Legal

Open source licenses

OnDevice original page templates, styles, and glue code are intended to be licensed under the MIT License (see the project LICENSE file). Third-party libraries keep their own terms. This page is about the code that is shipped to your browser.

libheif, libde265, and libheif-js (LGPL-3.0)

HEIC and HEIF decoding on browsers that cannot read those files natively is done withlibheif-js 1.23.5, an Emscripten / WebAssembly build of libheif 1.23.x that includes the libde265 HEVC decoder. libheif, libde265, and the libheif-js wrapper are licensed under the GNU Lesser General Public License v3.0 (LGPL-3.0). Copyright belongs to struktur AG, Dirk Farin, and their contributors, and to Kiril Vatev and contributors for the npm wrapper.

These files are served as a separate, replaceable pair — they are not merged into the rest of the site JavaScript:

/vendor/libheif-js/libheif.js (Emscripten glue)
/vendor/libheif-js/libheif.wasm (the decoder)
/vendor/libheif-js/LICENSE (LGPL-3.0 / GPL-3.0 texts as shipped with the package)
/vendor/libheif-js/SOURCE.txt (versions, checksums, source links, and replacement notes)

The worker at /workers/heic-worker.js is ordinary, readable JavaScript. It calls the library; it does not contain it. The library is loaded only after you choose a HEIC file that the browser cannot decode on its own.

Your rights, and how to replace the library

You may modify the LGPL library for your own use and reverse-engineer it to debug those modifications. To use your own build, keep the same file names and the interface documented in SOURCE.txt(a libheif(options) factory, locateFile, HeifDecoder, and the image methods the worker calls). You can save the site files and swap the two vendor files, or use a browser local override for that path.

Corresponding source for the versions we ship is listed in SOURCE.txt:strukturag/libheif,strukturag/libde265, andcatdad-experiments/libheif-js.

Emscripten runtime

The WebAssembly build is produced with Emscripten and may include Emscripten runtime code and parts of musl. Those portions are not LGPL; they are under MIT / NCSA-style terms used by Emscripten. See the notices shipped with libheif-js where present.

Other MIT / Apache / BSD dependencies

The static site is built with Astro (MIT). Batch ZIP download uses fflate (MIT). These are permissive licenses. They are not a substitute for the LGPL terms that apply to the HEIC decoder files.

WebP, AVIF, and JPEG XL fallback decoding uses jSquash modules@jsquash/webp 1.5.0, @jsquash/avif 2.1.1, and @jsquash/jxl 1.3.0 (Apache-2.0). Those packages ship WebAssembly codecs under BSD-style terms (libwebp from Google; libavif / AV1; libjxl). The WASM is loaded only when your browser cannot decode that format itself.

TIFF decoding uses UTIF.js 3.1.0 (MIT). Compressed TIFF streams may usepako (MIT and zlib). SVG fallback rendering uses canvg 4.0.3 (MIT) and its MIT-licensed helpers (stackblur-canvas, svg-pathdata, raf, rgbcolor). When the conversion worker has no built-in DOMParser, it uses @xmldom/xmldom 0.9.12 (MIT).

JPEG, PNG, and WebP metadata removal is implemented in this site’s own MIT-licensed worker: it drops EXIF, XMP, IPTC, and comment fields without re-encoding pixels when it can.

Libraries we did not ship

This site does not use heic2any. That package is often labeled MIT, but it embeds libheif, and the libheif author has stated that the wrapper, as published, does not meet the LGPL conditions (see heic2any issue 59).