What this license is
The JSON License is Douglas Crockford's MIT text with one sentence added: the Software shall be used for Good, not Evil. Everything else reads like MIT. You may use, copy, modify, publish, distribute, sublicense, and sell the code, as long as the copyright notice and the full permission notice, including that sentence, travel with it. The added sentence is a field-of-use restriction: it limits what you are allowed to use the software for. That is what puts it outside the Open Source Definition, which does not allow a license to restrict fields of endeavour.
Why it matters for your product
The clause sounds like a joke and behaves like a procurement blocker. The Free Software Foundation treats the license as non-free, Debian treats it as failing its guidelines, and Fedora rejects it. The Apache Software Foundation put it on its prohibited list, which forced real code changes in Apache projects. So a buyer with a license policy may refuse the component even though the grant underneath is MIT-shaped. There is also no way to show the use condition is met, because Good and Evil are undefined and no objective test exists.
You are meeting the terms when
- You are meeting the notice condition when the copyright line and the full permission notice, including the Good-not-Evil sentence, travel with every copy you distribute.
- You are as close as this license allows on the use clause when the person who owns license policy has looked at it and written down a decision, because nothing here can be checked objectively.
- You have removed the question entirely when you replace the dependency. In Java, org.json has Apache-2.0 alternatives such as Jackson and Gson, at the cost of rewriting the call sites.
- You are ready for a customer review when your component record names the license as JSON rather than as MIT, so the buyer's own policy can be applied to it.
Where teams get it wrong
- The license is read as MIT because the first 95 percent of the text is MIT. The added sentence is the only part that matters to a policy review.
- An SBOM records the component as MIT-like and it passes an allow-list that would have rejected it. Record the identifier as JSON and let the buyer decide.
- The replacement is postponed until a customer objects. The swap to an Apache-2.0 parser is a rewrite of the call sites, and it is cheaper before a deal is on the table.
How SourceTrust handles this license
SourceTrust fetches the published artifact, extracts the license files, and compares that text against the declared SPDX id, so the extra sentence is in front of you instead of buried inside a jar. No external obligation exists for a field-of-use restriction, so nothing lands on the project checklist and publishing is not held for it. The license catalog still records this license as permissive, so the component page groups it that way. The decision here is a policy one and it stays yours. Read Inventory and compliance overview to find every project that carries it.