Skip to main content
SourceTrust
See other licenses

WTFPL

WTFPL

An unlimited permission grant with a joke name. Legally broad, but many procurement policies reject it on sight.

On this page

What it does

The WTFPL is a single-term license: its one numbered term says you may do whatever you want with the work. Legally it functions as a very broad grant, and the Free Software Foundation counts it as a free, GPL-compatible license. The OSI has never approved it, and the name is the reason most often given. You find it across a long tail of small npm and PyPI packages, spark-md5 among them, which is also how it usually reaches a product: through a transitive dependency nobody chose.

Details

The legal duty here is nothing, and the practical problem is everything else. A buyer's approval list often names OSI-approved licenses only, and a reviewer who reads the full name of this license in a procurement pack stops and asks. That conversation costs more time than the dependency is worth. The other risk sits inside the repository. A WTFPL notice next to an ordinary copyright header is a sign that the author did not think it through, so ask before you rely on it.

Pros

  • Nothing to attach besides recording that the component is in the inventory.
  • No copyleft and no notice condition, so binaries do not need an extra licenses file for this component alone.

Cons

  • Some buyers still want the dedication text on file. "No conditions" is not the same as "no record."
  • Jurisdiction and moral-rights questions still exist around true public-domain dedications. Counsel should look at high-stakes use.

What it allows and requires

Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.

Permissions

  • Commercial use

    You may use the work commercially. These texts are written to drop almost every restriction.

  • Modify

    You may change the work and keep or publish those changes under your own terms.

  • Distribute

    You may give copies away, including inside a closed product, without a copyleft duty.

What WTFPL requires when you ship

WTFPL asks nothing of you: no notice, no attribution, no source duty. It still belongs on the attestation page so a buyer sees the whole inventory rather than only the interesting rows. The steps below are how to keep that record honest.

  1. You meet the terms by using the package. The WTFPL states no condition, so nothing has to be shipped or displayed.

  2. You keep a reviewer calm when you store the license text on the component, so the grant is visible rather than implied.

  3. You avoid a late surprise when you check your customers' approval lists early, because many of them take OSI-approved licenses only.

  4. You settle an ambiguous repository when you ask upstream in writing, in the case where an ordinary copyright header sits next to the WTFPL notice.

  5. You keep your options open when you look for a replacement under MIT or ISC before the dependency sits deep in your build.

The duties named in WTFPL

WTFPL names no duties. The empty list is the point. Keep the identifier on the record anyway so the inventory is complete.

Include notice

The text asks for almost nothing. Record the SPDX id anyway so buyers can see which grant you relied on.

Things to be aware of

  • Teams ship it into an enterprise product without checking the buyer's approval list. Check the list first: replacing a small utility is cheap, renegotiating is not.
  • Teams read the informal wording as meaning the author kept no rights. The license is a grant of permission, so the copyright still belongs to somebody.
  • Teams hide it by leaving it off the published list. That is the one move that turns a small policy question into a trust problem.

What the WTFPL does not do

Search results often flatten WTFPL into a slogan. These are the usual misreads. WTFPL is a grant with conditions, not a permission to skip the paperwork below.

  • the WTFPL does not create a notice or attribution duty. Teams still list it so buyers see the whole inventory.
  • It is not a warranty or a patent grant. Public-domain style texts waive conditions; they do not promise the code is free of defects.

How WTFPL differs from nearby licenses

These licenses are often confused with WTFPL, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.

WTFPL
An unlimited permission grant with a joke name. Legally broad, but many procurement policies reject it on sight.
Unlicense
A public domain dedication written for software, with a fallback license. OSI-approved, and it asks nothing of you.
0BSD
BSD with every condition removed: no notice, no credit. It is a permission grant, not a waiver, and that is why counsel like it.
ISC
The default license of a large slice of npm. Short and permissive: it asks only that the copyright and permission notice stay in the copies.

Common questions about WTFPL

Answers to common questions about what WTFPL requires, when its duties apply, and what evidence belongs with a release.

What is the WTFPL?

The WTFPL is a single-term license: its one numbered term says you may do whatever you want with the work. Legally it functions as a very broad grant, and the Free Software Foundation counts it as a free, GPL-compatible license. The OSI has never approved it, and the name is the reason most often given. You find it across a long tail of small npm and PyPI packages, spark-md5 among them, which is also how it usually reaches a product: through a transitive dependency nobody chose.

What does WTFPL require when you ship a product?

You meet the terms by using the package. The WTFPL states no condition, so nothing has to be shipped or displayed. You keep a reviewer calm when you store the license text on the component, so the grant is visible rather than implied. You avoid a late surprise when you check your customers' approval lists early, because many of them take OSI-approved licenses only. You settle an ambiguous repository when you ask upstream in writing, in the case where an ordinary copyright header sits next to the WTFPL notice. You keep your options open when you look for a replacement under MIT or ISC before the dependency sits deep in your build.

Should WTFPL still appear on an attestation page?

Yes. WTFPL asks nothing, and buyers still want the whole inventory rather than only the interesting rows.

How is WTFPL different from The Unlicense?

WTFPL asks this: An unlimited permission grant with a joke name. Legally broad, but many procurement policies reject it on sight. The Unlicense asks this: A public domain dedication written for software, with a fallback license. OSI-approved, and it asks nothing of you. Open the The Unlicense page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.

Where do I record WTFPL for a buyer?

SourceTrust fetches the published artifact, extracts the license file and compares it with the reference text. The WTFPL is short and usually unedited, so it often lands as confirmed and the text is stored on the component. No checklist item appears, because none of the six external obligations matches this license. What the product will not do is tell you whether your customer's policy accepts it, and that is the question which actually decides this one.

Where do I record WTFPL for a buyer?

SourceTrust fetches the published artifact, extracts the license file and compares it with the reference text. The WTFPL is short and usually unedited, so it often lands as confirmed and the text is stored on the component.

No checklist item appears, because none of the six external obligations matches this license. What the product will not do is tell you whether your customer's policy accepts it, and that is the question which actually decides this one.

Read /docs/reviewing-component for the review flow.

See also

The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.

Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.

Ship the proof.

Import WTFPL and the rest of what you ship. Free to import and review. You only pay when you publish.

Start for free

Cookies on sourcetrust.dev

We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.