Freedom251 › Static Analysis Tools
SpotBugs
What SpotBugs is
SpotBugs is a free, open-source tool that uses static analysis to find likely errors in Java code. It checks code patterns associated with bugs and covers more than 400 bug patterns. You can run it standalone or use its integrations for Ant, Maven, Gradle, and Eclipse, on Linux, macOS, or Windows. SpotBugs requires a Java 11 or later runtime. Its manual recommends at least 512 MB of memory, with very large projects potentially needing more. The project supports plugins for adding detectors, with fb-contrib and Find Security Bugs among its examples. It also includes a security bug category and guidance for integrating Find Security Bugs with the Maven plugin. SpotBugs is a community-supported fork of FindBugs, an abandoned project. Its warnings can include false positives; the Maven plugin introduction describes the false-warning rate as generally below 50%. Scanning bytecode generated by JDK 11 and newer is still experimental, while bytecode from JDK 10, 9, 7, and earlier is unsupported. Binary downloads come as gzipped tar or zip files. Users can report issues on GitHub or contact the project through its general-purpose mailing list.
Who it suits
SpotBugs suits Java developers who want static analysis in a standalone workflow or through Ant, Maven, Gradle, or Eclipse. It can also suit teams that want to extend bug detection with plugins, including security detectors.
What it does well
- Checks more than 400 bug patterns.
- Works standalone and integrates with Ant, Maven, Gradle, and Eclipse.
- Plugins can add detectors.
- Includes a security bug category.
- Runs on Linux, macOS, and Windows.
What to know first
- Requires a Java 11 or later runtime.
- Scanning bytecode from JDK 11 and newer is experimental.
- Bytecode from JDK 10, 9, 7, and earlier is unsupported.
- Warnings can include false positives.
Limits
SpotBugs is free software under the GNU Lesser General Public License. Its bytecode support for JDK 11 and newer is experimental, and bytecode from JDK 10, 9, 7, and earlier is unsupported.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| SpotBugs | Free software under the GNU Lesser General Public License | Free |
As spotbugs.github.io lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the SpotBugs website.
- Choose a gzipped tar or zip binary distribution.
- Prepare a Java 11 or later runtime environment.
- Run SpotBugs standalone or use its Ant, Maven, Gradle, or Eclipse integration.
Verdict
Choose SpotBugs if you need free static analysis for Java and want to run it standalone or through a listed build tool or IDE. Look elsewhere if you need established scanning support for bytecode produced by JDK 11 or newer, or support for older bytecode versions listed as unsupported.
Questions
How much does SpotBugs cost?
The listed SpotBugs plan is free. It is free software under the GNU Lesser General Public License.
Which languages does SpotBugs support?
The listed language support is Java.
Which operating systems can run SpotBugs?
The manual says it is known to run on GNU/Linux, Windows, and MacOS X.
Can I use SpotBugs with build tools or an IDE?
The project lists standalone use and integrations for Ant, Maven, Gradle, and Eclipse.
Can I add custom bug detectors?
Yes. Plugins can add detectors; the project lists fb-contrib and Find Security Bugs as examples.
What runtime and memory does SpotBugs need?
It requires Java 11 or later. The manual recommends at least 512 MB of memory, with very large projects potentially needing more.
Facts from SpotBugs's own pages
- Accuracy caveat
- SpotBugs may produce false warnings, and the Maven plugin introduction says its false warning rate is generally less than 50%. · spotbugs.github.io, 9 Oct 2026
- Analysis
- It looks for code patterns that are likely to be errors. · spotbugs.readthedocs.io, 9 Oct 2026
- Bytecode support
- The manual says support for scanning bytecode generated by JDK 11 and newer is still experimental, and outdated JDK bytecode such as 10, 9, 7, and older is unsupported. · spotbugs.readthedocs.io, 9 Oct 2026
- Distribution
- Binary distributions are available in gzipped tar and zip formats. · spotbugs.readthedocs.io, 9 Oct 2026
- Extensibility
- New detectors can be added through plugins, and the site lists fb-contrib and Find Security Bugs as examples. · spotbugs.github.io, 9 Oct 2026
- Integrations
- The project lists standalone use and integrations for Ant, Maven, Gradle, and Eclipse. · spotbugs.github.io, 9 Oct 2026
- Memory requirement
- The manual recommends at least 512 MB of memory and says very large projects may need more. · spotbugs.readthedocs.io, 9 Oct 2026
- Pattern coverage
- SpotBugs checks for more than 400 bug patterns. · spotbugs.github.io, 9 Oct 2026
- Platform support
- The manual says SpotBugs is known to run on GNU/Linux, Windows, and MacOS X. · spotbugs.readthedocs.io, 9 Oct 2026
- Project background
- SpotBugs is a community supported fork of the now abandoned FindBugs project. · spotbugs.github.io, 9 Oct 2026
- Purpose
- SpotBugs uses static analysis to look for bugs in Java code. · spotbugs.github.io, 9 Oct 2026
- Runtime requirement
- SpotBugs requires a Java 11 or later runtime environment. · spotbugs.readthedocs.io, 9 Oct 2026
- Security analysis
- The manual includes a security bug category and instructions for integrating Find Security Bugs with the Maven plugin. · spotbugs.readthedocs.io, 9 Oct 2026
- Support
- Users can report issues on GitHub or contact the project through its general purpose mailing list. · spotbugs.github.io, 9 Oct 2026
Where SpotBugs stands on Freedom251
- Static Analysis Tools#20 of 38