Bandit is a production-grade HTTP server library for Elixir, implementing HTTP/1 (RFC 9112), HTTP/2 (RFC 9113), and WebSocket (RFC 6455) protocols. It is built on the Thousand Island connection management library and serves as the default HTTP server for the Phoenix web framework (since version 1.7.11). The library is designed for correctness, security, and performance, achieving 100% conformance in the h2spec (HTTP/2) and Autobahn (WebSocket) test suites, while outperforming alternatives like Cowboy in benchmark comparisons. Architecturally, Bandit uses a protocol-sniffing initial handler that dispatches incoming connections to either an HTTP/1 or HTTP/2 handler based on the client preface. HTTP/2 connections follow a process-per-connection model with a separate stream process for each concurrent request, while HTTP/1 and WebSocket connections operate within a single process. The library exposes a small public API centered on the `Bandit` module, which validates options and delegates to Thousand Island. Internally, it defines clear abstractions such as the `Bandit.HTTPTransport` protocol for shared transport logic, a reusable `Bandit.Extractor` state machine for frame parsing, and telemetry spans for observability. Key features include support for HTTP/1 keepalive, HTTP/2 flow control and HPACK header compression, WebSocket permessage-deflate compression, content-encoding negotiation (gzip, deflate, zstd), Unix socket binding, and comprehensive error handling with clear RFC citations. The library is actively maintained with frequent releases addressing security vulnerabilities and edge cases, and includes extensive CI workflows for conformance testing, benchmarking, and regression prevention.