Licensing
The SDK is dual-licensed under MIT or Apache-2.0, at your option. What each license permits, and how to check a license record.
@open-e2ee/signal-protocol-sdk is dual-licensed under the MIT License or the Apache License 2.0, at your option. The SPDX expression is MIT OR Apache-2.0.
| License | What it permits | What it asks |
|---|---|---|
| MIT | Use, copy, modify, and redistribute, in open or proprietary products | Keep the copyright and license notice |
| Apache-2.0 | The same rights, with an express patent grant from contributors | Keep the notices and state your changes to the files |
Choose the one that fits your product. Neither requires a fee, a signed agreement, or a console account, and neither requires you to publish your own source.
The license file controls
This page summarizes the two licenses and is not legal advice. The license files in the repository control the grant.
Commercial licenses
The console does not sell SDK commercial licenses. A signed license record, when one exists, can be checked offline against a published key: see verify a license record.
No SDK phone-home requirement
The SDK does not need to contact the console during normal cryptographic operation.
Security and protocol policy
Spec revision pins, post-quantum policy defaults, the deliberate divergence from Signal Messenger, the identity trust model, audit status, and the responsibility split.
Verify a license record
Check the Ed25519 signature on a downloaded license record offline, against the public key published here.