Open-source licences
Last updated: 26 September 2026
Converting a HEIC photo here happens inside your own browser, and your photo is not uploaded for it. To do that, your browser downloads a small open-source program that reads HEIC. This page gives its licence, where its source code is, and how you can rebuild or replace it.
In short: the decoder is licensed under the LGPL-3.0, we did not change it, you can download the source we believe it was built from, from this site (below we say what we have and have not verified), and you are free to modify it, replace it and reverse-engineer it for your own use.
What we ship to your browser
- libheif-js 1.23.2: an Emscripten (WebAssembly) build of libheif 1.23.2, with the libde265 1.0.15 HEVC decoder inside. Licence of libheif, libde265 and the libheif-js wrapper: GNU Lesser General Public License v3.0 (LGPL-3.0). Copyright struktur AG, Dirk Farin and the libheif / libde265 contributors; libheif-js wrapper by Kiril Vatev and contributors.
- The files were built with Emscripten 3.1.61 and can contain Emscripten runtime code and parts of the musl C library. Those parts are not LGPL: they are under the MIT / NCSA licences, reproduced in EMSCRIPTEN-NOTICE.txt. This list comes from the build script and the strings in the binary, not from a full audit of the compiled file.
- Our own small files, /heic-worker.js and /heic-decode.js, are plain, readable JavaScript (not minified). They call the library; they do not contain it.
Files and licence texts
The library is delivered as separate files, exactly as its authors published them in the npm package (we changed nothing, and the files are not merged into any other script):
- /vendor/libheif-js/libheif.js (JavaScript glue) and /vendor/libheif-js/libheif.wasm (the decoder)
- /vendor/libheif-js/LICENSE.txt: the full LGPL-3.0 and GPL-3.0 texts as shipped with libheif
- /vendor/libheif-js/LICENSE-libheif-js-wrapper.txt: the LGPL-3.0 text shipped with the libheif-js package
- /vendor/libheif-js/EMSCRIPTEN-NOTICE.txt: MIT / NCSA / musl licence texts for the Emscripten runtime parts
- /vendor/libheif-js/SOURCE.txt: versions, checksums, source links, build and replacement instructions (the same information as below)
SHA-256 of the two binaries:
- libheif.js:
f148d9ff173e5a6d6781e80dccb8336f54bfbb032392ceb2d37e0e92923c4bf3 - libheif.wasm:
e4aa8333fbe55ec7c6c776f735236f40bed9103188498f8131d4e52b73cdfee8
Source code, hosted here
The complete corresponding source is kept on this site, so you do not depend on GitHub. GitHub does not include submodules in its archives, so libheif and libde265 are separate files. Each file below is the archive as GitHub serves it for the tag or commit shown.
- libheif-js-1.23.2.tar.gz: the wrapper and packaging, tag
1.23.2(commit6ca00b818c0ff51cb2a5c75b9ce97d708083335a).
SHA-256a52f4570a2c479db9875fd3d082748e41ed69057c77b81bc8bac7a689feab259 - libheif-emscripten-v1.23.2.tar.gz: the build recipe, tag
v1.23.2(commitdd5a19b878149437a5a427f6e1afa8bac624a714).
SHA-2561b1b71e8b34ccc2b9ba490d769172ad855c279efdc787d8ea7a901af177ebcab - libheif-ac1cb05c39008f01525c991ff8b88f84ddf70fd2.tar.gz: libheif 1.23.2, the submodule that libheif-emscripten pins, commit
ac1cb05c39008f01525c991ff8b88f84ddf70fd2.
SHA-25636c9b259386f1ffb3ed12d7ca01664fde8ef03802ded750de17db53303b099e7 - libde265-1.0.15-release.tar.gz: the libde265 1.0.15 release file that libheif's build script downloads (it includes the generated
configurescript).
SHA-25600251986c29d34d3af7117ed05874950c875dd9292d016be29d3b3762666511d - libde265-v1.0.15.tar.gz: the same version as a plain repository archive, tag
v1.0.15(commit17bb8d9fcea62db8cdeb0fc7ef8d15dbd19a22e4).
SHA-256d4e55706dfc5b2c5c9702940b675ce2d3e7511025c6894eaddcdbaf0b15fd3f3
The same sources on GitHub: libheif-js (tag 1.23.2), libheif-emscripten (tag v1.23.2), libheif (commit ac1cb05) and libde265 (tag v1.0.15). The package is also on npm (sha1 185691289ccfefe813e4b7f84ac4f84f24abb064). We made no changes to any of it.
Build it yourself
These steps come from the build workflow of libheif-emscripten v1.23.2 (.github/workflows/emscripten.yml, the “wasm” target). We copied them from the repository and have not run them ourselves. You need a clean Ubuntu 22.04 machine (the install script runs sudo apt-get and installs and removes packages), Node.js 24, git, curl, cmake, make and a C++ toolchain.
git clone https://github.com/catdad-experiments/libheif-emscripten
cd libheif-emscripten
git checkout v1.23.2
git submodule update --init --recursive # libheif at ac1cb05c39008f01525c991ff8b88f84ddf70fd2
npm install -g typescript@5
export EMSCRIPTEN_VERSION=3.1.61
cd libheif
./scripts/install-ci-linux.sh # installs Emscripten 3.1.61
./scripts/prepare-ci.sh
sed -e 's/USE_WASM=0/USE_WASM=1 USE_UNSAFE_EVAL=0/g' -e 's/USE_TYPESCRIPT=0/USE_TYPESCRIPT=1/g' \
./scripts/run-ci.sh > ./scripts/run-ci-wasm.sh
chmod +x ./scripts/run-ci-wasm.sh
./scripts/run-ci-wasm.sh # also downloads and builds libde265 1.0.15
cd ..
./dist-prep.sh wasm # result: dist/libheif.js, dist/libheif.wasm
The libheif-js package then runs the .js file through esbuild (minify, target es2019) with its scripts/install.js; that is why our libheif.js is minified. SOURCE.txt explains this step too. A rebuild is not guaranteed to be bit-for-bit identical to the files we ship.
Replace the library with your own version
The converter loads libheif.js and libheif.wasm as two separate files from /vendor/libheif-js/, through /heic-worker.js. To use your own build, replace both files, keeping the same names and folder. Your build must offer the interface that /heic-worker.js uses:
- a global function
libheif(options)(Emscripten MODULARIZE, namelibheif) that acceptslocateFile,onRuntimeInitializedandonAbortand returns the module;libheif.jsfindslibheif.wasmthroughlocateFile new module.HeifDecoder(), itsdecode(bytes)(returns a list of images) and itsdecoderproperty- per image:
is_primary(),get_width(),get_height(),has_alpha_channel(),display({data, width, height}, callback)andfree() module.heif_context_free(handle)
Practically: save the page and these files, put your build in the same place and serve that folder yourself (for example with python3 -m http.server), or use your browser's local-override feature to serve your own file at the same address.
Your rights
You may modify the library for your own use, and you may reverse-engineer it to debug those modifications. Nothing on this site or in its terms limits that.
Earlier decoder
Until 26 September 2026 this site used the heic2any library (version 0.0.4, MIT licence) for HEIC files. It is no longer used and the licence above does not concern it: the decoder we ship now is the LGPL-3.0 libheif-js described on this page. We replaced heic2any because it changed the contrast and colours of many phone photos and could not read some newer HEIC files.
Questions
Use the feedback button on any page, or reach us through the contact page.