Check Your Dependency Licenses
Paste a dependency manifest and instantly see each package's license and risk tier — permissive, weak-copyleft, or strong-copyleft.
Paste your manifest
Supports package.json, requirements.txt, composer.json, go.mod, Cargo.toml, Gemfile.lock, and more. Free plan checks up to 10 packages per manifest.
Press Cmd+Enter (Mac) or Ctrl+Enter (Windows/Linux) to check licenses
How it works
Paste the contents of a manifest or lockfile above — nothing is uploaded as a file, no account is required, and no project is created. GeekWala parses the text with the same manifest parsers its full scanner uses, then resolves each package's declared license from the registry metadata it already caches for scanning (falling back to the deps.dev API on a cache miss).
A license lookup needs one exact, published version. Packages pinned to a concrete version (from a lockfile) get a real lookup; a version range like ^1.2.0 (common inpackage.json) has no single answer, so those are classified Unknown without a lookup attempt. For the most complete results, paste a lockfile rather than a top-level manifest.
Results exist only for this request. Nothing is saved, so there's no history to manage and nothing to delete. Re-run the check anytime.
Supported manifests
Every format below is parsed by the same registry the full scanner uses, across GeekWala's 8 supported ecosystems.
License risk tiers explained
Each dependency is classified by matching its SPDX license identifier against a configured prefix map, not a full legal analysis.
MIT, Apache-2.0, BSD, ISC — safe to use with minimal obligations.
LGPL, MPL, EPL — obligations typically limited to modified files.
GPL, AGPL — may require distributing your source under the same license.
No license data resolved — review manually before relying on it.
Dual- or multi-licensed packages (an expression like (MIT OR Apache-2.0)) are classified Unknown today: GeekWala's classifier doesn't yet evaluate compound SPDX boolean expressions, so those need a manual look rather than an automatic pick of the more permissive option. This tool is a triage aid, not legal advice; read the license text itself before you rely on a risk tier for a compliance decision.
Frequently asked questions
Is this free?
Yes: no signup, up to 10 packages per manifest. Paste a manifest with more packages than that and the checker shows the first 10 and flags the rest as truncated.
Does GeekWala store what I paste?
No. The manifest text is parsed for this one request and discarded; no project, scan, or account is created, and nothing persists after you leave the page.
Why does a package show as "Unknown" even though it clearly has a license?
Two common causes: the version is a range rather than an exact pin (no single license to look up), or the license is a compound expression like (MIT OR Apache-2.0) that the classifier doesn't evaluate yet. Both are marked Unknown rather than guessed at.
Can I check more than 10 packages, or save the results?
Create a free account and add the packages as a project instead: GeekWala also scans the same dependencies for known vulnerabilities, tracked over time.
Want ongoing license + vulnerability monitoring?
GeekWala scans your dependencies for known vulnerabilities with EPSS and CISA KEV prioritization — save projects, track history, and get alerted on new issues.
Get Started Free