MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
On this page
What it does
The MIT License is a permission grant of about 170 words, and it is the most common license in the npm, PyPI and RubyGems ecosystems. You may use the code commercially, change it, keep your changes closed, and sublicense it inside your own product. You have one condition to meet: include the copyright notice and the full license text in every copy or substantial portion you distribute. There is no copyleft here, meaning no requirement that your own code be released under the same license. React, jQuery, Rails and Express all ship under it.
Details
What you are looking at is the shipping work, not a slogan. MIT is short enough that teams read it as a free pass. That is how notices disappear from a release. The grant lets you keep your product closed. It still names two duties that travel with every copy: keep the copyright line, and keep the license text. Both apply to files you vendor into your own repo and to transitive packages in the lockfile, not only to the libraries you chose by name. For a hosted service that never hands out a copy, MIT costs you a record. The moment you hand someone a copy, the notice condition becomes real work. That copy can be a desktop installer, a mobile app binary, a container image you publish, or an SDK another developer embeds. Distribution here means giving a copy to someone outside your own company, and that is the trigger. A README on GitHub is not the copy a customer receives. Put the notices in the installer, the about screen, the container image, or a licenses file inside the artifact. Then keep a public list of those same texts so a buyer can audit the inventory without unpacking the binary.
Pros
- Easy to drop into a closed, paid product. Procurement has seen this family hundreds of times.
- No copyleft on your own files. You keep your source private.
Cons
- The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
- Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Sublicense
You may include the code under your own product terms, so long as you still meet this license's conditions.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Patent grant
The text does not grant patents. If buyers want an express patent grant, Apache-2.0 is the usual alternative.
Obligations
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Substantial portion
MIT names copies or substantial portions. Keep the copyright line and the permission notice with both whole packages and excerpts you vendor.
What MIT requires when you ship
When a copy that includes MIT code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.
You are meeting the notice condition when the copyright line and the permission notice travel with every copy or substantial portion, including a single file you vendor.
You are done for a hosted service that never hands out a copy. Nothing in MIT triggers on running the software for users over a network.
You are covered for a desktop, mobile or on-premise build when the notices sit inside the artifact. An about screen or a bundled licenses file both work.
Your duties do not change when you modify the code or vendor a single file into your own repository. The copyright line stays, and the license text stays with it.
You are still within the terms when MIT code is pulled into a GPL project. The combined work then ships under the GPL, and the MIT notice stays with the MIT files.
The duties named in MIT
The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Substantial portion
MIT names copies or substantial portions. Keep the copyright line and the permission notice with both whole packages and excerpts you vendor.
Things to be aware of
- Reading MIT as no obligations at all and shipping a binary with no notices in it. Put the notices in the artifact you hand over, not only on a web page.
- Deleting the license header when you copy one or two files into your own repository. The condition follows the code, not the package it came in.
- Expecting a patent grant. MIT does not mention patents at all, so choose Apache-2.0 when an express patent grant matters to your buyers.
- Listing only direct dependencies. The notice condition follows every copy you distribute, so transitive MIT packages in your lockfile count too.
What the MIT License does not do
Search results often flatten MIT License into a slogan. These are the usual misreads. MIT is a grant with conditions, not a permission to skip the paperwork below.
- MIT does not mean no obligations. The copyright line and the full license text still have to travel with every copy you distribute.
- It does not mention patents. If an express patent grant matters to your buyers, Apache-2.0 is the usual alternative.
- It does not require you to open your own source. There is no copyleft here.
How MIT differs from nearby licenses
These licenses are often confused with MIT, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- MIT
- MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
- Apache-2.0
- Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
- ISC
- The default license of a large slice of npm. Short and permissive: it asks only that the copyright and permission notice stay in the copies.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
Common questions about MIT License
Answers to common questions about what MIT License requires, when its duties apply, and what evidence belongs with a release.
What is the MIT License?
The MIT License is a permission grant of about 170 words, and it is the most common license in the npm, PyPI and RubyGems ecosystems. You may use the code commercially, change it, keep your changes closed, and sublicense it inside your own product. You have one condition to meet: include the copyright notice and the full license text in every copy or substantial portion you distribute. There is no copyleft here, meaning no requirement that your own code be released under the same license. React, jQuery, Rails and Express all ship under it.
What does MIT require when you ship a product?
You are meeting the notice condition when the copyright line and the permission notice travel with every copy or substantial portion, including a single file you vendor. You are done for a hosted service that never hands out a copy. Nothing in MIT triggers on running the software for users over a network. You are covered for a desktop, mobile or on-premise build when the notices sit inside the artifact. An about screen or a bundled licenses file both work. Your duties do not change when you modify the code or vendor a single file into your own repository. The copyright line stays, and the license text stays with it. You are still within the terms when MIT code is pulled into a GPL project. The combined work then ships under the GPL, and the MIT notice stays with the MIT files.
Does MIT require me to open my own source?
It does not require you to open your own source. There is no copyleft here.
How do I attribute MIT in a product I ship?
Attribution for MIT means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.
Is a website notice enough for MIT?
No. MIT talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.
Do transitive MIT dependencies count?
Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in MIT transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.
How is MIT different from Apache License 2.0?
MIT asks this: MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy. Apache License 2.0 asks this: Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship. Open the Apache License 2.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record MIT for a buyer?
MIT is a notice license in the catalog, so a component under it needs license text attached before it counts as live on your published page. SourceTrust fetches the published artifact for the package, extracts the license file it contains, and compares that text against the declared SPDX id. A match lands as confirmed and fills the text in for you. Every other outcome waits for a person to accept it. The stored text is what your page and each export file carry.
Where do I record MIT for a buyer?
MIT is a notice license in the catalog, so a component under it needs license text attached before it counts as live on your published page. SourceTrust fetches the published artifact for the package, extracts the license file it contains, and compares that text against the declared SPDX id.
A match lands as confirmed and fills the text in for you. Every other outcome waits for a person to accept it.
The stored text is what your page and each export file carry. Read /docs/auto-fetch-license for how the fetch works.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.