# Licenses and credits

> Everything StartPrivate sends to your browser from other projects is under permissive terms without copyleft: mostly MIT, Apache-2.0, BSD-style and ISC code, a few similar notices (zlib, libpng, libjpeg, libtiff, Unicode) inside the WebAssembly engines, ODC-BY data, and the EFF word list under Creative Commons Attribution. Each item is hosted on this site at the fixed version listed below, the full license texts are in one plain-text file, and no web fonts are loaded at all.

## How components are delivered

Everything listed here is served from startprivate.com itself at a fixed version; no library, model or font is fetched from another server. Files load only on the pages that need them, and the large ones (face model, OCR engine, Content Credentials reader) only when you press the button that uses them. Script files carry content hashes in their names and Subresource Integrity checks where the browser supports them. The [methodology page](/methodology/) explains how to see these downloads in your browser's Network panel.

## Libraries and models

| Component | Version | License | Used for | Source |
|---|---|---|---|---|
| exifr | 7.1.3 | MIT | Reading EXIF values for the "what is in this file" report, the EXIF viewer and the photo date tool | [github.com/MikeKovarik/exifr](https://github.com/MikeKovarik/exifr) |
| fflate | 0.8.3 | MIT | Opening and repacking Word, Excel and PowerPoint files | [github.com/101arrowz/fflate](https://github.com/101arrowz/fflate) |
| Open XML SDK schema data | commit 431ab05 | MIT, © .NET Foundation and Contributors | The list of element and attribute names that the Word, Excel and PowerPoint cleaner checks a cleaned file against; this site's table is generated from it | [github.com/dotnet/Open-XML-SDK](https://github.com/dotnet/Open-XML-SDK) |
| IANA Language Subtag Registry | file of 2026-09-17 | CC0 1.0 (public domain dedication) | The list of language, script and region codes that the Word, Excel and PowerPoint cleaner checks the language tags of a cleaned file against | [iana.org/assignments/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry) |
| @contentauth/c2pa-web | 0.15.3 | MIT | Reading Content Credentials (C2PA), offline | [github.com/contentauth/c2pa-js](https://github.com/contentauth/c2pa-js) |
| c2pa-rs and the Rust crates it uses (compiled into the C2PA reader's WebAssembly) | c2pa 0.91.0 and 231 other crates, as built into @contentauth/c2pa-wasm 0.13.2 | c2pa: MIT or Apache-2.0, used under MIT. The crates: MIT, Apache-2.0 or BSD-3-Clause (where a crate offers a choice, MIT is used), and Unicode-3.0 for the ICU4X text libraries | The C2PA parsing and signature checks | [github.com/contentauth/c2pa-rs](https://github.com/contentauth/c2pa-rs); every crate is listed in the full texts below |
| TensorFlow.js core (@tensorflow/tfjs-core) | 4.22.0 | Apache-2.0 | The math operations this site uses to run the face model | [github.com/tensorflow/tfjs](https://github.com/tensorflow/tfjs) |
| TensorFlow.js WebAssembly backend (@tensorflow/tfjs-backend-wasm, with shared kernels from @tensorflow/tfjs-backend-cpu) | 4.22.0 | Apache-2.0; its WebAssembly file is built with XNNPACK (BSD-3-Clause), pthreadpool and cpuinfo (BSD-2-Clause), FP16, FXdiv and psimd (MIT) | Running the face model on your processor (no WebGL needed) | [github.com/tensorflow/tfjs](https://github.com/tensorflow/tfjs), [github.com/google/XNNPACK](https://github.com/google/XNNPACK) |
| YuNet face detection model, file face_detection_yunet_2023mar | 2023mar | MIT, © 2020 Shiqi Yu | Finding faces for the redaction tools | [OpenCV Zoo: face_detection_yunet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) |
| tesseract.js | 7.0.0 | Apache-2.0 | Running OCR for Find text | [github.com/naptha/tesseract.js](https://github.com/naptha/tesseract.js) |
| tesseract.js-core | 7.0.0 | Apache-2.0; the libraries compiled in with it: Tesseract 5.3.0 (Apache-2.0), Leptonica 1.83 (BSD-2-Clause), libwebp 1.2.2 (BSD-3-Clause), giflib 5.1 (MIT), libjpeg 9a (Independent JPEG Group license), libpng 1.6.38 (libpng license), libtiff 4.3.0 (libtiff license), zlib 1.2.12 (zlib license) and OpenLibm 0.8 (MIT, BSD-2-Clause and ISC terms, Sun's FDLIBM notice, and some public-domain files) | The Tesseract OCR engine compiled to WebAssembly | [github.com/naptha/tesseract.js-core](https://github.com/naptha/tesseract.js-core) |
| English OCR model, via @tesseract.js-data/eng | 1.0.0 (tessdata 4.0.0, best, integer) | Apache-2.0 for the trained data; the npm packaging is MIT | Recognizing Latin letters and digits | [github.com/tesseract-ocr/tessdata_best](https://github.com/tesseract-ocr/tessdata_best), packaged at [github.com/naptha/tessdata](https://github.com/naptha/tessdata) |
| zxing-wasm (reader) | 3.1.5 | MIT for the JavaScript, Apache-2.0 for its C++ glue; built from ZXing-C++ 3.1.1 (Apache-2.0) with libzueci (BSD-3-Clause) and stb_image (MIT or Unlicense, used under MIT) | Finding QR, Data Matrix, Aztec and PDF417 codes | [github.com/Sec-ant/zxing-wasm](https://github.com/Sec-ant/zxing-wasm), [github.com/zxing-cpp/zxing-cpp](https://github.com/zxing-cpp/zxing-cpp) |
| hash-wasm | 4.12.0 | MIT; of the C code inside, MD5 and SHA-1 are public domain, SHA-256/512 carry the 0BSD permission notice, which sets no conditions, BLAKE2b is used under CC0, and Argon2 builds on Go's BSD-3-Clause code | SHA-2, SHA-1 and MD5 for the file hash checker; Argon2id for text encryption | [github.com/Daninet/hash-wasm](https://github.com/Daninet/hash-wasm) |
| @zxcvbn-ts/core | 4.2.0 | MIT | Password strength estimates | [github.com/zxcvbn-ts/zxcvbn](https://github.com/zxcvbn-ts/zxcvbn) |
| @zxcvbn-ts/language-common | 4.1.3 | MIT | Common passwords, keyboard layouts and the EFF word list for the strength checker | same repository |
| @zxcvbn-ts/language-en | 4.1.1 | MIT; commonWords data ODC-BY (see below) | English common words, first names, last names and word sequences for the strength checker | same repository |

Small helper packages are bundled along with some of these and carry their own permissive licenses: with TensorFlow.js, long 4.0.0 (Apache-2.0); inside the OCR worker that tesseract.js 7.0.0 ships prebuilt, buffer 6.0.3, base64-js 1.5.1, bmp-js 0.1.0, is-url 1.2.4, regenerator-runtime 0.13.11 and zlib.js 0.3.1 (MIT), ieee754 1.2.1 (BSD-3-Clause), and idb-keyval 6.2.1 and wasm-feature-detect 1.8.0 (Apache-2.0); with zxcvbn-ts, fastest-levenshtein (MIT) and @zxcvbn-ts/dictionary-compression (MIT); with the C2PA reader, highgain (ISC) and code from @contentauth/c2pa-utilities (MIT). The face finder runs on this site's own implementation of the YuNet network written with TensorFlow.js operations.

The three WebAssembly files built with Emscripten (face finder backend, OCR engine, code reader) also contain parts of its runtime: Emscripten's own code (MIT or NCSA, used under MIT), musl libc (MIT), and LLVM's libc++, libc++abi and compiler-rt (Apache-2.0 with LLVM exceptions).

## Full license texts

The copyright notices and complete license texts for every component on this page, including each Rust crate inside the Content Credentials reader, are collected in one plain-text file: [third-party.txt](/licenses/third-party.txt). The site's build refuses to finish if it bundles anything that file does not cover.

This software is based in part on the work of the Independent JPEG Group.

## EFF Large Wordlist

The passphrase generator and the Diceware page use the **EFF Large Wordlist** for passphrases, a list of 7,776 words published by the Electronic Frontier Foundation in 2016 and designed for memorable, easy-to-type passphrases rolled with five dice. The list is used unchanged. The same list is also one of the dictionaries the password strength checker knows, through @zxcvbn-ts/language-common.

Credit: "EFF Large Wordlist" by the [Electronic Frontier Foundation](https://www.eff.org/dice), from [eff.org/dice](https://www.eff.org/dice) and the [2016 announcement of the new wordlists](https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases).

License: EFF's [copyright page](https://www.eff.org/copyright) currently states that original material on the EFF website may be freely distributed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) (Creative Commons Attribution 4.0 International), unless otherwise noted. The license badge on that same page still links to the [CC BY 3.0 United States](https://creativecommons.org/licenses/by/3.0/us/) license. Both are attribution licenses, and the credit above is given to meet either.

## OpenSubtitles word frequencies (ODC-BY)

The English common-words list in @zxcvbn-ts/language-en (commonWords.json) is a processed derivative (tokenized, frequency-counted, normalized and filtered) of the **OpenSubtitles 2024** dataset, provided by Helsinki-NLP through [OPUS](https://opus.nlpl.eu/). The dataset is licensed under the [Open Data Commons Attribution License (ODC-BY)](https://opendatacommons.org/licenses/by/), and the original data is attributed to the subtitle contributors and rights holders. The strength checker uses this list to recognize ordinary English words in passwords.

## Fonts and icons

No web fonts are loaded. Text uses the fonts already installed on your device. The logo and icons are drawn for this site and contain no third-party artwork.

## Tools used only to build and test the site

These never reach your browser and are listed for completeness: esbuild (MIT), TypeScript (Apache-2.0), marked (MIT), Vitest (MIT), Wrangler (MIT or Apache-2.0) and Playwright (Apache-2.0), plus ExifTool, FFmpeg and LibreOffice run separately to check the tools' output.

## Corrections

If you maintain one of these projects and something here is wrong or missing, write to [hello@startprivate.com](mailto:hello@startprivate.com) and it will be fixed.

Last updated: 2026-10-16