Permissive, and built into games, firmware and mobile apps. Three conditions: do not claim you wrote it, mark altered versions, keep the notice in source.
On this page
What it does
The zlib License is a short permissive grant with three conditions worth knowing. Do not misrepresent the origin of the software, so you may not claim you wrote the original. Mark altered source versions plainly as altered, so nobody mistakes your patched copy for upstream. Keep the notice in source distributions. The license does not require a notice inside compiled object code, though most vendors include one anyway. zlib itself and many game engines use it, and libpng carries a closely related license of its own.
Details
This is one of the few permissive licenses where modifying the code adds a condition. Vendoring a patched zlib into a firmware image or a game build is common, and marking it as altered is the step teams miss. There is also an identifier trap. The zlib-acknowledgement variant asks for an acknowledgment in your product documentation, and it is a separate SPDX id with a separate catalog row. Check which one the package declares before you decide there is nothing to do.
Pros
- Easy to drop into a closed, paid product. Procurement has seen this family hundreds of times.
- No copyleft on your own files. You keep your source private.
Cons
- The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
- Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Sublicense
You may include the code under your own product terms, so long as you still meet this license's conditions.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Patent grant
The text does not grant patents. If buyers want an express patent grant, Apache-2.0 is the usual alternative.
Obligations
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
State changes
Mark changed files so they are not misrepresented as the original.
What Zlib requires when you ship
When a copy that includes Zlib code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.
You are meeting the terms for an unmodified copy when the notice stays with the source you distribute. Nothing in your product may claim the code as your own work.
You are meeting the altered-version condition when your patched copy says plainly that it was changed, in the source and in the version string.
You are done for a hosted service once the component is recorded. zlib has no network trigger and never asks you to publish your own source.
You are meeting the terms for a shipped binary once the notice is in your licenses file. The license does not even demand it in object code.
You have read the identifier correctly when you know whether the package declares Zlib or zlib-acknowledgement, the variant that also wants a mention in your documentation.
The duties named in Zlib
The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
State changes
Mark changed files so they are not misrepresented as the original.
Things to be aware of
- Shipping a patched zlib without marking it as altered. It is one of only two things this license actually asks of you beyond keeping the notice.
- Assuming the acknowledgement variant and the base license are the same thing. They are separate SPDX ids with different duties in your documentation.
- Deciding a compression library is too small to list. Buyers read the whole inventory, and zlib is inside almost every binary you have ever shipped.
What the zlib License does not do
Search results often flatten zlib License into a slogan. These are the usual misreads. Zlib is a grant with conditions, not a permission to skip the paperwork below.
- the zlib License does not require you to publish your own source. Combining it with closed code is the point of the grant.
- the zlib License does not mean "no obligations." The copyright line and license text still have to travel with copies you hand to other people.
- It is not a patent license unless the text says so. MIT-family grants say nothing about patents.
How Zlib differs from nearby licenses
These licenses are often confused with Zlib, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- Zlib
- Permissive, and built into games, firmware and mobile apps. Three conditions: do not claim you wrote it, mark altered versions, keep the notice in source.
- MIT
- MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
- BSL-1.0
- The Boost license, not the Business Source License. Permissive, and it expressly does not ask for a notice inside compiled binaries.
- MPL-2.0
- File-scoped copyleft. The MPL files stay open when you ship a binary, modified or not. Your own separate files stay yours.
Common questions about zlib License
Answers to common questions about what zlib License requires, when its duties apply, and what evidence belongs with a release.
What is the zlib License?
The zlib License is a short permissive grant with three conditions worth knowing. Do not misrepresent the origin of the software, so you may not claim you wrote the original. Mark altered source versions plainly as altered, so nobody mistakes your patched copy for upstream. Keep the notice in source distributions. The license does not require a notice inside compiled object code, though most vendors include one anyway. zlib itself and many game engines use it, and libpng carries a closely related license of its own.
What does Zlib require when you ship a product?
You are meeting the terms for an unmodified copy when the notice stays with the source you distribute. Nothing in your product may claim the code as your own work. You are meeting the altered-version condition when your patched copy says plainly that it was changed, in the source and in the version string. You are done for a hosted service once the component is recorded. zlib has no network trigger and never asks you to publish your own source. You are meeting the terms for a shipped binary once the notice is in your licenses file. The license does not even demand it in object code. You have read the identifier correctly when you know whether the package declares Zlib or zlib-acknowledgement, the variant that also wants a mention in your documentation.
Does Zlib require me to open my own source?
It is not a patent license unless the text says so. MIT-family grants say nothing about patents.
How do I attribute Zlib in a product I ship?
Attribution for Zlib means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.
Is a website notice enough for Zlib?
No. Zlib talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.
Do transitive Zlib dependencies count?
Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in Zlib transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.
How is Zlib different from MIT License?
Zlib asks this: Permissive, and built into games, firmware and mobile apps. Three conditions: do not claim you wrote it, mark altered versions, keep the notice in source. MIT License asks this: MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy. Open the MIT License page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record Zlib for a buyer?
A patched copy is the interesting case here. When the extracted text differs from the reference for the declared id, SourceTrust lands the result as modified or mismatch instead of filling it in. The component then waits for a person to accept the text. That is the moment to check whether this is an altered version and whether it is marked as one. zlib is a notice license in the catalog, so text is needed before the component counts as live on your page.
Where do I record Zlib for a buyer?
A patched copy is the interesting case here. When the extracted text differs from the reference for the declared id, SourceTrust lands the result as modified or mismatch instead of filling it in.
The component then waits for a person to accept the text. That is the moment to check whether this is an altered version and whether it is marked as one. zlib is a notice license in the catalog, so text is needed before the component counts as live on your page.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.