The line between free and paid Java is not about "Java" at all: it runs by build, by version number, and by license. This guide maps every LTS release so you know precisely which JDK in your estate creates an Oracle audit claim and which one never will.
The line between free and paid Java is not about "Java" at all: it runs by build, by version number, and by license. This guide maps every LTS release so you know precisely which JDK in your estate creates an Oracle audit claim and which one never will.
After 25 years across the table from Oracle, the single most expensive misunderstanding I still see is treating "Java" as one thing that is either free or not. It is not one thing. Whether your use is free depends on three facts, in this order: which build you downloaded (Oracle's or a third party's), which version that build is, and which license shipped with it. Oracle's licensing FAQ and its download pages make this explicit, and the audit teams weaponize the confusion.
The license attached to an Oracle build is one of three: the No-Fee Terms and Conditions (NFTC), the Oracle Technology Network agreement (OTN), or the legacy Binary Code License (BCL) on very old releases. Only the NFTC permits free commercial production use, and it applies only to a narrow set of recent versions. Everything else in the Oracle-branded catalog either requires a subscription outright or requires one the moment you run it in production. This page draws the line version by version. If you want the underlying commercial metric decoded, that lives on our Java employee metric explainer; here we deal only with the free versus paid boundary.
You are not licensing "Java." You are licensing a specific build, at a specific version, under a specific license. Two of those three facts are usually wrong in an enterprise estate.
Below is the map that matters. Every row is an Oracle-branded JDK. The free/paid status is grounded in Oracle's own download pages and license FAQ, plus BellSoft's published tracking (April 2026). Read it carefully, because the difference between two adjacent build numbers can be the difference between $0 and a seven-figure claim.
| Oracle version | Free line | License | Production status |
|---|---|---|---|
| JDK 8 | Free through 8u202 (Jan 2019); 8u211 onward is paid | BCL (old), then OTN | Paid for commercial use from 8u211 |
| JDK 11 | No free production release, ever | OTN | Paid for all production use |
| JDK 17 | Free through 17.0.12 (Jul 2024); later builds paid | NFTC (expired Sep 2024), then OTN | Paid for production from 17.0.13 |
| JDK 21 | Free in production, updates free until Sep 2026 | NFTC, then OTN | Free now, paid after the NFTC window closes |
| JDK 25 | Free in production, updates free until Sep 2028 | NFTC, then OTN | Free now, paid after Sep 2028 |
| Non-LTS (24, 26) | Free for full ~6-month support life | NFTC | Free, no updates after the window |
Notice the pattern. The two current LTS releases (21 and 25) and the short-lived non-LTS releases are free in production today. Everything older, and everything past the NFTC cutoff on a given release, is paid. The trap is that Oracle's download infrastructure serves the paid builds with the same one-click convenience as the free ones. There is no paywall at the point of download. The bill arrives later, during an audit.
Oracle JDK 8 is the version that funds the audit program. The last free public update was 8u202, released January 2019. Every update from 8u211 onward requires a subscription for commercial use. In practice, most enterprise estates auto-patched their way well past 8u202 years ago, because 8u211 and later shipped the security fixes everyone needed. That patching, done for entirely responsible security reasons, is exactly what converts a formerly free deployment into unlicensed use.
When Oracle's audit team pulls telemetry or asks for your JDK inventory, they are looking first for Oracle-branded JDK 8 at any build above 8u202 running in production. It is the highest-yield finding they have: widely deployed, easy to prove from build strings, and almost always undocumented from a licensing standpoint. If you have Oracle JDK 8 above 8u202 anywhere in production, treat it as a live liability, not a theoretical one. The remediation is not to "roll back a patch," which reintroduces security risk; it is to migrate to a free OpenJDK build (covered below) or to buy the subscription with eyes open.
Oracle JDK 8 above 8u202 in production is the single most common seven-figure audit trigger. Responsible patching is precisely what creates the exposure.
JDK 11 is the quietest trap in the catalog because there is no version boundary to remember. There was never a free production build of Oracle JDK 11. Every release shipped under the OTN license, which permits free development, testing, and demonstration but forbids production use without a subscription. The download experience is identical to any free build, so teams pull it, deploy it, and never realize a line was crossed.
A fleet of OTN-licensed Oracle JDK 11 in production is, in my experience and in the published audit-trigger analysis, one of the most frequent bases for a large Java claim. The nuance that catches buyers off guard is the OTN dev/test carve-out: yes, your developers can legally run Oracle JDK 11 on their laptops for free. That carve-out evaporates the instant the same binary sits on a production server. Do not let "it's the same JDK our developers use" become your compliance posture. Inventory production separately from dev/test.
JDK 17 is where the NFTC giveth and then taketh away. When Oracle introduced the NFTC in September 2021, JDK 17 launched free for all use, including production. That free window ran out in September 2024. Build 17.0.12, released July 2024, was the last free update. Every JDK 17 release from 17.0.13 onward is OTN-licensed and requires a subscription for production.
So JDK 17 behaves like JDK 8 in structure: free below a specific build, paid above it. And the same patching dynamic applies. Any estate that stayed current on JDK 17 security updates has almost certainly moved past 17.0.12 and into paid territory without a purchasing decision ever being made. If you standardized on JDK 17 to "stay free," that assumption expired in 2024. Check your actual build numbers, not your intentions.
OpenJDK is the open-source reference implementation of Java SE. It is licensed under the GPL version 2 with the Classpath Exception, a license that explicitly permits free commercial production use, with no fee and no expiry. This is the structural escape from Oracle's version treadmill: with a free OpenJDK build, there is no build-number cliff, no NFTC clock, and no OTN production trap. The license does not change under your feet.
Multiple production-grade OpenJDK distributions are free for commercial use and cover essentially all enterprise workloads. The leading options and their positioning:
For a fuller comparison of these builds on support SLA, migration risk, and cost, see our breakdown of OpenJDK alternatives to Oracle Java. The practical point for this page: migrating from a paid Oracle build to a free OpenJDK build is a like-for-like runtime swap in the vast majority of cases, because Oracle JDK and OpenJDK are functionally near-identical. The cost of migration is testing and change management, not re-architecture.
OpenJDK under GPLv2 with the Classpath Exception has no build cliff and no expiry date. That is the only Java license that stays free while you patch.
When a version lands in paid territory, the only license Oracle sells for it since January 2023 is the Java SE Universal Subscription. It is priced per employee, and "employee" is total headcount, not Java users. Oracle's definition captures all full-time, part-time, and temporary staff, plus contractors and consultants supporting internal operations. The count is determined by headcount, not by how many people touch Java.
List pricing starts at $15 per employee per month and steps down by volume: roughly $12 above 1,000 employees, about $10.50 above 3,000, bottoming near $5.25 around 40,000 to 50,000 employees. Oracle's own worked example in its price list PDF is instructive: a 28,000-employee company (23,000 staff plus 5,000 contractors) at $6.75 per month equals $2,268,000 per year. That is the price of leaving a paid Oracle build in production instead of migrating. For the full tier detail see the Java tier pricing table with worked examples, and for how contractors inflate the count, the contractors and consultants guidance.
The metric is why version choice matters so much. Under the old Processor and Named User Plus metrics, a small Java footprint meant a small bill. Under the Universal Subscription, a single non-compliant Oracle JDK 8 server can justify a subscription priced against your entire workforce. If only a handful of developers use Java, the arithmetic is brutal, as we lay out in the 50-developers, 10,000-employees cost shock.
The NFTC is genuinely free for the versions it covers, but two conditions catch buyers. First, it is never retroactive. It does not cover Java 8, Java 11, or Java 17 past 17.0.12. If your version predates the NFTC, the NFTC does not rescue it. Second, the NFTC does not apply if you previously received that JDK version under a paid Oracle agreement (a Master Agreement or a Java SE subscription). Organizations that once held a Java subscription cannot simply drop it and claim NFTC coverage on the same versions. Model this carefully if you hold, or held, any legacy Java entitlement, and cross-check against your pre-2023 perpetual and NUP licenses before you rely on "free."
The action list is short and non-negotiable, in priority order:
The free/paid line is knowable and precise. The money is lost not because the rules are hidden but because estates drift past build-number cliffs while patching, and because Oracle sells the paid builds with zero friction. Get the inventory right, migrate the flagged versions to free OpenJDK, and you remove the audit trigger entirely rather than paying to keep it.
Only through update 8u202 (January 2019). Every Oracle JDK 8 update from 8u211 onward requires a subscription for commercial use. Because most enterprises patched past 8u202 years ago for security reasons, most Oracle JDK 8 in production is now paid and is the most common audit finding.
There was never a free production release of Oracle JDK 11. Every build shipped under the OTN license, which allows free development and testing but forbids production use without a subscription. It downloads as easily as a free build, so teams deploy it to production unaware, creating a frequent basis for large audit claims.
JDK 21 and JDK 25 are free in production under the NFTC, with free updates until September 2026 and September 2028 respectively. Non-LTS releases such as JDK 24 and 26 are free for their full six-month support life. All older LTS releases past their free build cutoff are paid.
Yes. OpenJDK is licensed under GPLv2 with the Classpath Exception, which explicitly permits free commercial production use with no fee and no expiry. Free distributions include Eclipse Temurin, Amazon Corretto, Azul Zulu, Microsoft Build of OpenJDK, and BellSoft Liberica. Unlike Oracle builds, there is no build-number cliff to track.
No. The NFTC is never retroactive. It does not cover Java 8, Java 11, or Java 17 past build 17.0.12. It also does not apply if your organization previously received that JDK version under a paid Oracle Master Agreement or Java SE subscription.
The Java SE Universal Subscription is priced per employee (total headcount, not Java users), starting at $15 per month and dropping to about $5.25 at 40,000-50,000 employees. Oracle's own example puts a 28,000-employee company at $2,268,000 per year, which is the cost of leaving a paid Oracle build in production instead of migrating to free OpenJDK.
Everything CIOs need to govern Oracle Java in 2026. Universal Subscription mechanics, the OpenJDK exit path, audit defense, and the 3 year plan that contains
Gated with a work email on the download page. No sales follow up you did not ask for.
Get the White Paper →
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Renewal signals, audit moves, and the levers that work. No vendor spin.
