What is the difference between the main open source licenses?
They differ on one axis that matters: what someone has to give back. MIT and BSD ask for a copyright notice and nothing else. Apache 2.0 adds a patent grant. The GPL family requires derivative works to be released under the same terms. AGPL extends that to software people only reach over a network.
Every comparison of these turns into a table with fourteen columns that nobody reads. There is really only one question, and everything else follows from it.
The one axis
What does someone who uses your code have to give back?
give back nothing give back everything
│ │
MIT ──┼── BSD ── Apache 2.0 ── MPL ── LGPL ── GPL ──┼── AGPL
│ │
notice only file-level library whole work + network use Slide left for adoption. Slide right for protection against someone taking your work closed.
The permissive end
MIT. Use it for anything, including selling it, as long as the copyright notice travels with copies. One paragraph. Covered in detail in the MIT license.
BSD (2-clause and 3-clause). Functionally equivalent to MIT. The 3-clause version adds a term preventing use of your name to endorse derived products. Choose between them on taste; nothing practical hangs on it.
Apache 2.0. Everything MIT does, plus two additions that matter in commercial settings. An explicit patent licence from contributors, and a termination provision that ends the patent grant for anyone who sues over patents. It also requires modified files to be marked as changed.
If your code might carry patent exposure, or is heading into products at companies with legal review, Apache 2.0 is the safer permissive choice. MIT’s only real advantage is that it is short enough that people actually read it.
The copyleft end
GPL. If you distribute software derived from GPL code, that software must be released under the GPL too, with source. This is the point of the licence rather than a side effect. It keeps derived work open.
LGPL. A deliberate compromise for libraries. Link against it from proprietary software freely; modifications to the library itself must stay open. It exists because strict GPL on a library stops commercial adoption dead.
AGPL. GPL, plus it closes the hosting gap. Under the GPL, running modified software as a network service is not distribution, so nothing has to be released. AGPL treats network use as triggering the obligation. This is why companies releasing a service under an open licence increasingly choose AGPL, and also why many corporate policies ban AGPL dependencies outright.
MPL 2.0. File-level copyleft. Modified files stay open, but MPL code can sit inside a larger proprietary work. A genuinely useful middle position that is underused.
┌─ WORTH CHECKING ─────────────────────────────────────────────────────┐ │ │ │ Private, finished, owned by you, and doing nothing. │ │ │ │ [ See what your repos are worth ] │ │ │ └──────────────────────────────────────────────────────────────────────┘
Choosing, briefly
Maximum adoption, commercial friendly: Apache 2.0. Not MIT, unless brevity matters more to you than the patent grant.
A library you want everyone to use: MIT or Apache 2.0.
A service you do not want a hyperscaler to run as a closed product: AGPL.
Something between the two: MPL 2.0.
Genuinely undecided: Apache 2.0. It is the least likely to be regretted.
The part that is irreversible
You can change the licence on future versions, provided you hold rights to every contribution, which for a project with outside contributors may already be untrue.
You cannot revoke the licence on versions already published. Anyone who obtained a copy keeps those rights to that copy permanently, including the right to fork it and continue. Relicensing is a decision about the future only.
Choose accordingly, and choose once.
The thing none of them do
None of these licences preserve any commercial value in public code, and it is worth being clear about why.
Every one of them is a public licence on published code, and published code has been collected into training corpora for years. That is done. No choice on the axis above changes it, and no relicensing undoes it.
The code with licensing value left is the code that was never published at all, whatever licence sits in its root directory. That argument is made properly in your MIT-licensed repo is worth nothing.
What to read next
- The MIT license, the default and the bridge to what private code is worth
- Software license types, including proprietary and source-available
- Licensing a GitHub repository, the mechanics
Common questions
- Which open source license should I choose?
- Apache 2.0 if you want maximum adoption with patent protection, MIT if you want the shortest possible permissive license, AGPL if you are releasing a service and want to stop competitors running a closed hosted version of it. Those three cover most real decisions.
- What is copyleft?
- The requirement that derivative works carry the same license. It is what separates the GPL family from the permissive family, and it is the whole of the practical difference between them.
- Can I change my project's license later?
- For future versions, if you hold the rights to every contribution. Versions already released stay under the license they were released with, permanently, including the right to fork them.
- Does using a GPL library force me to open source my code?
- If you distribute software that links to it, generally yes for the GPL. The LGPL exists precisely to allow linking without that consequence. Using GPL software internally without distributing it does not trigger the obligation.
- Do any of these licenses affect AI training?
- Not in a way that helps you commercially. All of these are public licenses on public code, and public code has already been collected. The licensing value sits in private repositories, whatever their license.