Ends Sept 2026Oracle JDK 21 · No-Fee Terms update window
Oracle's Java license reviews ask for every deployment by version, and the subscription is priced per employee. RuntimeClear is an open-source, read-only scanner plus an in-browser report that finds Oracle Java across servers, laptops, container images and CI, shows which builds are under paid terms or one update away, and how to move each one to a free OpenJDK build.
Built and supported by Tech Build Dreams LLC, Miami, Florida. Scanner source, MIT.
Findings ledger sample output
Sample| Host · version | Found | Status |
|---|---|---|
| win-fin-078u381 | C:\Program Files\Java\jre1.8.0_381 | Paid license |
| app-0217.0.14 | /usr/lib/jvm/jdk-17-oracle-x64 | Paid license |
| build-0121.0.8 | /usr/lib/jvm/jdk-21-oracle-x64 | At risk |
| build-01ref | Dockerfile:1 FROM container-registry.oracle.com/java/jdk:21 | At risk |
| win-fin-07auto-update | Java Update Scheduler (enabled) | At risk |
| mac-dev-0221.0.2 | /Library/Java/JavaVirtualMachines/graalvm-21.jdk | Needs review |
| mac-dev-0221.0.8 | /Library/Java/JavaVirtualMachines/temurin-21.jdk | Free |
Oracle JDK 8u211
First Java 8 update under the OTN license.
Oracle JDK 17.0.13
First JDK 17 update under OTN.
Oracle JDK 21
Last month of JDK 21 updates under the No-Fee Terms (NFTC).
October CPU
Further JDK 21 updates planned under OTN.
01 · License terms, per Oracle's published pages
Oracle licenses each Oracle JDK update under the terms in force when it ships. The September 2026 date changes the terms for JDK 21 updates released after it. It does not reach back into builds already released.
| Release line | Builds | License | Commercial production use |
|---|---|---|---|
| Oracle JDK 8 | 8u202 and earlier | BCL | Free for general-purpose computing |
| Oracle JDK 8 | 8u211 and later (Apr 2019 →) | OTN | Paid license |
| Oracle JDK 11 | every Oracle JDK 11 build | OTN | Paid license |
| Oracle JDK 17 | 17 – 17.0.12 | NFTC | Free |
| Oracle JDK 17 | 17.0.13 and later (Oct 2024 →) | OTN | Paid license |
| Oracle JDK 21 | 21 – updates released through Sept 2026 | NFTC | At risk free as installed; the next update is not |
| Oracle JDK 21 | October 20, 2026 CPU and later | OTN | Paid license |
| Oracle JDK 25 | updates through Sept 2028 | NFTC | Free same cliff, two years later |
Oracle's formal Java audit letters request global employee counts, deployments by version, installation inventories, and virtualization and cloud details.8 RuntimeClear produces the inventory part. Talk to counsel before sending anything to Oracle.
An Oracle JDK 21 build released under the No-Fee Terms and Conditions was licensed under NFTC.5 Oracle applies OTN to subsequent JDK 21 updates,1 so nothing on disk turns into a paid license on October 1 by itself.
From the October 2026 Critical Patch Update, Oracle JDK 21 updates are planned under the Java SE OTN License.2 They usually arrive without anyone deciding: auto-updaters, :21 or :latest image tags, setup-java with distribution: oracle, package repos, golden images.
Oracle JDK 8u211 and later, every Oracle JDK 11 build, and Oracle JDK 17.0.13 and later are OTN-licensed now.4 OTN allows personal and development use; commercial production use needs a Java SE subscription.6
Oracle's Java SE Universal Subscription is priced per employee, and its definition of employee includes full-time, part-time and temporary staff plus certain contractors.7 The price follows headcount, not the number of machines running Java.
This is a summary to help you find installs. Oracle's pages and your agreements with Oracle are what count. Every rule and its source is in the public repository.
JDK 21 will receive updates under the NFTC, until September 2026 … Subsequent JDK 21 updates will be licensed under the Java SE OTN License.
02 · What it inventories
The scanner records facts: paths, versions, vendors, build types and single matching lines. The report decides the license status, and anything it can't decide is marked needs review.
hosts
Java homes on Linux, macOS and Windows: package databases, /usr/lib/jvm, Program Files and the registry, SDKMAN, asdf, IDE-managed JDKs and running java processes. Version, vendor and build type come from each release file.
images
Dockerfile, Compose and Kubernetes lines that pull container-registry.oracle.com/java images, deprecated openjdk tags, or free vendor images.
pipelines
setup-java with distribution: oracle, GitLab CI, Jenkinsfiles and scripts that download from download.oracle.com, plus SDKMAN, Gradle and Maven toolchains.
updaters
The Windows Java Update Scheduler and Oracle's macOS updater: the way OTN builds usually arrive without anyone deciding.
Never: network connections, changes to the system, sudo, process arguments, environment variables beyond PATH and JAVA_HOME. Exactly what it reads
03 · Procedure
One script per platform, one JSON file per host, and a report page that never sends that JSON anywhere.
Read-only, no network calls, no root required. It reads Java home directories and their release files, package databases, PATH, running java executables and, if you point it at a repo, the single matching lines of Dockerfiles, Kubernetes and Compose YAML, CI workflows, SDKMAN, Gradle and Maven toolchains. Read the script first: it is one file, MIT-licensed.
$ curl -fsSLO https://raw.githubusercontent.com/techbuilddreams/runtimeclear/v1.0.1/runtimeclear.sh $ less runtimeclear.sh $ bash runtimeclear.sh --out scan.json --repo ~/src/my-service
PS> Invoke-WebRequest https://raw.githubusercontent.com/techbuilddreams/runtimeclear/v1.0.1/runtimeclear.ps1 -OutFile runtimeclear.ps1 PS> notepad .\runtimeclear.ps1 PS> powershell -NoProfile -ExecutionPolicy Bypass -File .\runtimeclear.ps1 -Out scan.json
Scanner v1.0.1. Add --anonymize (-Anonymize) to replace hostnames with a hash. Verify the download against SHA256SUMS before running; see how.
Open the report tool and drag in one file or a few hundred. Classification runs in your browser against a versioned rules file; the files are never uploaded. You immediately see host count, installs, references and how many findings fall into each status.
04 · Pricing, one-time, USD
The scanner and the summary counts cost nothing and stay that way. Pay once when you want the details, the runbook and the document.
Free
$0 forever
Scanner, counts and status totals.
Get the scannerReport The document
$149 one-time · 1 organization
Every finding, the runbook, the cost estimate and the PDF.
Buy report · $149MSP
$399 one-time · up to 10 organizations
The full report for each client organization you serve.
Buy MSP · $39914-day refund, no questions. Refund policyCheckout by Stripe. Run the free scan before paying.
05 · For IT service providers
The MSP plan covers up to 10 client organizations for $399, once, with unlimited hosts in each.
Nothing to install on client machines: pipe the script over SSH, collect one JSON per host, and keep each client's files in its own folder. Load one client at a time into the report, set the organization name, and print a PDF with that name, the date and the rules version.
--anonymize before files leave the client$ while read -r h; do
ssh "$h" 'bash -s -- --quiet --out runtimeclear.json' < runtimeclear.sh &&
scp "$h:runtimeclear.json" "./scan-$h.json" && ssh -n "$h" rm -f runtimeclear.json
done < hosts.txt
06 · Questions
No. RuntimeClear is an educational inventory tool. It maps what it finds to Oracle's published license terms and links the pages it relies on. Your contracts with Oracle, and your counsel or licensing contact, decide what applies to you.
No. RuntimeClear is built by Tech Build Dreams LLC and is not affiliated with, endorsed by or sponsored by Oracle. We don't sell Oracle licenses and we don't get paid by any JDK vendor.
The scanner makes no network calls. It writes one JSON file on the host, and you decide where that file goes. The report page reads the file with your browser's File API and classifies it in JavaScript on your machine. Nothing from the scan is uploaded.
The only server call is after payment: the page sends your Stripe checkout reference to our server to confirm the purchase. It contains no scan data. Details on the security page and in the privacy policy.
Yes, as references. Point the scanner at a repository with --repo and it records the matching line from Dockerfiles (for example container-registry.oracle.com/java/jdk), Compose and Kubernetes YAML, GitHub Actions setup-java with distribution: oracle, GitLab CI, .sdkmanrc, .tool-versions, and Gradle and Maven toolchains. It does not pull or inspect image layers; run the scanner inside a running container if you need to see what is actually installed there.
Some vendors ship a JDK inside their product, and some Oracle products include a restricted-use Java license. The scanner can see those installs but can't see your contracts, so they are marked needs review. Check with the application vendor or your Oracle licensing contact before changing or removing them.
Every rule lives in one versioned rules file with a citation and the date it was last checked. The report shows the rules version and date on screen and on the PDF. When Oracle changes its terms we update the file and note it in the changelog; re-open the report and your existing scan files are re-classified.
The install or reference is free to use today, but it is set up to move onto OTN-licensed builds: an Oracle JDK 21 that gets updated, an enabled Java auto-updater, a floating image tag or a CI step that resolves to Oracle's latest JDK 21. Pinning or switching it before the October 2026 update keeps it free.
Email support@runtimeclear.com within 14 days of purchase. We refund in full, no questions. See the refund policy.
If it finds nothing, you've spent a few minutes and $0.