On this page · 10 sections
Summary. Oracle JDK 21 updates left the free No-Fee Terms and Conditions (NFTC) licence after September 2026. The first update licensed under the paid Java SE OTN terms is JDK 21.0.13, released in the Critical Patch Update of 20 October 2026. Oracle announced this on 14 August 2026. The commercial exit, a Java SE Universal Subscription, starts at $100 a year for up to 10 employees under Oracle's 8 October 2026 price list, and its enterprise rates fall to a published $5.25 per employee per month. The other three exits cost nothing: upgrade to JDK 25, which stays under NFTC until September 2028; switch to a non-Oracle OpenJDK build such as Eclipse Temurin 21, supported to at least December 2029, or Amazon Corretto 21, supported to October 2030; or freeze on the last NFTC binary, 21.0.12.1, and accept no further security patches. The subscription is priced per employee, not per developer or per server, so a 1,000-person company pays for 1,000 people whether 4 engineers write Java or 400 do.
Update, 2 November 2026. The licence change has happened. Oracle JDK 21.0.13, released on 20 October 2026, is the first update under OTN, and the last NFTC build is 21.0.12.1 from 18 August 2026. Oracle's 8 October 2026 price list also replaced the $15 entry rate with annual prices from $100 for organisations under 3,000 employees. Our 2027 guide to the Oracle JDK 21 licence and Java audits has the current position.
That last point is where most of the money is lost. Teams read "Java 21 is going paid", price it against their Java headcount, and get a number that is wrong by an order of magnitude. The metric Oracle sells on has nothing to do with how much Java you run.
What actually changes, and on which date
Nothing changes in the JDK itself. No API is removed, no bytecode level moves, no binary stops working. What changes is the licence attached to the next update you download.
Oracle's Java downloads page now says the Oracle JDK 21 licence changed in October 2026. Updates from 21.0.13 fall under the Java SE OTN licence, which allows uses such as personal and development use at no cost, and other uses allowed under earlier licences may no longer be available. The current release on 2 November 2026 is JDK 21.0.13.0.3.
The mechanism is Oracle's one-year overlap rule. JDK 25 LTS shipped in September 2025, which started a twelve-month window during which both JDK 21 and JDK 25 remained available under the permissive licence. That window closed at the end of September 2026.
Donald Smith, Vice President of Product Management at Oracle, wrote in the 14 August 2026 announcement: "This one-year overlap is intended to give users who wish to continue using the permissive no-fee NFTC license time to migrate to Oracle JDK 25, the latest LTS release."
The date the licence changed was 20 October 2026. Oracle publishes Critical Patch Updates on the third Tuesday of January, April, July and October, and its security-alerts page lists 19 January 2027 as the next one. The 20 October 2026 release, JDK 21.0.13, is the first JDK 21 update carrying OTN terms.
One detail almost everyone will get wrong. Since May 2026 Oracle also ships Critical Security Patch Updates on the third Tuesday of February, March, May, June, August, September, November and December, and 15 September 2026 was one of them. Oracle's wording is that NFTC covers JDK 21 updates "through and including September 2026". No JDK 21 build shipped in September, so the last free-for-production binary is 21.0.12.1, released on 18 August 2026. If your compliance evidence records "the last NFTC build", record the actual build you pulled and the date you pulled it, not the quarter.
| Date | Event | Licence on JDK 21 updates |
|---|---|---|
| September 2023 | JDK 21 GA | NFTC, free for production |
| September 2025 | JDK 25 LTS GA, overlap starts | NFTC, free for production |
| 21 July 2026 | July 2026 Critical Patch Update | NFTC, free for production |
| 18 August 2026 | Last NFTC build, 21.0.12.1 (no JDK 21 build shipped in September) | NFTC, free for production |
| 20 October 2026 | October 2026 Critical Patch Update | OTN, production use requires a fee |
| September 2031 | End of Oracle commercial support for Java 21 | Subscription only |
Who is not affected at all
The announcement is narrower than the headlines suggest. Oracle lists several categories that keep taking the latest JDK 21 updates exactly as they do now:
Java SE Universal Subscription customers and legacy Java SE product customers. Workloads running on Oracle Cloud Infrastructure. Anyone using Oracle Java as part of a separately licensed Oracle product. And anyone using Java for personal use, development, testing, prototyping or demonstrating applications, which the OTN licence grants at no cost.
That last grant matters more than it looks. Developer laptops, CI build agents and test environments are covered by the free grants of the OTN licence. The fee attaches to production. A team that runs Oracle JDK 21 on workstations and Temurin in production has no exposure at all after October 2026, and a team in the reverse position has full exposure.
Also unaffected: every OpenJDK build that is not Oracle's. The source is the same upstream OpenJDK project, released under GPLv2 with the Classpath Exception. Oracle's licence change applies to Oracle's binaries.
The four exits, and what each one costs
Option 1: upgrade to JDK 25
JDK 25 is the current LTS and stays under NFTC, free for production and free to redistribute, until September 2028. That is the option Oracle is steering towards, and for most estates it is the right one, because the work is a JDK upgrade you were going to do anyway inside three years.
The cost is engineering time, not licence fees. JDK 21 to 25 is a four-version jump across two feature releases, so the realistic work is dependency updates (build plugins, bytecode manipulation libraries, agents), a pass over anything reading internal JDK APIs, and a performance re-baseline. Nothing in this jump is a language-level breaking change on the scale of the Java 8 to 11 module migration.
Note the trap in the timing: taking JDK 25 buys you until September 2028, at which point the same overlap rule applies again after Java 29 ships in September 2027. This is now a permanent two-year cadence, not a one-off event.
Option 2: move to a non-Oracle OpenJDK build
The free-forever answer. Same upstream source, same TCK certification, different publisher, and free support windows that run years past Oracle's free JDK 21 updates.
| Distribution | JDK 21 support ends | Licence | Cost |
|---|---|---|---|
| Oracle JDK 21 | September 2031 (subscription only) | OTN from 20 Oct 2026 | From $100 a year by headcount |
| Eclipse Temurin 21 | At least December 2029 | GPLv2 with Classpath Exception | Free |
| Amazon Corretto 21 | October 2030 | GPLv2 with Classpath Exception | Free |
| Red Hat build of OpenJDK 21 | 31 December 2029 full support, 30 September 2031 ELS-1 | GPLv2 with Classpath Exception | Included in RHEL subscription |
Eclipse Adoptium's support table gives Temurin 21 an end of availability of "at least Dec 2029", with 21.0.13+9 current on 2 November 2026 and quarterly releases continuing. Amazon publishes a firmer date: Corretto 21 has a last planned update of July 2030 and end of life in October 2030, distributed under GPLv2 with CPE at no cost. Red Hat's OpenJDK life-cycle policy, updated 13 August 2026, gives OpenJDK 21 full support to 31 December 2029 and paid ELS-1 to 30 September 2031, with entitlements included in a RHEL subscription.
Amazon describes Corretto as "designed as a drop-in replacement for all Java SE distributions unless you are using features not available in OpenJDK". In practice the swap is a base-image change or an alternatives update, then a full regression run. Budget for the regression run, not the swap.
The one genuine incompatibility to check before you commit: Oracle-specific extras that are not in OpenJDK. Java Flight Recorder is upstream and fine. Jipher, Oracle's FIPS 140 cryptographic provider, is not. Jipher 20, the current release, is licensed under OTN and supported through Oracle's Java Verified Portfolio, which is included for subscribers and Oracle Cloud customers. If a regulated workload depends on Jipher, the free distributions do not replace it and a subscription conversation is unavoidable.
Option 3: buy the Java SE Universal Subscription
Oracle's subscription FAQ states the pricing model directly. The subscription is sold on an employee-based metric. Under 3,000 employees the annual price is $100 for up to 10, $1,000 for up to 100, $10,000 for up to 500, and $10,000 plus $147.20 for each employee above 500. From 3,000, rates start at $10.50 per employee per month and fall to a published $5.25, and may go lower above 50,000 employees.
Read the metric carefully. It is employees, not Java developers, not servers, not cores, not containers. Oracle confirms the architecture is irrelevant: "Java SE Universal Subscriptions are available per Employee. The underlying application architecture and deployment model does not affect pricing." Worked from Oracle's 8 October 2026 price list, a 900-employee company pays the $10,000 flat price for the first 500 employees plus $147.20 a year for each of the other 400. That is $10,000 + (400 x $147.20) = $68,880 a year, or $5,740 a month, regardless of whether it runs one Java service or two hundred.
That arithmetic is why the subscription is usually the wrong answer for a mid-sized firm with a small Java estate, and can be the right answer for a bank with thousands of Java processes and a hard requirement for vendor-backed patches with a support contract behind them.
One more clause to read before signing. Oracle's FAQ on non-renewal: "At the end of your Java SE Universal Subscription, your rights to any commercial software downloaded under the subscription, and your access to Oracle Premier Support, will end. We recommend transitioning your Java SE applications to OpenJDK binaries from Oracle (under a GPL license) before the end of your subscription." A subscription is not a purchase. If you stop paying, you migrate anyway, from a later starting point.
Option 4: freeze on 21.0.12.1 and stop patching
Legal, free, and a decision rather than a plan. The NFTC binaries you already hold stay licensed under the terms you received them under. Oracle's NFTC text grants a licence to "internally use the unmodified Programs for the purposes of developing, testing, prototyping and demonstrating your applications, and running the Program for Your own personal use or internal business operations", with no expiry clause on binaries already obtained.
What you give up is every subsequent security fix. Java CVEs are disclosed publicly in each quarterly advisory, so freezing means running a runtime whose unpatched vulnerabilities are published on a schedule. That first advisory has landed: the October 2026 Critical Patch Update carried 55 Java SE patches, 49 of them remotely exploitable without authentication, and lists 21.0.12.1 as affected. For anything internet-facing this is no longer a defensible position.
The honest use for this option is as a bridge: freeze deliberately for one or two quarters while a JDK 25 upgrade or a Temurin swap completes, with the end date written down.
The JDK 17 trap
A predictable reaction to "JDK 21 is going paid" is "then we will stay on 17". That is backwards on both counts.
Oracle JDK 17 left the permissive licence two years ago. Updates from 17.0.13 onwards, released after 15 October 2024, are already under the OTN licence. There is no free-for-production Oracle JDK 17 to fall back to.
Separately, Oracle's roadmap lists JDK 17 premier support until September 2026, the month before the JDK 21 licence change. Extended support runs to September 2029, and Oracle's roadmap footnote is worth quoting because it is genuinely favourable and widely missed: "The Extended Support fee will be waived for the period October 2026 to September 2029 for Java SE 17." So an existing Oracle customer on 17 keeps extended support at no uplift for three years. A non-customer on 17 gets nothing, because that waiver applies to the extended-support fee, not to the licence.
The net position: JDK 17 is a worse place to sit than JDK 21, not a safer one.
Where Oracle's own pages disagree
Three Oracle pages state the JDK 25 free-licence end date, and they do not match. The 14 August 2026 announcement says "JDK 25 updates are planned to remain available under the NFTC until October 2028". The licensing FAQ says "until September of 2028", and its licence table gives "Oracle JDK, releases through September 2028". The downloads page also says September 2028.
The discrepancy is almost certainly the same distinction as with JDK 21: updates through September, with the first OTN-licensed release arriving at the October CPU. Two of the three pages say September, so plan to September 2028 and treat October as the first paid release. If a licence position turns on that month, get it in writing from Oracle rather than from a web page.
This is a general lesson for anyone tracking vendor end-of-life dates. Roadmap tables, blog announcements and download pages are maintained by different teams and drift apart. The download page for the specific version you run is usually the most current of the three, because it changes with every release.
India-specific considerations
For Indian services companies and global capability centres, the employee-based metric is the whole story. A GCC with 6,000 staff in Bengaluru and 40 Java engineers is priced on 6,000. Indian IT services firms and GCCs run headcounts where the subscription's total contract value crosses seven figures in USD long before the Java estate justifies it, which is why the free distributions dominate here.
Two India-specific points worth adding to the decision memo. First, if the Java workload processes personal data, a frozen unpatched runtime is difficult to defend under the reasonable-security-safeguards obligation in the Digital Personal Data Protection Act 2023, so Option 4 carries regulatory weight beyond the technical risk. Second, for BFSI workloads under RBI supervision, the deciding factor is usually whether the auditor accepts a community-supported distribution. Red Hat's build and Amazon Corretto both come with a named commercial entity behind them, which answers that question more cleanly than a bare community build.
What to do now
The work now is inventory and decision, not migration. Migration can follow.
- Find every Oracle JDK 21 binary in production. Not every JDK, specifically Oracle's.
java -versiondistinguishes them: Oracle builds report "Java(TM) SE Runtime Environment", OpenJDK builds report "OpenJDK Runtime Environment". Sweep container images and base images too, where aFROMline pinned years ago is the usual source of surprise.
- Separate production from everything else. Development, test, prototyping and demonstration are covered by the OTN free grants. Only production drives cost.
- Check for Oracle-only components. Jipher for FIPS 140, the Java Management Service features kept for subscribers, and on JDK 8 the Enterprise Performance Pack. These do not come across to a free distribution.
- Pick one target and one bridge. JDK 25 if the upgrade is tractable this year, Temurin or Corretto 21 if it is not. Both are defensible; running both across different services is not.
- Write down the freeze end date if you freeze. A frozen runtime without a dated exit becomes permanent.
The real cost here is the inventory, not the licence. Most estates do not know which JDK is in which container, and that is the work that has to happen no matter which of the four options you choose.
If the answer is a JDK upgrade rather than a distribution swap, it belongs with the rest of the modernisation backlog rather than as a standalone project. The same inventory feeds a monolith to microservices migration and the platform engineering patterns that make the next runtime cutover routine. The mechanics also rhyme with the MySQL 8.0 end-of-life and extended-support cost decision: a vendor deadline, a paid extension, and a free alternative that most teams should take.
FAQ
How eCorpIT can help
eCorpIT runs JDK inventory and cutover work as part of application modernisation engagements: finding which runtime is in which container, separating production exposure from development use, and executing the upgrade or the distribution swap with a regression suite behind it. The firm is CMMI Level 5 and ISO 27001:2022 certified, and delivers this work through senior-led engineering teams rather than staff placement. See Java development services for the wider engagement model, or talk to us through /contact-us/ about a runtime inventory.
References
- JDK 21 approaches end-of-permissive license — Donald Smith, Oracle, 14 August 2026.
- Oracle Java SE Support Roadmap — Oracle, updated 20 October 2026.
- Oracle Java SE Licensing FAQ — Oracle.
- Java SE Universal Subscription FAQ — Oracle.
- Java Downloads — Oracle, JDK 21.0.13.0.3, 25.0.5.0.3 and 27.0.1.0.3 licence statements.
- Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins — Oracle, CPU and CSPU calendar.
- Temurin Support — Eclipse Adoptium release and end-of-availability table.
- Amazon Corretto FAQs — AWS, Corretto support calendar and licence terms.
- OpenJDK Life Cycle and Support Policy — Red Hat, updated 13 August 2026.
- Oracle Technology Network License Agreement for Oracle Java SE — Oracle, OTN free grants.
Last updated: 2 November 2026.
