PMD

Overview

PMD is a free static code analyzer for developers and teams who want to check code across multiple languages. It is a particularly good fit when configurable rules and duplicate-code detection matter; it is less compelling for teams that need uniform rule coverage across every supported language.

Its BSD-style license and downloadable distribution keep adoption straightforward, but running it requires Java 8 or above. Teams should also account for its version policy: only the latest major version remains in active development and regularly receives fixes and new features.

Key features

PMD includes more than 400 built-in rules for issues such as unused variables, empty catch blocks and unnecessary object creation. Custom rules written in Java or XPath let teams adapt checks to local conventions, a meaningful advantage over a fixed ruleset. That flexibility suits teams willing to select and maintain their rules; it may be more setup than a project seeking a ready-made, uniform policy needs.

Its language list includes Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML and XSL. Scala is supported without Scala rules, so teams should not assume equivalent analysis depth across the full range. CPD, bundled with PMD, detects duplicated code across many programming languages and makes the download useful for teams that want clone detection alongside static analysis.

PMD runs from the command line or as a Maven, Ant, Gradle or bld build operation. Its GitHub Action uses a supplied ruleset, creates SARIF reports and can fail a build at a chosen violation count. PMD also documents CI integrations for Atlassian Bamboo, GitHub Actions, GitLab and Jenkins; its GitLab component converts PMD reports to GitLab's Code Quality format. This supports automated checks, while the ruleset still needs to reflect the project's needs.

IDE integrations include Eclipse, IntelliJ IDEA and Visual Studio Code, among others. Some integrations, including the listed Apache NetBeans and Emacs plugins, are marked as not actively maintained, so teams relying on those editors should weigh that maintenance status before standardizing on them.

Pricing

PMD costs nothing under a BSD-style license. The free plan is the downloadable static code analyzer, with no separate paid tier described. There is no free trial because the software is free; no seat or usage quota is stated.

Platforms

PMD supports Linux, macOS, Windows and self-hosted use. It is distributed as a ZIP archive containing PMD and CPD, and requires Java 8 or above. Execution instructions cover Linux/Unix and Windows, using pmd or pmd.bat. Since version 7.11.0, binary distribution files include GPG signatures for download verification.

Who it's for

PMD suits developers and teams that want configurable static checks, broad language coverage and duplicate detection without a software charge. Its build-tool and CI options make it a sensible choice for projects that want to include checks in development or build workflows. It is a weaker fit when Scala-specific rules are essential, Java cannot be part of the runtime environment, or a team depends on an IDE plugin that is not actively maintained.

Questions can be raised through Stack Overflow, GitHub Discussions, Gitter or PMD Guru at Gurubase; bugs can be reported through GitHub issues. Security reports follow PMD's SECURITY.md policy.

Pros and cons

• Pros: More than 400 built-in rules plus Java- and XPath-based custom rules give teams room to align checks with their conventions.
• Pros: CPD adds duplicate-code detection in the same distribution, avoiding a separate tool for that task.
• Pros: Command-line, build-tool and CI integrations support use in both local and automated workflows.
• Cons: Java 8 or above is required to run PMD, which adds a runtime requirement for teams not already using Java.
• Cons: Scala has no Scala-specific rules, and some IDE integrations are not actively maintained, limiting confidence in coverage or editor support for those users.
• Cons: Older major versions become unsupported, so teams need to keep current to receive active development and regular fixes.

Alternatives

For a narrower focus on code clones, compare Code Clone Detection Tools. Readers choosing primarily among general code-quality checks can browse Linters or Static Analysis Tools.

Duplo is another free option for Linux, macOS and Windows, distributed under GNU GPL v2 or later. CloneWorks is free on those platforms, but its license requires acknowledgement and requires redistribution and derivatives to remain free of charge. dcd is free for Linux and macOS under AGPL-3.0; it also offers priority direct email support for a price not listed.

jscpd is another free option, with API, Linux, macOS, self-hosted and Windows platforms. NiCad is free, MIT-licensed and requires OpenTxl 11 or later. Simian Similarity Analyzer is a free option for Linux, macOS and Windows under Apache License 2.0. copydetect is free and supports API, Linux, macOS, self-hosted and Windows platforms. Algo VPN is also listed as free and supports Android, iOS, Linux, macOS and Windows.

Verdict

Choose PMD if your team wants a free, extensible analyzer that combines a substantial built-in ruleset with bundled duplicate detection and can be integrated into build or CI workflows. Look elsewhere if Java 8 or above is impractical, Scala rule coverage is central, or your workflow depends on an IDE integration that is no longer actively maintained.