Open-source licences
Last updated: 5 October 2026
Kathaleaf is built with open-source software. Most of it is part of the app's own code under permissive licences (MIT, BSD, ISC, Apache-2.0). One component, the HEIC decoder, is under the GNU Lesser General Public License and is handled separately, as described below.
libheif and libde265 — HEIC decoder (LGPL-3.0)
When you add an iPhone photo (HEIC) and your browser cannot open it itself, Kathaleaf loads libheif-js version 1.23.2: a WebAssembly build of libheif and libde265. It runs in your browser only; your photo is never sent anywhere to be converted.
- The file, served unmodified and only when needed:
/vendor/libheif/1.23.2/libheif-bundle.mjs(SHA-256d05292271af008d300cc75be374feb8fd35b418a71420a556c3fb817f662b502) - Licence texts: libheif and libde265 (LGPL-3.0) and libheif-js (LGPL-3.0).
- Source and build recipe for this exact version: the Emscripten build of libheif and libde265, libheif-emscripten v1.23.2; the JavaScript packaging, libheif-js at 6ca00b8 (npm libheif-js@1.23.2), from which our file is copied byte for byte. You can also ask us for the source through the contact page.
Using your own build of the decoder
The LGPL lets you run Kathaleaf with a modified version of the library. Kathaleaf loads the decoder at run time from the path above and only calls its HeifDecoder interface, so any build of libheif-js that exposes the same interface works:
- Build libheif-js (or modify libheif/libde265 and build it) to a single ES module that, like
libheif-bundle.mjs, exports a function returning the library. - Serve your file in place of ours: in Chrome or Edge, DevTools → Sources → Overrides lets you replace
/vendor/libheif/1.23.2/libheif-bundle.mjswith your own file; in a self-hosted copy of Kathaleaf, put it inui/public/vendor/libheif/<version>/(the scriptui/scripts/vendor-libheif.mjsdoes this from the npm package) and setLIBHEIF_VERSIONandLIBHEIF_SHA256inui/lib/local/heicVersion.ts. - Kathaleaf checks the decoder's SHA-256 before running it, so a copy changed by anyone else is refused. To run yours on this site, tell your own browser its hash: in the DevTools console, run
localStorage.setItem("folio.libheifSha256", "<your file's SHA-256, in hex>"). (Remove it to go back to ours.) - Reload Kathaleaf and add a HEIC photo.
Print colour — colour engine and press profile
When you export a print PDF, Kathaleaf converts each page to CMYK in your browser with its own WebAssembly module, built from Little CMS (MIT) and libjpeg-turbo (IJG, BSD-3-Clause and zlib licences) with Emscripten (MIT) and its musl C library (MIT). Licence texts: Little CMS, libjpeg-turbo (and the IJG notice), Emscripten, musl.
The press colour profile embedded in every CMYK PDF is Kathaleaf's own, built from the FOGRA39 characterisation data by Fogra, which Fogra allows to be used and redistributed freely. “FOGRA39” names that reference data only; the profile is not certified or endorsed by Fogra. File: /vendor/icc/folio-fogra39-5bfbe4308861181c.icc (SHA-256 5bfbe4308861181c149d11174683d74724faaa2bff2be31448736918d87905b0); source, terms and build recipe: NOTICE.
Fonts (SIL Open Font License 1.1)
Kathaleaf serves its own copies of these typefaces, taken from the google/fonts repository. Each is free software under the SIL Open Font License 1.1; the licence text and copyright for each family is linked below and is also kept inside every font file. Lato, Quicksand, Comfortaa, Dancing Script and Lobster are served unmodified; the others are reduced to the Latin characters Kathaleaf uses. How each file was made, with its source and SHA-256, is recorded in ui/app/fonts/NOTICE.md in Kathaleaf's source.
- Inter — licence (OFL.txt)
- EB Garamond — licence (OFL.txt)
- Noto Serif — licence (OFL.txt)
- Lato — licence (OFL.txt)
- Manrope — licence (OFL.txt)
- Cabin — licence (OFL.txt)
- Quicksand — licence (OFL.txt)
- Comfortaa — licence (OFL.txt)
- Jura — licence (OFL.txt)
- Dancing Script — licence (OFL.txt)
- Lobster — licence (OFL.txt)
Other components used on your device
- exifr (MIT) — reads the date a photo was taken.
- @noble/hashes (MIT) — fingerprints each photo (SHA-256) so the same photo is not added twice.
- @noble/curves (MIT) — the Ed25519 key that proves, without revealing it, that your device holds your backup's key.
- @simplewebauthn/browser (MIT) — passkey sign-in, loaded only when you use a passkey.
- go-webauthn (BSD-3-Clause) — checks passkeys on Kathaleaf's server.