TypeScript Access Modifiers: public, private, protected

TypeScript has three access modifiers for class members: public (the default), protected and private. They control where a member can be used, and the compiler reports any access from the wrong place.

class Employee {
    public name: string;          // anywhere (public is the default)
    protected salary: number;     // this class and subclasses
    private ssn: string;          // this class only

    constructor(name: string, salary: number, ssn: string) {
        this.name = name;
        this.salary = salary;
        this.ssn = ssn;
    }

    maskedSsn(): string {
        return "***-**-" + this.ssn.slice(-4); // fine: inside the class
    }
}

const e = new Employee("Ada", 5000, "123-45-6789");
console.log(e.name, e.maskedSsn()); // Ada ***-**-6789

// @ts-expect-error: Property 'ssn' is private and only accessible within class 'Employee'.
console.log(e.ssn);

The last line is a compile error, but look at what it printed when run anyway: 123-45-6789. That is the most important fact on this page, and the private section explains it.

What Each Modifier Allows

The modifiers work on fields, methods, getters and setters, constructors and parameter properties (constructor(private id: string)). Writing public is optional, and many codebases leave it out.

private Is a Compile-Time Check

TypeScript erases private along with the rest of the types. The compiled class has an ordinary property, so anything that does not go through the type checker sees it: plain JavaScript callers, JSON.stringify, Object.keys, and even TypeScript's own bracket notation, which is allowed as a deliberate escape hatch.

class Session {
    private token = "abc123";
    userId = 7;
}

const s = new Session();
console.log(s["token"]);           // abc123: bracket access skips the check
console.log(Object.keys(s));       // [ 'token', 'userId' ]
console.log(JSON.stringify(s));    // {"token":"abc123","userId":7}

That is fine for what private is for: telling other developers (and your editor) that a member is an implementation detail. It is not a security boundary, and a private field will end up in logs and JSON responses unless you strip it yourself.

#private Fields: Enforced at Runtime

JavaScript has its own private fields, written with #. The engine enforces them: outside the class, obj.#field is not even valid syntax, and the field does not show up in Object.keys, JSON.stringify or console.log.

class Session {
    #token = "abc123";
    userId = 7;

    constructor(token: string) {
        this.#token = token;
    }

    matches(t: string): boolean {
        return this.#token === t;
    }

    static isSession(x: object): boolean {
        return #token in x; // brand check: was x made by this class?
    }
}

const s = new Session("xyz");
console.log(s.matches("xyz"));     // true
console.log(Object.keys(s));       // [ 'userId' ]
console.log(JSON.stringify(s));    // {"userId":7}
console.log(s);                    // Session { userId: 7 }
console.log(Session.isSession(s), Session.isSession({ userId: 7 })); // true false

Writing s.#token outside the class is error TS18013 (Property '#token' is not accessible outside class 'Session' because it has a private identifier), and unlike the private case, there is no way around it at runtime either. See private fields in JavaScript for the runtime rules.

private vs #private: Which to Use

Use #private when the data must stay private at runtime (tokens, internal state a library's users must not touch) or when you want JSON.stringify to leave it out. Use private when the goal is only a clean public API, when a framework needs to read the field reflectively, or to match a codebase's existing style. Do not combine them: private #x is error TS18010 (An accessibility modifier cannot be used with a private identifier).

protected and Subclasses

A protected member is available inside the class and in any class that extends it, but not on instances from outside.

class Shape {
    protected sides: number;

    constructor(sides: number) {
        this.sides = sides;
    }
}

class Polygon extends Shape {
    describe(): string {
        return `${this.sides} sides`; // fine: subclass
    }
}

const hex = new Polygon(6);
console.log(hex.describe()); // 6 sides

// @ts-expect-error: Property 'sides' is protected and only accessible within class 'Shape' and its subclasses.
console.log(hex.sides); // 6: like private, protected is not enforced at runtime

One rule surprises people. Inside Polygon, you can read sides on this or on another Polygon, but not on a plain Shape passed in as a parameter: other.sides where other: Shape is error TS2446 (Property 'sides' is protected and only accessible through an instance of class 'Polygon'. This is an instance of class 'Shape'.). A subclass may only reach protected members of objects that belong to its own branch of the hierarchy.

A subclass can make a protected member public by redeclaring it, but it cannot make a public member protected or private. Redeclare it with an initializer (public override sides = 6) or as a type only (declare public sides: number). A bare public sides: number; is rejected with TS2564 and TS2612, because under modern class fields it would reset the inherited value to undefined after super() returns.

readonly

readonly blocks reassignment after construction. The field can be set in its declaration or in the constructor; any later assignment is error TS2540.

class Order {
    readonly id: string;
    readonly items: string[] = [];

    constructor(id: string) {
        this.id = id; // allowed: inside the constructor
    }
}

const order = new Order("A-17");
order.items.push("book"); // allowed: readonly is shallow
console.log(order);       // Order { id: 'A-17', items: [ 'book' ] }

// @ts-expect-error: Cannot assign to 'id' because it is a read-only property.
order.id = "B-1";
console.log(order.id);    // B-1: nothing stops it at runtime

Two limits show up here. readonly is shallow: the array cannot be replaced, but its contents can change (type it readonly string[] to block push). And like private, it disappears at runtime, so the assignment the compiler rejected still ran. For a value that must not change at runtime, use Object.freeze or a getter with no setter. The readonly page covers Readonly<T> and readonly arrays.

readonly combines with the access modifiers: private readonly cache = new Map<string, number>() is a common pattern for a field that is internal and never reassigned.

Common Mistakes

• Treating private as security. It is gone at runtime. Use #field for data that must stay hidden, and never send an object with secrets straight to JSON.stringify.
• Writing public everywhere. It is the default; adding it changes nothing.
• Using protected for everything "internal". If no subclass needs it, private keeps the surface smaller.
• Expecting readonly to freeze nested data. It only stops reassignment of the property itself.