Licenses

# Media engine inventory and licenses

This page lists the media software this site actually ships, the pieces still in intake, and the exact contracts behind them. What an operation may do is decided by what the active engine or core can parse and encode, never by a review status.

##  What this site ships

 Asset Version License Codecs Notices & duties

MediaBunny (npm mediabunny)

bundled with the app
 1.55.3 MPL-2.0 none (demux/mux/remux layer; decode/encode via the browser's WebCodecs) MPL-2.0 notices and source availability for the shipped, unmodified package.

gifenc

bundled with the app
 1.0.3 MIT GIF (animated output only) MIT notice.

@ffmpeg/ffmpeg + @ffmpeg/util (wrapper only)

bundled with the app
 0.12.15 / 0.12.2 MIT none (the wrapper embeds no codecs) MIT notices.

MediaBunny FLAC extension (libFLAC WASM)

bundled with the app
 1.55.4 MPL-2.0 wrapper + BSD-3-Clause libFLAC binary FLAC encode (browser tier; used when the browser reports no native FLAC encoder) MPL-2.0 notices and source availability for the wrapper; libFLAC is BSD-3-Clause, source at flac.sourceforge.io.

MediaBunny MP3 extension (LAME 3.100 WASM)

bundled with the app
 1.55.4 MPL-2.0 wrapper + LGPL-2.1-or-later LAME binary MP3 encode (browser tier; no browser ships a WebCodecs MP3 encoder) MPL-2.0 notices plus LAME's source/relink path (lame.sourceforge.io).

MediaBunny AAC extension (FFmpeg native AAC WASM)

bundled with the app
 1.55.4 MPL-2.0 wrapper + LGPL-2.1-or-later FFmpeg AAC binary AAC-LC encode (browser tier; used where the browser reports no native AAC encoder) MPL-2.0 notices plus the AAC encoder's source availability (FFmpeg, LGPL-2.1-or-later).

User-supplied FFmpeg core (uploaded files, session-only)

you supply it; bytes stay in this browser
 runtime identity (FFmpeg banner + SHA-256 fingerprint shown at /media/core) Unknown, user-supplied whatever the uploaded core contains; its own parsed capability report decides, nothing else Displayed identity and fingerprint only; no license asserted for user-supplied binaries.

User-named remote FFmpeg core directory (pinned SHA-256)

you supply it; bytes stay in this browser
 runtime identity (FFmpeg banner + SHA-256 fingerprint shown at /media/core) Unknown, user-supplied whatever the remote core contains; its own parsed capability report decides, nothing else The fetch is a disclosed browser egress to the exact URL the user names; the core loads only when the fetched WASM matches the user-supplied SHA-256 pin.

Encoding through MediaBunny uses this browser's own codec support when available; the run checks the exact configuration first and refuses rather than switching codecs silently.

##  The bundled FFmpeg core (LGPL-2.1+)

The compatibility engine runs FFmpeg compiled to WebAssembly under LGPL-2.1-or-later, built manually with emscripten and shipped from this repository: no GPL components, no CDN fetch, no third-party binary. The externals compiled into it:

- https://github.com/cisco/openh2642.5.0BSD-2-Clause

H.264 encoding comes from openh264. Cisco's royalty-free patent grant covers Cisco's own prebuilt binaries. A build compiled from source, including this one, is NOT covered by that grant.

- https://chromium.googlesource.com/webm/libvpx1.15.0BSD-3-Clause

VP8 and VP9 encoding come from libvpx, which also grants its essential patents for VP8/VP9 implementations.

- https://gitlab.com/AOMediaCodec/SVT-AV12.3.0BSD-2-Clause + patent grant

AV1 encoding uses SVT-AV1 (picked over rav1e: C toolchain builds cleanly under emscripten next to the FFmpeg configure, and the AOM patent grant travels with the BSD license). rav1e stays a valid alternative on user-supplied cores.

- npm @breezystack/lamejs1.2.7LGPL-3.0-or-later

MP3 output on the bundled tier is encoded by lamejs beside the core (decode through FFmpeg to PCM, encode in JavaScript). lamejs is a LAME port and inherits LGPL-3.0, recorded here as shipped, not as MIT.

The configure line and the expected encoder set are recorded in public/ffmpeg/lgpl/manifest.json and asserted by test. A build that loses an encoder or gains a GPL component fails the suite, not the user.

Encoders the core is built to carry (generated from the recorded set)

- Video encoders: libopenh264, libvpx, libvpx-vp9, libsvtav1, prores_ks, prores_aw.
- Audio encoders: aac, ac3, eac3, flac, pcm_s16le.
- MP3: decoded to PCM through the core, then encoded by lamejs beside it (LGPL-3.0).
- HEVC: decode only. No core shipped here contains an HEVC encoder.
- DTS: no encoder ships in any FFmpeg build; decode only unless a user core carries one.

The built artifacts and their SHA-256 pins are recorded in public/ffmpeg/lgpl/manifest.json and verified on every load.

##  Archive, font & image-tool engines

Beyond media, a handful of tools ship their own engine packages. Every one runs in your browser; versions match the lockfile and this list is asserted by test.

 Asset Version License Notices & duties

brotli-wasm

[/files/brotli](/files/brotli)
 3.0.1 Apache-2.0 Rust brotli compiled to WebAssembly. The recorded decision guessed MIT; the actual package license is Apache-2.0 and this row records it. Runs in the archive family worker only.

fzstd

[/files/zstd](/files/zstd)
 0.1.1 MIT Pure-JavaScript Zstandard decoder (no wasm, no encoder). Decode-only by decision: no zstandard encoder passed intake, and the tool refuses the compress direction instead of half-shipping one.

7z-wasm

[/files/7z](/files/7z)
 1.2.0 LGPL-2.1 7-Zip 24.09 compiled to WebAssembly, used EXTRACT-ONLY. 7-Zip is LGPL-2.1 with a special exception for unmodified code; the bundled unRAR code carries its own restriction (the unRar license: cannot be used to re-create the RAR compression algorithm). Both notices ship with this row. Source: github.com/use-strict/7z-wasm.

wawoff2

[/files/woff2](/files/woff2)
 2.0.1 MIT Fontello's WebAssembly build of Google's woff2 compressor/decompressor (the underlying woff2 C++ is Apache-2.0 / its own notice; the npm wrapper is MIT — the recorded decision guessed Apache-2.0 for the wrapper, corrected here). Used for whole-font TTF↔WOFF2 conversion; no subsetting.

thumbhash

[/images/thumbhash](/images/thumbhash)
 0.1.1 MIT Evan Wallace's compact image-placeholder codec. MIT as recorded. The hashing runs on the main thread — it is pure arithmetic over ≤100 px samples.

hqx (vendored port)

[/images/hqx](/images/hqx)
 1.0.2 LGPL-2.1 Maxim Stepin's HQ2x/HQ3x/HQ4x pixel-art scalers, JavaScript port by Endel Dreyer, vendored into this repository with the canvas entry stripped (src/hqx/hqx.js carries the header). LGPL-2.1 applies to that file; the source it derives from is github.com/gamestdio/hqx.

@jsquash/{avif,jpeg,jxl,png,qoi,webp}

[/images/animated](/images/animated)
 2.1.1 / 1.6.0 / 1.3.0 / 3.1.1 / 1.1.0 / 1.5.0 Apache-2.0 npm wrappers (Apache-2.0) over the codec WebAssembly they bundle. The image family uses them for AVIF, JPEG, JPEG XL, PNG, QOI and WebP encode/decode; the AVIF sequence muxer on /images/animated encodes its per-frame AV1 samples through the approved jsquash encoder, and the media image path uses the QOI encoder. They run inside the image/media worker families.

vendored Squoosh codecs (src/squoosh/codecs)

[/images/compress](/images/compress)
 vendored tree per codec — from the vendored files, never guessed Codec WebAssembly vendored from the Squoosh project into src/squoosh/codecs. Ground truth per dir: imagequant — GPL-3.0-or-later (LICENSE.codec.md: libimagequant © Kornel Lesiński, changes licensed GPL v3 or later; vendored v2.12.1); oxipng — MIT (vendored README, v9.0.0); hqx wasm build (wasmboy-rs) — Apache-2.0 (vendored pkg README, v0.1.2). The remaining dirs (avif/libavif v0.5.4, webp/libwebp v1.0.2, wp2/libwebp2, jxl, mozjpeg, qoi, resize, rotate) ship no license text in this tree — their upstream licenses govern and live in the source repos named in each README; this row does not restate them.

##  User-supplied cores

You can load your own FFmpeg core at [/media/core](/media/core). Uploaded bytes are validated (shape bounds, WASM magic, wrapper ABI, banner parse), fingerprinted by SHA-256, probed for their own capability report, and kept in memory for the session only. Nothing is written anywhere, and the core is dropped on reset or reload. The remote option takes a URL you name plus a mandatory SHA-256 pin: the fetch is a disclosed browser egress to that exact URL, and the bytes load only when they match your pin. What a user core may do is decided by the capability report parsed from the core itself. HEVC or DTS encode, for example, exist only when the core you loaded reports an encoder for them.

##  Where media bytes go

Media files dropped on this site's pages are processed on the device: the engines above read and write them in the page. The remote core fetch you configure at /media/core is the one media egress this site can make, and it fetches engine code, never your media bytes; everything else stays local. See the [privacy policy](/privacy-policy) for the full data handling statement.

##  In intake, not shipped

- FFmpeg WASM core (manual LGPL-2.1 build, repo-shipped)Not shippedLGPL-2.1-or-later

LGPL-2.1: ship the exact source/commit and configure line the build was made from, plus a relink path; recorded in public/ffmpeg/lgpl/manifest.json when the manual emscripten build runs (the configure line and externals are recorded there now).

The manual emscripten build has not been run in this environment (no CI, no toolchain present), so no artifacts and no SHA-256 pins exist yet. The loader, validation, capability probe, and the /media/core manager all ship and refuse honestly (media/core-fetch-failed) until the core commits. The GPL @ffmpeg/core packages and the CDN fetch are gone; no other core URL is fetched by any code path.

---

Canonical HTML: https://nutter.tools/licenses
Markdown version: https://nutter.tools/licenses/index.md
Plain-text version: https://nutter.tools/licenses/index.txt
Agent index: https://nutter.tools/llms.txt