uses one CPU core for your code.
Run several copies of the app behind a load balancer, and keep the app stateless so any copy can answer any request. Move heavy CPU work to worker threads or separate services. Keep shared state in Redis or the database, not in memory.
Microservices and messaging: Large teams split big systems into smaller services.
A microservice owns one job, like payments or notifications, and talks to others through APIs or messages. This helps big teams but adds network problems and harder debugging. Most products should start as one well-organised app (a modular monolith) and split only when needed.
Observability: You cannot fix what you cannot see.
Observability means logs, metrics (numbers like requests per second) and traces (the path of one request through all services). OpenTelemetry is the common open standard for collecting them. Set alerts for errors and slow responses, not for every small thing.
Security in depth: Backends hold the most valuable data in a company.
Study the OWASP Top 10, such as injection and broken access control. Use parameterised queries, rate limits, security headers and least privilege for database users. Keep packages updated and check them with npm audit.
Leading and reviewing: Senior engineers make the whole team better.
Write short design documents before big changes and ask for feedback early. Give code reviews that are kind and explain why. Help juniors by pairing with them and writing clear runbooks for common problems.
Tasks
Project
A small but production-style system, such as an event ticket platform: an API, a worker service, PostgreSQL with transactions for seat booking, Redis cache, a queue, traces and alerts, load-tested with a tool like k6, with a design document explaining every choice.
Free resources