Skip to main content
SourceTrust
See other licenses

ISC

ISC License

The default license of a large slice of npm. Short and permissive: it asks only that the copyright and permission notice stay in the copies.

On this page

What it does

ISC is BSD 2-Clause with the language the drafters considered redundant taken out. The grant is one sentence: anyone may use, copy, modify and distribute the software for any purpose, with or without fee. The single condition is that the copyright notice and the permission notice appear in all copies. It sits on semver, rimraf, glob and much of OpenBSD, which is why it turns up in almost every Node lockfile. The FSF lists it as a free, GPL-compatible license, and in practice it works like MIT.

Details

ISC almost never creates work on its own. It creates work in bulk. A mid-sized Node project can carry several hundred ISC packages, each with its own copyright line and its own author. The condition is per copy, so an export that collects every notice is the only practical answer, and a hand-maintained list is not. For a hosted service there is nothing to do beyond recording the components. For anything you hand to a customer, all of those notices have to come along.

Pros

  • Easy to drop into a closed, paid product. Procurement has seen this family hundreds of times.
  • No copyleft on your own files. You keep your source private.

Cons

  • The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
  • Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.

What it allows and requires

Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.

Permissions

  • Commercial use

    You may ship the code inside a paid product. The license does not restrict commercial use.

  • Modify

    You may change the code, including keeping those changes private, unless a later obligation says otherwise.

  • Distribute

    You may give copies to others. Distribution is what usually turns notice and source duties into real work.

  • Sublicense

    You may include the code under your own product terms, so long as you still meet this license's conditions.

  • Private use

    Use inside your company, including internal forks, does not by itself trigger distribution duties.

What ISC requires when you ship

When a copy that includes ISC code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.

  1. You are meeting the terms when every ISC component you distribute carries its copyright notice and its permission notice in the copy the recipient gets.

  2. You are done for a hosted service once the component is recorded with its text. ISC has no network trigger, no source duty and no linking rules.

  3. You are meeting the terms for a binary or an SDK when the notices are collected into a licenses file that ships alongside the artifact.

  4. You keep the same duties after you modify the code, and you may keep your modifications closed. Nothing here asks for your source.

The duties named in ISC

The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.

Include copyright

Keep the copyright line with every copy or substantial portion you distribute.

Include license

Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.

All copies

ISC asks that the copyright notice and the permission notice appear in all copies. It does not use MIT's substantial-portion phrasing.

Things to be aware of

  • Letting a bulk export drop per-package notices. The condition is per copy, so each package's own copyright line belongs in the file you ship.
  • Treating an ISC package as unlicensed because the license file is four lines long. It is a real license with a real notice condition.
  • Copying only direct dependencies into the notices file. Most ISC packages arrive as transitive dependencies of something else you installed.

What the ISC License does not do

Search results often flatten ISC License into a slogan. These are the usual misreads. ISC is a grant with conditions, not a permission to skip the paperwork below.

  • The ISC License does not require you to publish your own source. Combining it with closed code is the point of the grant.
  • It does not use MIT's substantial-portion phrasing. The condition is the copyright notice and the permission notice in all copies.
  • It does not grant patents, and it has no BSD-style clause about documentation that accompanies a binary.

How ISC differs from nearby licenses

These licenses are often confused with ISC, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.

ISC
The default license of a large slice of npm. Short and permissive: it asks only that the copyright and permission notice stay in the copies.
MIT
MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
BSD-2-Clause
MIT in BSD wording. Use it in a closed product, and keep the copyright line, the conditions and the disclaimer with every copy you distribute.
MPL-2.0
File-scoped copyleft. The MPL files stay open when you ship a binary, modified or not. Your own separate files stay yours.

Common questions about ISC License

Answers to common questions about what ISC License requires, when its duties apply, and what evidence belongs with a release.

What is the ISC License?

ISC is BSD 2-Clause with the language the drafters considered redundant taken out. The grant is one sentence: anyone may use, copy, modify and distribute the software for any purpose, with or without fee. The single condition is that the copyright notice and the permission notice appear in all copies. It sits on semver, rimraf, glob and much of OpenBSD, which is why it turns up in almost every Node lockfile. The FSF lists it as a free, GPL-compatible license, and in practice it works like MIT.

What does ISC require when you ship a product?

You are meeting the terms when every ISC component you distribute carries its copyright notice and its permission notice in the copy the recipient gets. You are done for a hosted service once the component is recorded with its text. ISC has no network trigger, no source duty and no linking rules. You are meeting the terms for a binary or an SDK when the notices are collected into a licenses file that ships alongside the artifact. You keep the same duties after you modify the code, and you may keep your modifications closed. Nothing here asks for your source.

Does ISC require me to open my own source?

It does not grant patents, and it has no BSD-style clause about documentation that accompanies a binary.

How do I attribute ISC in a product I ship?

Attribution for ISC means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.

Is a website notice enough for ISC?

No. ISC talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.

Do transitive ISC dependencies count?

Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in ISC transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.

How is ISC different from MIT License?

ISC asks this: The default license of a large slice of npm. Short and permissive: it asks only that the copyright and permission notice stay in the copies. MIT License asks this: MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy. Open the MIT License page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.

Where do I record ISC for a buyer?

SourceTrust resolves every ISC component in your lockfile the same way, so the volume stops being the problem. It fetches the published artifact, extracts the license file, and fills in the text when it matches the declared id. Short license files are the ones most often stored with a different copyright holder. A mismatch here usually means a real difference in the notice rather than a formatting one. ISC is a notice license in the catalog, so text is needed before a component counts as live.

Where do I record ISC for a buyer?

SourceTrust resolves every ISC component in your lockfile the same way, so the volume stops being the problem. It fetches the published artifact, extracts the license file, and fills in the text when it matches the declared id.

Short license files are the ones most often stored with a different copyright holder. A mismatch here usually means a real difference in the notice rather than a formatting one.

ISC is a notice license in the catalog, so text is needed before a component counts as live. Read /docs/auto-fetch-license.

See also

The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.

Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.

Ship the proof.

Import ISC License and the rest of what you ship. Free to import and review. You only pay when you publish.

Start for free

Cookies on sourcetrust.dev

We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.