Skip to content
licensecompat checker

Scan a dependency tree for license conflicts

The checker answers one pair at a time. This answers a whole tree: which licenses your dependencies actually carry, whether they can be combined, and which package introduced each conflict. Everything runs in your browser — nothing is uploaded.

Paste a lockfile or a list of licenses to scan.

Where the license data comes from

An npm package-lock.json (v2 or v3) records a license for almost every package, which is why it can be scanned directly. A package.json lists only names and version ranges — no licenses — so it cannot, and neither can the lockfiles for pip, Cargo, or Go modules. Those ecosystems need an SBOM: a CycloneDX or SPDX file records a license per component, and this page reads both.

How to generate an SBOM for npm, pip, Cargo, and Go modules — one command each.

Checking a single pair instead? Use the checker or the full matrix.