BSD-3-Clause is a permissive licence very close to MIT with one extra term: you may not use the names of the project or its contributors to endorse or promote products derived from it. It is common on infrastructure-grade code whose authors care about attribution being accurate rather than merely present.
Filed under the SPDX identifier GitHub reports for the repository,
not under what the README claims. NOASSERTION means a licence file
exists that GitHub could not match to an SPDX identifier — read it
before you depend on it.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
27400
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ungoogled-software/ungoogled-chromium
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-13 — 1 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-13
archived
false
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
75
created_at
2026-06-15
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/clearcotelabs/clearcote-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-02 — 12 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-02
archived
false
latest_release
v1.8.2 · 2026-08-02
license.spdx_id
BSD-3-Clause
stargazers_count
2500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/refraction-networking/utls
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ARCHIVED: archived = true, set 2025-05-01. A maintainer's own statement outranks every date rule.
Field
Value at this printing
pushed_at
—
archived
true
archived_at
2025-05-01
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
3100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/salesforce/ja3
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
The first two clauses are the familiar retain-the-notice conditions for source and binary distribution. The third forbids using the names of the copyright holder or contributors to endorse or promote your derived product without written permission. It is a trademark-shaped provision inside a copyright licence, and it exists because the reputational value of a project's name is real.
Nothing in it restricts what you may build, distribute or charge for. It restricts what you may imply about who stands behind it.
What it means in this catalogue
The entries here are largely libraries at the network and browser-base layer, where the licence choice reflects the norms of the communities that produced them rather than any position on fingerprinting. It is filed in the permissive bucket, alongside MIT, Apache-2.0 and ISC.
This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.
Questions about the BSD-3-Clause entries
Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.
Is BSD-3-Clause more restrictive than MIT?
Only in one respect: it forbids using the project's or contributors' names to endorse or promote derived products without permission. It imposes no copyleft and no source-disclosure obligation, and this register files both in the permissive bucket.
What is the extra clause in BSD-3-Clause?
The non-endorsement clause. You may build and ship whatever you like; you may not imply that the original authors back it. That is a statement about attribution rather than about code.
How does this registry classify licences into buckets?
Into permissive, copyleft, custom or NOASSERTION, none declared, and not applicable — derived from the SPDX identifier the repository declares. The bucket is a filtering aid; only the licence text settles what a given obligation actually reaches.
Every row above was chosen by somebody who then had to establish two
separate things — whether the code was alive, and whether it was theirs
to use. Donut Browser answers the second in its own repository: an
open-source anti-detect browser under AGPL-3.0, with the desktop
application and the sync server both in that repository, engine-level
fingerprint spoofing through the Wayfern Chromium fork rather than
injected JavaScript, a local REST API and MCP server on your own
machine, zero telemetry, and a pre-launch gate that refuses to start a
profile when the proxy's exit geography contradicts the profile's
fingerprint. Its own licence row is in
this same catalogue, read at the same
field check as everything else.