libheif-js 1.23.2 -- HEIC/HEIF decoder (WebAssembly build of libheif), used by convert.shinobitools.com ================================================================================================ What this is libheif-js is an Emscripten (WebAssembly) build of libheif 1.23.2, which bundles libde265 (HEVC decoder). It runs INSIDE YOUR BROWSER (in a Web Worker started by /heic-worker.js). Your photos are never uploaded to a server for decoding. Licence libheif and libde265 are licensed under the GNU Lesser General Public License v3.0 (LGPL-3.0). The libheif-js wrapper is LGPL-3.0 too. LICENSE.txt LGPL-3.0 and GPL-3.0 texts, as shipped by libheif ("COPYING") LICENSE-libheif-js-wrapper.txt LGPL-3.0 text, as shipped in the libheif-js npm package Copyright (c) struktur AG, Dirk Farin and the libheif / libde265 contributors; libheif-js wrapper by Kiril Vatev and contributors. The files in this folder are the UNMODIFIED files of the npm package (we changed nothing; see below for what the package itself does to libheif.js) libheif.js = libheif-js@1.23.2 libheif-wasm/libheif.js (JS glue, not merged into any other file) libheif.wasm = libheif-js@1.23.2 libheif-wasm/libheif.wasm (the WebAssembly binary) package.json = libheif-js@1.23.2 package.json (provenance) SHA-256 libheif.js f148d9ff173e5a6d6781e80dccb8336f54bfbb032392ceb2d37e0e92923c4bf3 SHA-256 libheif.wasm e4aa8333fbe55ec7c6c776f735236f40bed9103188498f8131d4e52b73cdfee8 Package: https://registry.npmjs.org/libheif-js/-/libheif-js-1.23.2.tgz npm integrity sha512-qvHIXtggEsw1lCNCWBYKloL2Z36DJBm0R9ThGiH2JnhKYdeZFLPFkP30Lw4yMskxxhx0bKg1gLrBHX1D2w2pSw== sha1 185691289ccfefe813e4b7f84ac4f84f24abb064 No changes were made by us. Our own code is in separate files (/heic-worker.js, /heic-decode.js). Emscripten / musl notice libheif.js and libheif.wasm were built with Emscripten 3.1.61 and can contain Emscripten runtime code and parts of musl libc (MIT / NCSA). Their licence texts are in EMSCRIPTEN-NOTICE.txt in this folder. So "everything in the library is LGPL" would be too broad: the decoding code (libheif, libde265) is LGPL-3.0, the Emscripten runtime parts are MIT/NCSA. This inventory comes from the build script and the strings in the binary, not from a full audit of the compiled binary. Complete corresponding source -- copies hosted by us, in /vendor/libheif-js/source/ These are the archives exactly as GitHub serves them for the tags/commit below (GitHub archives do not contain submodules, so libheif and libde265 are separate files). Kept here permanently, so the source stays available even if GitHub changes. SHA-256 of the files as we hold them: source/libheif-js-1.23.2.tar.gz a52f4570a2c479db9875fd3d082748e41ed69057c77b81bc8bac7a689feab259 libheif-js wrapper + packaging, tag 1.23.2 (no "v"), commit 6ca00b818c0ff51cb2a5c75b9ce97d708083335a source/libheif-emscripten-v1.23.2.tar.gz 1b1b71e8b34ccc2b9ba490d769172ad855c279efdc787d8ea7a901af177ebcab build recipe, tag v1.23.2, commit dd5a19b878149437a5a427f6e1afa8bac624a714 (.github/workflows/emscripten.yml, dist-prep.sh; its "libheif" folder is a submodule = the next file) source/libheif-ac1cb05c39008f01525c991ff8b88f84ddf70fd2.tar.gz 36c9b259386f1ffb3ed12d7ca01664fde8ef03802ded750de17db53303b099e7 libheif 1.23.2, commit ac1cb05c39008f01525c991ff8b88f84ddf70fd2 (includes build-emscripten.sh, scripts/install-ci-linux.sh, scripts/prepare-ci.sh, scripts/run-ci.sh) source/libde265-1.0.15-release.tar.gz 00251986c29d34d3af7117ed05874950c875dd9292d016be29d3b3762666511d libde265 1.0.15 release tarball (v1.0.15, includes the generated ./configure); this is the exact file libheif's build-emscripten.sh downloads (releases/download/v1.0.15/libde265-1.0.15.tar.gz) source/libde265-v1.0.15.tar.gz d4e55706dfc5b2c5c9702940b675ce2d3e7511025c6894eaddcdbaf0b15fd3f3 libde265 git tag v1.0.15, commit 17bb8d9fcea62db8cdeb0fc7ef8d15dbd19a22e4 (plain repository archive, without the generated configure script) Checked on 26 Sep 2026 against the GitHub API: tag 1.23.2 of libheif-js -> commit 6ca00b8...; tag v1.23.2 of libheif-emscripten -> commit dd5a19b..., whose "libheif" submodule points to ac1cb05c39008f01525c991ff8b88f84ddf70fd2; tag v1.0.15 of libde265 -> commit 17bb8d9.... The commit id recorded inside each of the four repository archives (git get-tar-commit-id) matches the commit named above. The libde265 release tarball (libde265-1.0.15-release.tar.gz) is a release file, not a git archive, so it carries no such id; its sha256 is listed above. Not checked: that the published libheif.js / libheif.wasm were built from exactly these sources (that is what the rebuild steps below are for; we did not run them). Same sources on GitHub (for reference) https://github.com/catdad-experiments/libheif-js/tree/1.23.2 https://github.com/catdad-experiments/libheif-emscripten/tree/v1.23.2 https://github.com/strukturag/libheif/tree/ac1cb05c39008f01525c991ff8b88f84ddf70fd2 https://github.com/strukturag/libde265/tree/v1.0.15 npm: https://registry.npmjs.org/libheif-js/-/libheif-js-1.23.2.tgz (see the hashes above) How to rebuild the binaries yourself These steps are copied from .github/workflows/emscripten.yml of libheif-emscripten v1.23.2 (target "wasm") and the scripts it calls; we have not run them ourselves. Needs Linux (the CI uses Ubuntu 22.04), Node.js, git, curl, cmake, make, autotools and a C++ toolchain. # 1. sources: libheif-emscripten v1.23.2 with its libheif submodule git clone https://github.com/catdad-experiments/libheif-emscripten cd libheif-emscripten git checkout v1.23.2 git submodule update --init --recursive # libheif = ac1cb05c39008f01525c991ff8b88f84ddf70fd2 # (or unpack source/libheif-emscripten-v1.23.2.tar.gz and put the contents of # source/libheif-ac1cb05c39008f01525c991ff8b88f84ddf70fd2.tar.gz in its "libheif" folder) # 2. tools (the CI uses Node 24 and TypeScript 5) npm install -g typescript@5 export EMSCRIPTEN_VERSION=3.1.61 cd libheif ./scripts/install-ci-linux.sh # installs Emscripten 3.1.61 into ./emscripten/emsdk (run from the libheif directory; uses sudo apt-get on Ubuntu 22.04) ./scripts/prepare-ci.sh # 3. build (target wasm: same run-ci.sh, with these two substitutions) sed -e 's/USE_WASM=0/USE_WASM=1 USE_UNSAFE_EVAL=0/g' -e 's/USE_TYPESCRIPT=0/USE_TYPESCRIPT=1/g' \ ./scripts/run-ci.sh > ./scripts/run-ci-wasm.sh chmod +x ./scripts/run-ci-wasm.sh ./scripts/run-ci-wasm.sh cd .. # 4. collect the output ./dist-prep.sh wasm # -> dist/libheif.js, libheif.wasm, libheif.d.ts, LICENSE What step 3 does: run-ci.sh (with EMSCRIPTEN_VERSION set) runs libheif's build-emscripten.sh, which downloads libde265 1.0.15 from https://github.com/strukturag/libde265/releases/download/v1.0.15/libde265-1.0.15.tar.gz (same file as source/libde265-1.0.15-release.tar.gz), builds it with emconfigure/emmake, then builds libheif with emcmake (defaults: libde265 on; AOM, WebCodecs, uncompressed codec and OpenJPEG off) and links libheif.js + libheif.wasm with emcc -O3 (-sMODULARIZE, EXPORT_NAME=libheif, -sDYNAMIC_EXECUTION=0). To use our copy of libde265 instead of downloading it: put source/libde265-1.0.15-release.tar.gz into the libheif directory as libde265-1.0.15.tar.gz before step 3 (the build script downloads the same file name, so an existing copy is not fetched again; if your checkout of the script differs, adjust the download line). We have not run this either. The workflow also builds a "js" target; we use only the "wasm" one. The libheif-js package then produces our two files (scripts/install.js of libheif-js 1.23.2, run by `npm run fetch` after `npm install` in the unpacked source/libheif-js-1.23.2.tar.gz): it takes the libheif-emscripten release files (libheif.tar.gz, the "libheif-wasm" folder from the build above), and runs every .js file through esbuild (minify, target es2019). So libheif.js in this folder is the Emscripten output after that esbuild step (that is why it is minified and has no header); libheif.wasm is copied unchanged. To reproduce it: `npm install && node scripts/install.js ` (install.js accepts a local tarball as its first argument; the tarball holds the folders "libheif" and "libheif-wasm" made by the workflow's release step), then take libheif-wasm/libheif.js and libheif-wasm/libheif.wasm. The esbuild version comes from the package's own dependencies. We cannot promise a rebuild gives a bit-for-bit identical file (compiler and download versions). How to replace the library with your own version (LGPL section 4) This site loads the library as two separate, unmerged files: /vendor/libheif-js/libheif.js and /vendor/libheif-js/libheif.wasm (/heic-worker.js: importScripts('/vendor/libheif-js/libheif.js') and locateFile -> /vendor/libheif-js/). Replace BOTH files with your own build and the converter uses them. The build must keep this interface, which is all that /heic-worker.js uses: - a global factory function libheif(options) (Emscripten MODULARIZE, EXPORT_NAME=libheif) that takes options.locateFile(name), options.onRuntimeInitialized and options.onAbort and returns the module object; libheif.js finds libheif.wasm through locateFile('libheif.wasm') - module.HeifDecoder: new HeifDecoder(); decoder.decode(uint8array) -> array of images; the property decoder.decoder (the heif_context handle) - per image: is_primary(), get_width(), get_height(), has_alpha_channel(), display({data: Uint8ClampedArray(width*height*4), width, height}, callback(result)) which fills the RGBA buffer and calls callback with a truthy value on success, and free() - module.heif_context_free(handle) Practically: save the page and these files, put your build next to them, and serve the folder yourself (for example `python3 -m http.server`); or use your browser's local-override / request-rewrite feature to serve your own file at the same URL. Your rights under LGPL-3.0 (section 4) You may modify the library for your own use and you may reverse-engineer it to debug those modifications. Nothing on this site, in its terms or in any other agreement with us limits that. Other files EMSCRIPTEN-NOTICE.txt MIT / NCSA / musl licence texts for the Emscripten runtime parts source/ source archives (see above) /open-source.html human-readable notice with the same information