cryptography safe for commercial use?PyPI package · License: Apache-2.0 OR BSD-3-Clause
cryptography is licensed under Apache-2.0 OR BSD-3-Clause, which imposes no source-disclosure obligation in any of the shipping models below.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Distributed binary / app | No obligation | This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Delivered to customer | No obligation | This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Internal use only | No obligation | This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Published library | No obligation | This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
AttributionNOTICE filePatent grant
If you only use it at build time, the answer changes.
This package offers a choice of licenses. The least restrictive option is shown. Apache-2.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
This page covers one package. Your requirements.txt has many more.
Check your whole manifest →The license was read from the PyPI registry, then evaluated against each shipping model. Only the declared license is considered; code copied into a project's own source files is not detected by this method.
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.