Oracle JDK 21 stops being free on 20 October 2026: the four options, costed

Summary. Oracle JDK 21 updates leave the free No-Fee Terms and Conditions (NFTC) licence after September 2026. The first update licensed under the paid Java SE OTN terms is the Critical Patch Update scheduled for 20 October 2026, per Oracle's own security-alerts calendar. Oracle announced this on 14 August 2026. The commercial exit, a Java SE Universal Subscription, starts at $15 per employee per month and falls to a published floor of $5.25. The other three exits cost nothing: upgrade to JDK 25, which stays under NFTC until September 2028; switch to a non-Oracle OpenJDK build such as Eclipse Temurin 21, supported to at least December 2029, or Amazon Corretto 21, supported to October 2030; or freeze on the last NFTC binary, 21.0.12, and accept no further security patches. The subscription is priced per employee, not per developer or per server, so a 1,000-person company pays for 1,000 people whether 4 engineers write Java or 400 do.

That last point is where most of the money is lost. Teams read "Java 21 is going paid", price it against their Java headcount, and get a number that is wrong by an order of magnitude. The metric Oracle sells on has nothing to do with how much Java you run.

What actually changes, and on which date

Nothing changes in the JDK itself. No API is removed, no bytecode level moves, no binary stops working. What changes is the licence attached to the next update you download.

Oracle's Java downloads page states the position plainly for JDK 21: "JDK 21 will receive updates under the NFTC, until September 2026, a year after the release of the next LTS. Subsequent JDK 21 updates will be licensed under the Java SE OTN License (OTN) and production use beyond the limited free grants of the OTN license will require a fee." The current release is JDK 21.0.12.

The mechanism is Oracle's one-year overlap rule. JDK 25 LTS shipped in September 2025, which started a twelve-month window during which both JDK 21 and JDK 25 remained available under the permissive licence. That window closes at the end of September 2026.

Donald Smith, Vice President of Product Management at Oracle, wrote in the 14 August 2026 announcement: "This one-year overlap is intended to give users who wish to continue using the permissive no-fee NFTC license time to migrate to Oracle JDK 25, the latest LTS release."

The date to put in the change calendar is 20 October 2026. Oracle publishes Critical Patch Updates on the third Tuesday of January, April, July and October, and its security-alerts page lists 20 October 2026 as the next one. That release is the first JDK 21 update carrying OTN terms.

One detail almost everyone will get wrong. Since May 2026 Oracle also ships Critical Security Patch Updates on the third Tuesday of February, March, May, June, August, September, November and December, and 15 September 2026 is one of them. Oracle's wording is that NFTC covers JDK 21 updates "through and including September 2026". So the last free-for-production JDK 21 binary may well carry a September date, not a July one. If your compliance evidence records "the last NFTC build", record the actual build you pulled and the date you pulled it, not the quarter.

Who is not affected at all

The announcement is narrower than the headlines suggest. Oracle lists several categories that keep taking the latest JDK 21 updates exactly as they do now:

Java SE Universal Subscription customers and legacy Java SE product customers. Workloads running on Oracle Cloud Infrastructure. Anyone using Oracle Java as part of a separately licensed Oracle product. And anyone using Java for personal use, development, testing, prototyping or demonstrating applications, which the OTN licence grants at no cost.

That last grant matters more than it looks. Developer laptops, CI build agents and test environments are covered by the free grants of the OTN licence. The fee attaches to production. A team that runs Oracle JDK 21 on workstations and Temurin in production has no exposure at all after October 2026, and a team in the reverse position has full exposure.

Also unaffected: every OpenJDK build that is not Oracle's. The source is the same upstream OpenJDK project, released under GPLv2 with the Classpath Exception. Oracle's licence change applies to Oracle's binaries.

The four exits, and what each one costs

Option 1: upgrade to JDK 25

JDK 25 is the current LTS and stays under NFTC, free for production and free to redistribute, until September 2028. That is the option Oracle is steering towards, and for most estates it is the right one, because the work is a JDK upgrade you were going to do anyway inside three years.

The cost is engineering time, not licence fees. JDK 21 to 25 is a four-version jump across two feature releases, so the realistic work is dependency updates (build plugins, bytecode manipulation libraries, agents), a pass over anything reading internal JDK APIs, and a performance re-baseline. Nothing in this jump is a language-level breaking change on the scale of the Java 8 to 11 module migration.

Note the trap in the timing: taking JDK 25 buys you until September 2028, at which point the same overlap rule applies again after Java 29 ships in September 2027. This is now a permanent two-year cadence, not a one-off event.

Option 2: move to a non-Oracle OpenJDK build

The free-forever answer. Same upstream source, same TCK certification, different publisher, and support windows that run years past Oracle's.

Eclipse Adoptium's support table gives Temurin 21 an end of availability of "at least Dec 2029", with the current build at 21.0.12+8 and quarterly releases continuing. Amazon publishes a firmer date: Corretto 21 has a last planned update of July 2030 and end of life in October 2030, distributed under GPLv2 with CPE at no cost. Red Hat's OpenJDK life-cycle policy, updated 13 August 2026, gives OpenJDK 21 full support to 31 December 2029 and paid ELS-1 to 30 September 2031, with entitlements included in a RHEL subscription.

Amazon describes Corretto as "designed as a drop-in replacement for all Java SE distributions unless you are using features not available in OpenJDK". In practice the swap is a base-image change or an alternatives update, then a full regression run. Budget for the regression run, not the swap.

The one genuine incompatibility to check before you commit: Oracle-specific extras that are not in OpenJDK. Java Flight Recorder is upstream and fine. Jipher, Oracle's FIPS 140 cryptographic provider, is not, and Oracle supports Jipher 10 only to the end of JDK 17 premier support in September 2026. If a regulated workload depends on Jipher, the free distributions do not replace it and a subscription conversation is unavoidable.

Option 3: buy the Java SE Universal Subscription

Oracle's subscription FAQ states the pricing model directly: "The Java SE Universal Subscription is sold by an Employee-based metric. Pricing starts at $15/employee per month. Published tier pricing is as low as $5.25 per month and can be even lower for customers with more than 50k employees."

Read the metric carefully. It is employees, not Java developers, not servers, not cores, not containers. Oracle confirms the architecture is irrelevant: "Java SE Universal Subscriptions are available per Employee. The underlying application architecture and deployment model does not affect pricing." Worked from Oracle's own published entry rate, a 900-employee company sits in the top band at $15 per employee per month, which is $13,500 a month, or $162,000 a year, regardless of whether it runs one Java service or two hundred.

That arithmetic is why the subscription is usually the wrong answer for a mid-sized firm with a small Java estate, and can be the right answer for a bank with thousands of Java processes and a hard requirement for vendor-backed patches with a support contract behind them.

One more clause to read before signing. Oracle's FAQ on non-renewal: "At the end of your Java SE Universal Subscription, your rights to any commercial software downloaded under the subscription, and your access to Oracle Premier Support, will end. We recommend transitioning your Java SE applications to OpenJDK binaries from Oracle (under a GPL license) before the end of your subscription." A subscription is not a purchase. If you stop paying, you migrate anyway, from a later starting point.

Option 4: freeze on 21.0.12 and stop patching

Legal, free, and a decision rather than a plan. The NFTC binaries you already hold stay licensed under the terms you received them under. Oracle's NFTC text grants a licence to "internally use the unmodified Programs for the purposes of developing, testing, prototyping and demonstrating your applications, and running the Program for Your own personal use or internal business operations", with no expiry clause on binaries already obtained.

What you give up is every subsequent security fix. Java CVEs are disclosed publicly in each quarterly advisory, so freezing means running a runtime whose unpatched vulnerabilities are published on a schedule. For anything internet-facing this is not a defensible position past the first advisory that lands.

The honest use for this option is as a bridge: freeze deliberately for one or two quarters while a JDK 25 upgrade or a Temurin swap completes, with the end date written down.

The JDK 17 trap

A predictable reaction to "JDK 21 is going paid" is "then we will stay on 17". That is backwards on both counts.

Oracle JDK 17 left the permissive licence nearly two years ago. Updates from 17.0.13 onwards, released after 15 October 2024, are already under the OTN licence. There is no free-for-production Oracle JDK 17 to fall back to.

Separately, JDK 17 premier support ends in September 2026, the same month as the JDK 21 licence change. Extended support runs to September 2029, and Oracle's roadmap footnote is worth quoting because it is genuinely favourable and widely missed: "The Extended Support fee will be waived for the period October 2026 to September 2029 for Java SE 17." So an existing Oracle customer on 17 keeps extended support at no uplift for three years. A non-customer on 17 gets nothing, because that waiver applies to the extended-support fee, not to the licence.

The net position: JDK 17 is a worse place to sit than JDK 21, not a safer one.

Where Oracle's own pages disagree

Three Oracle pages state the JDK 25 free-licence end date, and they do not match. The 14 August 2026 announcement says "JDK 25 updates are planned to remain available under the NFTC until October 2028". The licensing FAQ says "until September of 2028", and its licence table gives "Oracle JDK, releases through September 2028". The downloads page also says September 2028.

The discrepancy is almost certainly the same distinction as with JDK 21: updates through September, with the first OTN-licensed release arriving at the October CPU. Two of the three pages say September, so plan to September 2028 and treat October as the first paid release. If a licence position turns on that month, get it in writing from Oracle rather than from a web page.

This is a general lesson for anyone tracking vendor end-of-life dates. Roadmap tables, blog announcements and download pages are maintained by different teams and drift apart. The download page for the specific version you run is usually the most current of the three, because it changes with every release.

India-specific considerations

For Indian services companies and global capability centres, the employee-based metric is the whole story. A GCC with 6,000 staff in Bengaluru and 40 Java engineers is priced on 6,000. Indian IT services firms and GCCs run headcounts where the subscription's total contract value crosses seven figures in USD long before the Java estate justifies it, which is why the free distributions dominate here.

Two India-specific points worth adding to the decision memo. First, if the Java workload processes personal data, a frozen unpatched runtime is difficult to defend under the reasonable-security-safeguards obligation in the Digital Personal Data Protection Act 2023, so Option 4 carries regulatory weight beyond the technical risk. Second, for BFSI workloads under RBI supervision, the deciding factor is usually whether the auditor accepts a community-supported distribution. Red Hat's build and Amazon Corretto both come with a named commercial entity behind them, which answers that question more cleanly than a bare community build.

What to do in the next six weeks

The work before 20 October 2026 is inventory and decision, not migration. Migration can follow.

1. Find every Oracle JDK 21 binary in production. Not every JDK, specifically Oracle's. java -version distinguishes them: Oracle builds report "Java(TM) SE Runtime Environment", OpenJDK builds report "OpenJDK Runtime Environment". Sweep container images and base images too, where a FROM line pinned years ago is the usual source of surprise.

1. Separate production from everything else. Development, test, prototyping and demonstration are covered by the OTN free grants. Only production drives cost.

1. Check for Oracle-only components. Jipher for FIPS 140, the Java SE Subscription Enterprise Performance Pack, Java Management Service. These do not come across to a free distribution.

1. Pick one target and one bridge. JDK 25 if the upgrade is tractable this year, Temurin or Corretto 21 if it is not. Both are defensible; running both across different services is not.

1. Write down the freeze end date if you freeze. A frozen runtime without a dated exit becomes permanent.

The real cost here is the inventory, not the licence. Most estates do not know which JDK is in which container, and that is the work that has to happen no matter which of the four options you choose.

If the answer is a JDK upgrade rather than a distribution swap, it belongs with the rest of the modernisation backlog rather than as a standalone project. The same inventory feeds a monolith to microservices migration and the platform engineering patterns that make the next runtime cutover routine. The mechanics also rhyme with the MySQL 8.0 end-of-life and extended-support cost decision: a vendor deadline, a paid extension, and a free alternative that most teams should take.

FAQ

How eCorpIT can help

eCorpIT runs JDK inventory and cutover work as part of application modernisation engagements: finding which runtime is in which container, separating production exposure from development use, and executing the upgrade or the distribution swap with a regression suite behind it. The firm is CMMI Level 5 and ISO 27001:2022 certified, and delivers this work through senior-led engineering teams rather than staff placement. See Java development services for the wider engagement model, or talk to us through /contact-us/ about a runtime inventory ahead of the October deadline.

References

1. JDK 21 approaches end-of-permissive license — Donald Smith, Oracle, 14 August 2026.

1. Oracle Java SE Support Roadmap — Oracle, updated 4 August 2026.

1. Oracle Java SE Licensing FAQ — Oracle.

1. Java SE Universal Subscription FAQ — Oracle.

1. Java Downloads — Oracle, JDK 21.0.12, 25.0.4 and 26.0.2 licence statements.

1. Oracle No-Fee Terms and Conditions (NFTC) License Agreement — Oracle.

1. Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins — Oracle, CPU and CSPU calendar.

1. Temurin Support — Eclipse Adoptium release and end-of-availability table.

1. Amazon Corretto FAQs — AWS, Corretto support calendar and licence terms.

1. OpenJDK Life Cycle and Support Policy — Red Hat, updated 13 August 2026.

1. Oracle Technology Network License Agreement for Oracle Java SE — Oracle, OTN free grants.

Last updated: 19 August 2026.