I'm looking for an open source license that requires attribution to end users.

Thus far, I've looked at the MIT license and Apache 2.0. But I am not convinced that they require attribution to end users.

The MIT License - https://opensource.org/licenses/MIT

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

I find the above a little bit vague. Does it mean the source? Does it have to be easily readable by the end user?

For example, would an Android app be required to show the copyright notice in the UI? Since a user can't easily access the file system to see a LICENSE file.

Apache 2.0 - https://opensource.org/licenses/Apache-2.0

§4 You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:

  1. You must give any other recipients of the Work or Derivative Works a copy of this License; and

I interpret the above that the license must be shown to the end users, but not necessarily the copyright notice. Thus, no attribution.

  1. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and

I interpret this part that the copyright notices must be shown only in the source code. But not necessarily in the distributed binary form to the end users.

To summarize my questions

  1. Are any of my interpretations correct?
  2. Do either of these licenses actually require attribution to the end users? If so how?
  3. Do you have a suggestion of another license that fulfill my requirement?

2 Answers 2


Your interpretations are generally correct.

Nearly all open source licenses require some amount of attribution, with exception of 0BSD and some niche crayon licenses like WTFPL.

The MIT license requires the notices to be included in all copies the software. Binaries or packaged software are also a representation of the software, so that they too must include the notices.

  • With an overly literal reading, this could be satisfied if the binary happens to include the notices as a string: there is no explicit requirement to keep these notices user-accessible.
  • More reasonably, the notices should be shown via some user interface, or in associated files that are visible to end users.

As you've correctly noticed, the notices include a copyright notice, and therefore provide some amount of attribution.

The Apache 2.0 License requires two documents to be provided to any recipients of the software:

  • a copy of the license document
  • the NOTICE file, if it exists

The NOTICE file is intended to contain attribution notices. The license explicitly allows the following locations for the NOTICE file contents, as long as they are readable:

  • as a text file distributed with the software
  • in the source form or documentation, if they are distributed with the software
  • displayed by the software, wherever such notices would usually appear

The Apache license has very detailed and strong attribution requirements, but only if the NOTICE file mechanism is used. I'd therefore encourage you to make use of that mechanism for any Apache-licensed project.

Whether or not the license spells this out, the authors of the software still have a moral right to be recognized as the authors. Moral rights are a part of copyright that is independent from the economic rights. I do not interpret licenses without strong attribution requirements as a waiver of these moral rights, in fact moral rights are sometimes unwaivable. However, moral rights differ substantially between jurisdictions. In common law jurisdictions and especially the US, moral rights are extremely weak and do not seem to apply to software.

However, you are only bound by the laws from which you first publish your software. Applicability of that in the age of the internet is not entirely clear, but if you publish a software from a country, you should at least comply with the copyright laws of that country. You may therefore have to respect the moral rights anyway, and provide attribution for all works included in the software you publish. What licenses do and don't require is secondary to those concerns.

In Sweden, Art 3 of the Copyright Act covers the right to attribution, and when it may be waived.

  • Great answer! Thank you for taking the time. As a side note, would you say that Apache 2.0 is stronger than MIT in this regard or are they equal?
    – J.A.P
    Apr 6, 2019 at 17:54
  • 1
    @J.A.P The Apache license has much stronger and clearer rules about attribution. But only if the NOTICE file mechanism is used. By default, the MIT license is marginally stronger simply because the license template contains a copyright notice line. Apache separates the document with license terms from the copyright notice + license dedication (see the appendix “how to apply…”). In my personal opinion, the Apache 2 license is the best permissive license out there. It is longish but professionally drafted, considers patents, and remains clear outside of US jurisdictions.
    – amon
    Apr 6, 2019 at 18:15
  • Thanks again. I'm under the same impression as you. Apache will be my goto license from here on.
    – J.A.P
    Apr 6, 2019 at 18:19
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – MadHatter
    Sep 5, 2022 at 5:19
  • 1
    @ChaseMedallion Components that are part of the frontend are distributed to the user; nearly all Open Source licenses then require that the recipient/user is given the license + attribution. There are tools to create such notices from your NPM dependency graph. Components on the backend are not distributed to the user, but some licenses like the AGPL also trigger requirements on remote network interaction or upon public performance of the software. Permissive Open Source licenses like ISC/MIT/BSD/Apache don't require attribution when used in the backend though.
    – amon
    Sep 22, 2022 at 18:49


MIT in an almost encrypted way says that we don't need to attribute, see prove:


On the other hand, Apache 2.0 License is widely known for attribution(s) need-less-ness.

But "You must retain, in the Source form ... all copyright, patent, trademark, and attribution notices ..."

  • 1
    I'm sorry your answer isn't finding much favour, but that is still no reason to shout. Please don't restore the "shouty" version, or it will get reverted and the post will get locked.
    – MadHatter
    Sep 3, 2022 at 5:40
  • 2
    Frankly, you don't have a clue what you're talking about - which is worrying as you are stating opinions on copyright. The T&Cs here (which you agreed to when you signed up) mean that all your contributions are licensed under CC-BY, so anyone has permission to edit them, including the mods. Sep 3, 2022 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.