How a 33-year-old scripting language from Brazil quietly powers Roblox, Cloudflare, and billions of requests daily.
Get new posts delivered to your inbox. No spam, unsubscribe anytime.
LuaJIT finishes a computational benchmark in 23.29 seconds. C finishes in 22.29. That's a 4.5% gap between a dynamically typed scripting language and the fastest compiled language on earth. Python, doing the same test? 416.55 seconds. Eighteen times slower. (If you're curious about the ML engineer career path that relies heavily on Python, I wrote a complete roadmap for 2026.)
Lua just jumped 18 spots to #20 on the TIOBE Index in March 2026. It powers the scripting inside Roblox (381.8 million monthly active users), Cloudflare's edge network (roughly 20% of all web traffic), every World of Warcraft addon ever written, and the entire Neovim plugin ecosystem. Yet most developers couldn't write a "Hello World" in it.
This is the most underrated language in programming. Here's why.
| Metric | Value |
|---|---|
| TIOBE ranking (March 2026) | #20 (up from #38 in one month) |
| Stack Overflow usage (2025) | 9.2% of all respondents |
| Admired by current users | 45.3% |
| Roblox monthly active users | 381.8 million |
| Roblox developers using Luau | 3.5 million |
| LuaJIT vs C performance gap | ~4.5% |
| LuaJIT vs Python speed | ~18x faster |
| Entire source code | 32,000 lines of C, 388K compressed |
| US Lua developer salary | $82K-$141K/year |
| Latest version | 5.5.0 (December 2025) |
| License | MIT (completely free) |
| Year created | 1993 in Rio de Janeiro |
A few of those numbers deserve context. The 18-spot TIOBE jump in a single month is almost unheard of for a 33-year-old language. The TIOBE CEO noted that Lua briefly touched the top 10 in 2011, and it's unclear whether it'll get there again. I think it will. And the reason is that Lua occupies a niche that no other language can touch.
Lua isn't trying to replace Python. It isn't trying to be a general-purpose language. It's an embeddable scripting language -- designed to live inside other programs and give them programmable behavior.
Think of it this way. Python is a house. You build things in it. Lua is electricity. It powers things that are already built.
The entire language fits in 32,000 lines of C code. The compiled interpreter is 293K on 64-bit Linux. The compressed tarball is 388K. For comparison, Python's source code is over 2 million lines. Node.js ships tens of megabytes.
Lua achieves this minimalism through a radical design philosophy: provide meta-mechanisms instead of features. There's one data structure -- the table. It serves as an array, dictionary, object, module, and namespace. There are no classes, but Lua's metatables let you build any object system you want. There's no built-in module system, but tables + metatables make it trivial to create one.
This isn't a limitation. It's the point.
Most developers interact with Lua daily without knowing it. Here's where it's running:
Roblox is the biggest Lua story. The platform uses Luau, a custom Lua dialect, and has 381.8 million monthly active users and 3.5 million developers. In 2025, community developers earned over $1.5 billion on the platform. Roblox's 2026 revenue guidance is $6.0-6.2 billion. All game logic, all scripting, all user-created content -- Lua.
World of Warcraft uses Lua for its entire UI and modding system. Every addon -- from damage meters to auction house tools to raid assistants -- is written in Lua. The WoW modding community has been writing Lua since 2004. That's two decades of accumulated knowledge and tooling.
Angry Birds used Lua for level scripting and game logic. Hades 2 and The Binding of Isaac: Rebirth expose Lua modding APIs. Lua is the industry standard for game scripting because it's fast enough to run in a game loop and small enough to embed in a game engine without bloating the binary.
This is where Lua gets interesting for people who don't make games.
Cloudflare is the largest user of OpenResty globally -- an NGINX distribution that embeds LuaJIT into the web server core. Cloudflare handles roughly 20% of global web traffic. Their WAF (Web Application Firewall) compiles rules to Lua and executes them at the edge. When you visit a website protected by Cloudflare, Lua code is deciding whether to let you through.
Kong, the most popular open-source API gateway, is built on OpenResty with all plugins written in Lua. Their benchmarks show LuaJIT operating at "very close to native speeds" with the ability to schedule 100,000+ timers efficiently.
Let me restate that. A significant percentage of all internet traffic is being processed by Lua. Not Python. Not Go. Not Rust. Lua.
Neovim adopted Lua as its primary configuration and plugin language, replacing Vimscript. With 3.5 million+ developers using Neovim, Lua has become the de facto language for editor customization in the Vim ecosystem. The built-in plugin manager was recently merged, further cementing Lua's role.
Redis supports Lua scripting for atomic operations. HAProxy uses Lua for custom load-balancing logic. MediaWiki (Wikipedia's engine) uses Lua for template processing. Adobe Photoshop Lightroom uses Lua for plugins.
Lua runs on PIC microcontrollers, AVR chips, LEGO Mindstorms bricks, and old Garmin GPS units. NodeMCU, the popular open-source firmware for ESP8266 Wi-Fi chips, uses Lua as its scripting language. When your entire runtime needs to fit in kilobytes, Python isn't an option. Lua's 278K footprint makes it the default choice.
This is where Lua breaks people's expectations. Let me lay out the benchmark data.
| Language | Benchmark Time | Relative to C |
|---|---|---|
| C | 22.29s | 1.0x |
| LuaJIT | 23.29s | 1.04x |
| PyPy | 26.33s | 1.18x |
| Java | 54.30s | 2.44x |
| Node.js | 92.94s | 4.17x |
| Python (CPython) | 416.55s | 18.7x |
Read that again. LuaJIT -- a dynamically typed, garbage-collected scripting language -- runs within 4.5% of C. It's faster than Java. It's 4x faster than Node.js. It's 18x faster than Python.
The person behind this is Mike Pall, who wrote LuaJIT's tracing JIT compiler. A Hacker News commenter once described him as "a robot from the future". The JIT compiler analyzes hot code paths at runtime and generates optimized machine code on the fly.
Even without JIT compilation, standard Lua is fast for an interpreted language:
| Implementation | Benchmark Time |
|---|---|
| Lua 5.4.2 (standard) | 3.69s |
| LuaJIT 2.1 | 0.81s |
That's a 4.5x speedup from JIT compilation alone. Standard Lua uses a register-based virtual machine (as opposed to Python's stack-based VM), which contributes to its baseline performance advantage.
There's a valid concern here. Mike Pall stepped back from active feature development around 2015-2020. As of late 2025, LuaJIT remains under active maintenance with bug fixes and platform refinements, but there are no plans for full Lua 5.3+ support in the mainline branch.
This matters because Lua 5.5 (released December 2025) brings 60% memory savings for large arrays and incremental major GC, but LuaJIT users won't see these improvements. You're choosing between cutting-edge language features (Lua 5.5) and cutting-edge performance (LuaJIT 2.1 on Lua 5.1 semantics).
For most use cases, this tradeoff is irrelevant. Roblox uses Luau (their own fork). OpenResty and Kong use LuaJIT 2.1. Neovim supports both. The ecosystem has pragmatically split and it works.
Lua 5.5.0 dropped on December 22, 2025. The headline features:
Declarations for global variables. This is bigger than it sounds. Lua's biggest footgun has always been that misspelling a variable name silently creates a new global. Now you can declare globals explicitly, catching typos at compile time.
60% less memory for large arrays. Lua 5.5 introduces more compact array representations that slash memory usage for array-heavy workloads. If you're processing large datasets or running on memory-constrained devices, this is huge.
Incremental major GC. The generational garbage collector now does major collections incrementally instead of stop-the-world. This means fewer latency spikes -- critical for real-time applications like games and network processing.
table.create, named vararg tables, read-only for-loop variables. Quality-of-life improvements that reduce boilerplate and prevent common mistakes.
The release is fully backward compatible. Existing Lua 5.4 code runs without modification. The Lua team has maintained this backward compatibility discipline for decades -- a major reason why embedded Lua deployments stay stable across years.
Let's be honest. Lua is not going to land you a job at your average web startup.
| Role | Salary Range |
|---|---|
| Lua Programmer (US avg) | $53,500-$131,000 |
| Lua Developer (US avg) | $115,000-$141,500 |
| Roblox Sr. Software Engineer | $197,000-$243,000 |
| Lua hourly rate | $55-$68/hour |
The job market for Lua is small but premium. There aren't thousands of Lua job postings. But the ones that exist pay well, because the talent pool is tiny. A Roblox senior engineer making $243K is earning more than most React developers.
The demand comes from four sectors (and if you're weighing roles, see my breakdown of AI engineer vs ML engineer):
If you're in one of these sectors, Lua isn't optional. It's the language. If you're not in these sectors, Lua is a competitive advantage precisely because so few people know it.
There's a popular Hacker News thread titled "I wish Lua had won against Python". The argument: Lua integrates better as an embedded language, has cleaner semantics, and is orders of magnitude more portable.
But Lua didn't lose to Python. They play different games.
Python won the "general-purpose scripting" war. It has the libraries, the community, the ecosystem. Nobody disputes this.
Lua won the "embedding" war. And it won so completely that there's basically no competition. No other language has seriously challenged Lua's niche as the best embeddable scripting language.
Here's why:
Lua's C API is its secret weapon. Embedding Lua into a C or C++ application takes about 20 lines of code:
-- This runs inside your C application
function on_request(method, path)
if path == "/health" then
return 200, "OK"
end
return process_route(method, path)
end
The host application calls Lua functions. Lua calls host functions. Values pass back and forth through a clean stack-based API. No FFI complexity. No binding generators. No GIL issues.
Try embedding Python into a C application. You'll need to manage reference counting, deal with the Global Interpreter Lock, handle module initialization, and pray that your build system finds the right Python shared library. It works, but it's an order of magnitude more complex.
Everything in Lua is a table. Arrays are tables with integer keys. Dictionaries are tables with string keys. Objects are tables with metatables. Modules are tables. The global namespace is a table.
-- An array
local fruits = {"apple", "banana", "cherry"}
-- A dictionary
local config = {host = "localhost", port = 8080}
-- An "object" with methods
local Player = {}
Player.__index = Player
function Player.new(name, score)
return setmetatable({name = name, score = score}, Player)
end
function Player:greet()
return "I'm " .. self.name .. " with score " .. self.score
end
This sounds limiting. It's actually liberating. You never have to choose between a list and a tuple and a set and a frozenset. There's one thing. It does everything. The mental overhead is near zero.
278K for the interpreter plus all standard libraries. That's not a typo. Two hundred seventy-eight kilobytes. You can embed Lua into a firmware image, a game engine, a web server, or a microcontroller without thinking about footprint.
Most "Lua in 2025" articles make three mistakes.
Mistake 1: "Lua is just for games." Gaming is the most visible use case, but Cloudflare running Lua on 20% of global web traffic is arguably more significant. Kong processing API calls through Lua plugins at Fortune 500 companies is arguably more significant. The infrastructure story is bigger than the gaming story. (I wrote about why data engineering roles keep evolving in a separate piece.)
Mistake 2: "Lua is dying because LuaJIT isn't actively developed." LuaJIT is maintained. It receives bug fixes. It's stable enough that Cloudflare routes billions of requests through it daily. "Active maintenance" and "active feature development" are different things. LuaJIT doesn't need new features. It needs to keep working. And it does.
Mistake 3: "You can't build a career on Lua." You can't build a generic career on Lua. But a Roblox engineer making $243K isn't struggling. An infrastructure engineer writing Kong plugins isn't struggling. The jobs are fewer, the competition is less, and the pay is often higher. That's a career.
Learn Lua if:
Don't learn Lua if:
Timeline to productivity:
| Milestone | Time |
|---|---|
| Basic syntax and tables | 1-2 hours |
| Comfortable with metatables | 1-2 days |
| Writing production scripts | 1 week |
| Understanding the C API | 2-3 weeks |
| Contributing to OpenResty/Kong/Neovim plugins | 1-2 months |
Lua is genuinely learnable in hours. The entire language specification fits in a single webpage. There are 8 basic types, 21 keywords, and one data structure. If you know any programming language, you can read Lua code immediately.
Lua is the most elegant language in mainstream use. Not the most popular. Not the most employable. The most elegant.
It solves the embedding problem so completely that nobody has bothered to compete. In 33 years, no language has emerged that does what Lua does better than Lua does it. Tcl tried and faded. JavaScript got embedded into some things (via V8) but it's enormous and complex. Python can be embedded but it's painful. Lua just... works. In 278K.
The 9.2% usage rate on Stack Overflow doesn't capture reality. Lua's impact is measured not by how many developers write it, but by how many users are served by systems running it. Every Roblox player. Every website behind Cloudflare. Every WoW player with addons. Every Neovim user. That's hundreds of millions of people interacting with Lua-powered systems daily.
The TIOBE jump to #20 is the beginning, not a blip. Roblox is growing (from 85 million DAU in Q4 2024 to 144 million in Q4 2025). Edge computing is growing. IoT is growing. Every one of these trends benefits Lua because every one of them needs a fast, tiny, embeddable scripting language.
Python taught the world that scripting languages matter. Lua proves that sometimes, the best language is the smallest one.
And with Lua 5.5's 60% memory reduction and incremental GC, the language is getting better at exactly the thing it was already best at: doing more with less.
I don't think everyone should learn Lua. I think everyone who builds systems should. Not because it'll get you hired (though it might, and well). Because understanding Lua -- its philosophy of minimalism, its single data structure, its seamless C integration -- will make you a better programmer in whatever language you use. Whether you end up building AI systems or deploying ML pipelines, the fundamentals transfer.
There's a Hacker News comment that sums it up: "Lua is lurking in places you'd never expect." After researching this article, I think the surprise isn't where Lua is hiding. It's how much of the internet runs on a 278K interpreter designed by a research team in Rio de Janeiro.