What is SPDX?

SPDX (Software Package Data Exchange) is a standardized format for communicating software licensing information. It defines a list of official license identifiers — short, unique codes like MIT, GPL-3.0-only, or Apache-2.0 — that unambiguously identify open-source and proprietary licenses.

Using SPDX identifiers instead of free-text license names eliminates ambiguity. For example, "GPL" could mean version 2 or 3, but GPL-2.0-only and GPL-3.0-only are precise. SPDX is widely adopted in package managers (npm, PyPI, Maven), legal compliance tools, and software bill of materials (SBOM) standards.

Tool description

This tool validates and looks up SPDX license identifiers. Enter a license ID to check whether it is valid, current, or deprecated. It also provides a searchable list of all known SPDX identifiers with their status, making it easy to find the correct identifier for your project.

Examples

Input: MIT

Output:

  • Status: Valid
  • Description: MIT License — a permissive, short license that allows reuse with attribution

Input: GPL-2.0

Output:

  • Status: Deprecated
  • Description: Use GPL-2.0-only or GPL-2.0-or-later instead

Input: Apache-2.0

Output:

  • Status: Valid
  • Description: Apache License 2.0 — a permissive license with explicit patent grant

Features

  • Instant validation of any SPDX license identifier
  • Distinguishes between valid, deprecated, and unknown identifiers
  • Searchable list of all current and deprecated SPDX identifiers

How it works

The tool references the official SPDX license identifier list (from the spdx-license-ids package). When you enter an identifier, it performs a case-insensitive lookup against both current and deprecated lists. If found in the deprecated list, it flags the identifier and suggests the correct replacement.

Tips

  • Use npm license or license-checker to audit your project's dependencies against SPDX IDs
  • Prefer -only or -or-later suffixed identifiers over bare version numbers
  • Check the deprecated list if you're migrating an older project to modern SPDX compliance