On this page · 10 sections
- What changed on 20 October 2026
- Is Oracle JDK 21 still free in production after October 2026?
- Your four options for a production JDK 21 estate
- What the Java SE Universal Subscription costs now
- Audit risk: where Oracle JDK 21 hides
- Free OpenJDK 21 and 25 builds compared
- Migration checklist: replacing Oracle JDK 21 with an OpenJDK 21 build
- Notes for teams in India, the UK, the EU and the US
- How eCorpIT can help
- References
Summary. For most businesses, no: current Oracle JDK 21 updates are no longer free to run in production. From 20 October 2026, Oracle JDK 21 releases moved to the Oracle Technology Network (OTN) License Agreement for Java SE. JDK 21.0.13 is the first update under those terms; builds through 21.0.12.1 stay under the free No-Fee Terms and Conditions (NFTC). OTN allows free personal use, development, testing, demonstrations and use with approved Oracle products, and it lets Oracle audit an organisation's use. Other production use needs a Java SE Universal Subscription or another Oracle entitlement. Three clean exits remain: pay, move to Oracle JDK 25 (NFTC updates through September 2028), or switch to a free OpenJDK build. Since 8 October 2026, organisations under 3,000 employees pay $100 a year (10 or fewer), $1,000 (100 or fewer) or $10,000 (500 or fewer), plus $147.20 per extra employee. From 3,000, rates run from $10.50 down to $5.25 per employee per month, counting all staff and supporting contractors, not Java users. Free builds run for years: Corretto 21 to October 2030, Temurin 21 to at least December 2029, Microsoft's build to at least September 2028.
About this article. For CTOs, engineering leads, IT asset managers and procurement teams running Java in production. On 1 November 2026 we checked it against Oracle's licensing FAQ and support roadmap (both updated 20 October 2026), the OTN text (last updated 10 April 2019), the NFTC text (last updated 12 September 2021), the 8 October 2026 price list, Oracle's release notes and advisories, and each distributor's support page. This is not legal advice: your Oracle contract overrides anything here, and Oracle's FAQ says the licence text prevails over the FAQ, so have counsel review your position. Vendors change prices, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
Our August pieces on the JDK 21 deadline and the September 2026 Java licensing cliff set out the dates in advance, but their prices predate Oracle's 8 October cut.
What changed on 20 October 2026
When a new long-term support (LTS) release arrives, Oracle keeps the previous one under the permissive NFTC licence for one more year, then moves its updates to OTN. Oracle JDK 25 shipped in September 2025, which started the clock for JDK 21. Oracle's 14 August 2026 blog said updates from the October 2026 Critical Patch Update (CPU) would move to OTN, the terms already used for Java 8, 11 and 17. The CPU landed on 20 October, and the release notes call JDK 21.0.13 the first JDK 21 update under OTN. JavaFX 21 follows a similar change, and the blog said GraalVM for JDK 21 would move to a GraalVM OTN licence.
Oracle's FAQ, archive and downloads page map the change to the version numbers an auditor or asset register will use.
| Oracle release | Licence | Free for production? |
|---|---|---|
| Oracle JDK 21.0.12.1 and earlier | NFTC | Yes, but no further fixes |
| Oracle JDK 21.0.13 and later | OTN | No, outside the listed free uses |
| Oracle JDK 17.0.13 and later, 11 (all), 8u211 and later | OTN | No, outside the listed free uses |
| Oracle JDK 25, updates through September 2028 | NFTC | Yes |
| Oracle JDK 27, non-LTS | NFTC for its six-month life | Yes |
| Oracle OpenJDK builds, jdk.java.net | GPLv2 with Classpath Exception | Yes, but JDK 21 builds ended January 2024 and JDK 25 builds January 2026 |
Two details need care. The FAQ's table stops at 21.0.12, but Oracle's archive lists 21.0.12.1, released on 18 August 2026, under NFTC, and no JDK 21 build shipped in September, so 21.0.12.1 is the last NFTC build. And while the FAQ, roadmap and downloads page end JDK 25's NFTC updates in September 2028, one year after the planned Java 29 LTS, the August blog says October 2028. Plan for the earlier date.
For subscribers nothing ends soon: the roadmap lists Premier Support for Java 21 until at least September 2028 and Extended Support until at least September 2031.
Is Oracle JDK 21 still free in production after October 2026?
Only in the cases the OTN licence allows. Oracle's FAQ summarises them as:
- Personal use on a desktop or laptop, such as games or personal applications.
- Development, testing, prototyping and demonstrating applications.
- Use with approved products (Schedule A), or as an end user of an application built with one (Schedule B), such as a vendor's Oracle Forms application. Oracle publishes an exclusive list.
- Use with identified Oracle Cloud Infrastructure products.
Personal use is narrow: the FAQ says any use on a desktop or laptop as part of business operations does not count, so a finance analyst running a Java tool for work is outside it. Development use covers internal work on your own applications, so developer laptops and test environments sit inside it. OTN also bars passing the software to third parties other than contractors acting for you, whereas NFTC allowed free redistribution, so check any image or installer you ship to customers.
Several groups are not affected: subscription and legacy Java SE customers, Oracle Cloud Infrastructure customers under its service terms, and customers with current support on an Oracle product that includes Java, for use with that product. If an application vendor has an agreement with Oracle to supply Java, you may not need a separate licence for that application; ask the vendor in writing.
The FAQ also says you may keep using releases under the licence you downloaded them under. The exposure comes from what happens next: the first 21.0.13 or later build that reaches a production server, by a manual patch, an auto-update or a CI pipeline, is an OTN build. Oracle's FAQ notes that NFTC builds have no click-through licence, which made scripted downloads simple, so pipelines written in 2024 or 2025 to fetch the latest Oracle JDK 21 deserve a check now.
Your four options for a production JDK 21 estate
| Option | Licence cost | Security fixes | Pick it if |
|---|---|---|---|
| Stay on Oracle JDK 21.0.12.1 | None | None since 18 August 2026 | Only as a short bridge, never for internet-facing services |
| Buy a Java SE Universal Subscription | From $100 a year | Oracle updates for Java 21 to at least September 2031 | You want Oracle support and tooling, or a vendor certifies only Oracle JDK |
| Move to Oracle JDK 25 | None while NFTC applies | NFTC updates through September 2028 | Apps are ready for a major-version upgrade |
| Switch to a free OpenJDK 21 build | None | Corretto to October 2030; Temurin to at least December 2029 | You want to stay on 21 without an Oracle contract |
A common pattern is to swap the runtime on the same feature version first, which removes licence exposure with the least change, then schedule JDK 25 on its own timeline.
What the Java SE Universal Subscription costs now
On 8 October 2026, Oracle announced simplified annual pricing for organisations with fewer than 3,000 employees, with online purchase through the Oracle Store for those with 500 or fewer. The price list of that date sets it out.
| Employees | Annual price (USD) |
|---|---|
| 10 or fewer | $100 |
| 100 or fewer | $1,000 |
| 500 or fewer | $10,000 |
| 501 to 2,999 | $10,000 plus $147.20 per employee above 500 |
| 3,000 or more | Enterprise rates below |
The enterprise rates are unchanged from the March 2023 list.
| Employees | Per employee per month |
|---|---|
| 3,000 to 9,999 | $10.50 |
| 10,000 to 19,999 | $8.25 |
| 20,000 to 29,999 | $6.75 |
| 30,000 to 39,999 | $5.70 |
| 40,000 to 49,999 | $5.25 |
| 50,000 or more | Contact Oracle |
The minimum term is one year, the lower prices are for now sold only directly, not through resellers, and each flat band is a single entitlement that cannot be stacked.
The metric is the part that surprises finance teams. Oracle counts all your full-time, part-time and temporary staff, plus those of your agents, contractors, outsourcers and consultants who support your internal business operations, however few of them use Java. If the count later rises above what you licensed, you must buy more. There is also a processor limit, excluding desktops and laptops: 1,000 for up to 10 employees, 10,000 for 11 to 100, 20,000 for 101 to 500, and 50,000 above that.
Worked numbers at list price:
- 40-person startup: the 100-or-fewer band, so $1,000 a year.
- 450 staff plus 150 contractors supporting internal operations: 600 counted, so $10,000 + (100 × $147.20) = $24,720 a year. The March 2023 list's $15 tier gave 600 × $15 × 12 = $108,000.
- 2,400 counted: $10,000 + (1,900 × $147.20) = $289,680 a year, against 2,400 × $12 × 12 = $345,600 on the old tier.
- 12,000 counted: 12,000 × $8.25 × 12 = $1,188,000 a year, unchanged.
The schedule meets the enterprise rates almost exactly at the boundary: Oracle's own examples put 2,999 employees at $377,852.80 a year and 3,000 at $378,000. Below 3,000, that changes the build-versus-buy sum for smaller firms.
Audit risk: where Oracle JDK 21 hides
The OTN text lets Oracle audit an organisation's use of the software. It also ends the licence automatically, without notice, if you breach its terms, after which you must destroy your copies. The NFTC text we read has no audit clause.
On our reading, not a statement from Oracle, one production server running an OTN build without an entitlement can put your whole counted headcount in the conversation, because that is how the subscription is sold. So inventory matters more than negotiation tactics. Oracle JDK tends to sit in places a server inventory misses:
- Container base images built from an Oracle JDK tarball, and the images derived from them.
- Release pipelines. A CI runner doing development and test work is inside the free grant, but one that bakes the latest Oracle JDK into a release image puts an OTN build in production.
- Golden VM images and AMIs that bake in a JDK and get cloned for years.
- Business desktops and laptops, which are not personal use if the work is business work.
- Vendor-bundled runtimes inside third-party products, where the vendor's licence may or may not cover you.
Three checks identify a runtime. java -version prints Java(TM) SE Runtime Environment for Oracle JDK and OpenJDK Runtime Environment for OpenJDK builds. The system properties show the vendor and exact version. The release file in the JDK home records the implementor.
# Product line
java -version 2>&1
# Vendor and exact version
java -XshowSettings:properties -version 2>&1 | grep -E "java\.vendor|java\.runtime\.version"
# Implementor and version
grep -E "IMPLEMENTOR|JAVA_VERSION" "$JAVA_HOME/release"
# Inside a container image
docker run --rm --entrypoint java <image>:<tag> -version
Oracle's own OpenJDK builds also report Oracle Corporation as the vendor, so check the product line too. Oracle's current builds carry five-part versions such as 21.0.13.0.3, so treat anything from 21.0.13 upwards as OTN. Record each finding with version, location and, where you can, the download date; for any 21.0.12.1 you keep, that record is your evidence it was obtained under NFTC.
Patch cadence raises the stakes. Oracle shipped a monthly Java update, 21.0.12.1, on 18 August 2026. The 20 October CPU carried 55 Java patches, 49 remotely exploitable without authentication, and lists 21.0.12.1 as affected. Two unscheduled builds followed for the eMudhra certificate authority compromise: 21.0.13.0.2 on 21 October and 21.0.13.0.3, the current download, on 24 October. Oracle is targeting a Java update on 17 November 2026 and plans multiple monthly updates in 2027, and its 2027 CPU dates are 19 January, 20 April, 20 July and 19 October. Every public JDK 21 build among them is OTN-licensed, and each leaves a frozen 21.0.12.1 further behind. Our July 2026 CPU triage guide covers how to sort a release that size.
Run the inventory before any licence conversation, not during one. Oracle says Java Management Service, an Oracle Cloud service, can help all users find vulnerable versions.
Free OpenJDK 21 and 25 builds compared
All four builds are based on OpenJDK source, licensed under GPLv2 with the Classpath Exception.
| Distribution | JDK 21 updates until | JDK 25 updates until | Paid support |
|---|---|---|---|
| Eclipse Temurin | At least December 2029 | At least September 2031 | Third-party vendors only |
| Amazon Corretto | End of life October 2030 (last update July 2030) | End of life October 2032 (last update July 2032) | Through AWS Support plans |
| Microsoft Build of OpenJDK | Earliest end September 2028 | Earliest end September 2030 | Azure support plans, for Azure workloads only |
| Azul Zulu builds | Free builds provided as is | Free builds provided as is | Azul Core to September 2031 (21) and September 2033 (25) |
Corretto gives the longest free commitment for JDK 21, is TCK-certified and is the natural default on AWS. Temurin is vendor-neutral, supports LTS releases for at least four years, and publishes a release when OpenJDK ships a Critical Security Patch Update (CSPU); its build and test cycle can take up to three weeks after the upstream date, with popular platforms first. Microsoft's build has the shortest published JDK 21 window, though Microsoft may extend it, ships quarterly, and limits commercial support to Azure, Azure Stack and Azure Arc workloads. Azul's free builds come under terms that disclaim warranties and support obligations; its roadmap dates are for paid Azul Core.
October showed how builders differ under pressure. Corretto shipped 21.0.13.0.11 on 24 October for CVE-2026-114820, scored 9.1. Microsoft's notes list 21.0.13.0.2 as its final October build. Adoptium respun its pipelines for the fix and announced Temurin 21.0.13+9 on 30 October. Trust stores differ too: Temurin uses Mozilla's list and keeps emSign Root CA - G1, which Oracle removed, so test outbound TLS after any swap.
Microsoft's 21 and 25 builds are not certified on Alpine (musl), and Corretto lists Alpine Linux 3.21 or later for its musl builds, so check before swapping a slim container base.
Migration checklist: replacing Oracle JDK 21 with an OpenJDK 21 build
- Inventory every runtime across servers, containers, CI agents, VM images and managed desktops.
- Classify each install: production or not, and any exemption (subscription, Oracle Cloud, Oracle product, Schedule A or B, vendor-bundled).
- Pick one target per platform, for example Corretto on AWS, Microsoft's build on Azure, Temurin elsewhere.
- Swap like for like on the same feature version, which avoids language and API changes. AWS calls Corretto a drop-in replacement unless you use features not in OpenJDK, so check for Oracle-only components such as Jipher, its FIPS cryptography provider.
- Rebuild container images on the new base, such as
amazoncorretto:21oreclipse-temurin:21, and pin by digest.
- Fix pipelines that download Oracle JDK, and add a CI check that fails if
java -versionreports the Oracle product line.
- Run regression and load tests, comparing GC logs, startup times and TLS connections against the Oracle baseline.
- Remove Oracle JDK 21.0.13 and later from production, and record what was removed, where and when.
- Patch on the new cadence: quarterly releases plus monthly security builds when they appear.
- Schedule JDK 25, noting that Java 29 is planned as the next LTS in September 2027.
Notes for teams in India, the UK, the EU and the US
The contractor clause reaches across borders. Staff of your outsourcers and consultants count if they support your internal business operations, so a UK or US company with an Indian delivery partner may need to count that partner's assigned team. Indian IT services firms and global capability centres with large vendor populations should model the count both ways before talking to Oracle. Prices are listed in US dollars, so ask Oracle about local currency and tax.
Teams in India should also check certificates. Oracle's October builds distrust the eMudhra intermediates it describes as compromised and remove the emSign roots and the Comodo AAA root, so TLS sessions and strict signed-JAR checks can fail on affected chains. Test partner integrations that rely on those certificates before rolling out a current JDK.
If your Java services run on Kubernetes, the runtime swap fits into the cluster upgrades many teams face in 2027; our Kubernetes 2027 upgrade calendar lists those dates.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development services team runs Java runtime inventories and like-for-like moves from Oracle JDK to OpenJDK builds, alongside your legal and procurement teams. Talk to us at /contact-us/.
Last updated: 1 November 2026.
