Permissive licenses: MIT, BSD, and Apache 2.0
Permissive open-source licenses let you do almost anything as long as you keep the copyright notice — including building closed-source products on top. How MIT, BSD, and Apache 2.0 differ, and why Apache's explicit patent grant is the one that matters at scale.
In this series
Open source licenses explainedA permissive license is the most generous kind of open-source license1: do almost anything you want with the code — use it, modify it, ship it inside a closed-source commercial product — on one condition, that you keep the original copyright notice. There is no requirement to share your changes back. This is why permissive licenses dominate libraries and frameworks: a company can adopt the code without its own product becoming open source, so adoption meets no resistance.
🔗 Learn more — 1 What is an open-source license?
What "permissive" actually requires
The obligations are deliberately tiny. Across the permissive licenses, the recurring requirement is attribution: preserve the copyright line and the license text when you redistribute. That's essentially it. You may relicense your combined work however you like, keep your modifications private, and sell the result. The trade is explicit — the author gives up any claim on what you build in exchange for the widest possible use. The three that matter are MIT, BSD, and Apache 2.0.
MIT — the short one
The MIT license is about 170 words and grants permission "to deal in the Software without restriction" — use, copy, modify, merge, publish, distribute, sublicense, and sell — provided the copyright notice travels with it. It is the most popular open-source license in the world precisely because it is short and unsurprising.
One thing MIT does not contain is an explicit patent grant. Its permission is scoped to copyright ("the Software"); it says nothing about patents the contributor might hold. (Lawyers debate whether an implied patent license exists; there is no explicit one.) For most small libraries this never matters. For code from a company with a patent portfolio, it can.
BSD — the same idea, a small family
The BSD licenses are permissive in the same way as MIT, with a notable clause history:
- 2-Clause BSD ("Simplified") — keep the copyright notice in source and binary form. Functionally equivalent to MIT.
- 3-Clause BSD ("New" / "Modified") — adds a no-endorsement clause: you may not use the names of the project or its contributors to promote your derived product without permission. This is the most commonly used BSD variant today.
- 4-Clause BSD ("Original") — added an advertising clause requiring every ad for a derived product to credit the university. UC Berkeley formally rescinded that clause on 22 July 1999, and the FSF recommends against it because the clauses pile up incompatibly. Avoid the 4-clause version.
Apache 2.0 — permissive, plus a patent grant
Apache 2.0 is permissive but longer and more careful, and the extra length buys real protection that MIT and BSD lack:
- An explicit patent grant (§3). Every contributor grants you a perpetual, royalty-free patent license to use their contribution. You are not just safe under copyright — you are safe under their patents too.
- Patent-retaliation termination (§3). If you sue someone claiming the software infringes your patents, your patent license terminates. This is a built-in defense against patent aggression.
- A NOTICE file (§4d). If the project ships a
NOTICEfile, redistributions must preserve its attribution text.
That patent grant is why Apache 2.0 is the default for large, corporate-backed projects (Kubernetes, most of the Apache Software Foundation): it gives downstream users explicit patent peace, which a company's lawyers will insist on before depending on the code.
The three at a glance
| MIT | BSD-3-Clause | Apache-2.0 | |
|---|---|---|---|
| SPDX id | MIT |
BSD-3-Clause |
Apache-2.0 |
| Keep copyright notice | Yes | Yes | Yes |
| Explicit patent grant | No | No | Yes |
| Patent-retaliation defense | No | No | Yes |
| No-endorsement clause | No | Yes | Via NOTICE / trademarks |
| Length | ~170 words | Short | Long |
| Typical use | Small libraries | System code, libraries | Corporate-backed projects |
When permissive is the right call
Reach for permissive when your goal is ubiquity — you want the code everywhere, including inside products you'll never see, and you're fine with that. Pick Apache 2.0 over MIT/BSD whenever patents could plausibly be in play (anything corporate-backed, anything in a litigious domain); pick MIT when you want the shortest possible license and patents are a non-issue. If instead you want changes pushed back to the commons, that's the opposite design — copyleft2 — and choosing between the two is its own decision.
🔗 Learn more — 2 Copyleft and the GPL family