Oracle JDK 21 Goes Paid on October 20: Temurin vs Corretto vs JDK 25, and How to Choose

There is a date sitting about three weeks in front of you, and most Java teams have not put it in their calendar.

On October 20, 2026, Oracle ships its quarterly Critical Patch Update. For JDK 21, that release is the first one published under the Java SE OTN license, the paid terms that already cover Java 8, 11, and 17. Oracle flagged this on its own Java SE Support Roadmap with a section titled "End of Permissive Licensing of Java SE 21 (Sept 2026) approaching", and made the formal announcement on August 14, 2026.

Here is the part that should make you uncomfortable. The license change does not arrive as an email or a popup. It arrives as a build number. If your Dockerfiles, base images, or package managers pull oraclejdk:21 from a URL that never changes, the patch job that runs on October 21 will silently install an OTN-licensed binary into production. One production host on that build is enough to trigger Oracle's employee-count subscription model across your entire organization.

I have not personally run a fleet through this migration, so this is not a war story. It is a breakdown of the four exits, with every number linked to its source, and a checklist you can run this week.

What actually changes on October 20

The mechanism is Oracle's one-year overlap rule, and it has been predictable since 2021:

• September 2023: JDK 21 ships under the NFTC license, the No-Fee Terms and Conditions. Free for commercial and production use.
• September 2025: JDK 25 LTS ships. That starts a twelve-month window in which both LTS releases stay permissively licensed.
• July 21, 2026: Oracle ships the 21.0.12 Critical Patch Update. This is the last free-for-production JDK 21 build.
• Through September 2026: Oracle's downloads page states JDK 21 receives NFTC updates "until September 2026, a year after the release of the next LTS". A September-dated security patch may still be free.
• October 20, 2026: The quarterly CPU lands, and 21.0.13 is the first JDK 21 release under the Java SE OTN license. Production use requires a paid subscription.

Donald Smith, Oracle's Vice President of Product Management, wrote in the August 14 announcement that the overlap "is intended to give users who wish to continue using the permissive no-fee NFTC license time to migrate to Oracle JDK 25, the latest LTS release."

None of this is new behavior. JDK 17 went through the identical sequence two years ago: permissive through September 2024, OTN-licensed from the October 15, 2024 update onward. If your team slept through that one and paid for it later, this is the redo.

What does not change (and what everyone gets wrong)

Three misconceptions are circulating, and all three cost money if you act on them.

Your existing installs do not become illegal. Every JDK 21 binary you downloaded under the NFTC stays licensed under the terms it shipped with, forever, including production use. Nothing expires, nothing phones home. Licensing attaches to the artifact, not the calendar.

Development stays free even on Oracle builds. The OTN license permits personal use, development, testing, prototyping, and demonstration at no cost. Developer laptops, CI agents, and test environments are not the exposure. The fee attaches to production deployment.

OpenJDK builds are a separate track entirely. The change binds Oracle's own JDK 21 builds only. Builds of OpenJDK 21 distributed under GPLv2 with the Classpath Exception, by Oracle or anyone else, are untouched.

The real exposure is narrow and mechanical: which machines will install 21.0.13 or later, and who authorized it.

What it costs if you do nothing

Oracle's Java SE Universal Subscription is priced per employee of your organization, not per server, starting at $15 per employee per month and falling to a published floor of $5.25 at volume.

The trap is proportionality, or the lack of it. A 50-person company that runs one production service on an OTN-licensed JDK 21 build is not billed for one server. The subscription model counts employees. That single unattended patch job can turn into a five-figure annual line item, backdated through an audit, priced against headcount you never associated with Java.

The four exits, compared

All four are legal. They differ in cost, effort, and how long the clock runs.

Option 1: Upgrade to Oracle JDK 25. This is the exit Oracle is steering everyone toward, and for most estates it is the right default. JDK 25 is the current LTS and stays under the NFTC until September 2028, one year after Java 29 ships in September 2027. The cost is engineering time, not license fees: a four-version jump across two feature releases, mostly dependency and plugin updates plus a performance re-baseline, with no language-level break on the scale of the Java 8 module migration. Note the structural point: this does not end the treadmill, it resets it. In September 2028 the same cliff arrives for JDK 25.

Option 2: Switch to Eclipse Temurin 21. The free-forever answer if you need to stay on 21. Same upstream OpenJDK source, TCK-certified, different publisher. The Eclipse Adoptium support table gives Temurin 21 an end of availability of at least December 2029, with quarterly releases continuing. Migration is a base image and download URL change in most cases.

Option 3: Switch to Amazon Corretto 21. The longest runway of the free options. Amazon's Corretto FAQ lists JDK 21 support with a last planned update of July 2030 and end of life in October 2030, under GPLv2 with the Classpath Exception at no cost. If you are already on AWS, this is the path of least organizational resistance.

Option 4: Freeze on 21.0.12. Legal, free, and a bridge rather than a plan. The binaries you hold stay licensed, but the security clock stops: every CVE disclosed after October 20 stays unpatched on those JVMs. Treat this as a holding pattern measured in weeks while you execute one of the other three, not as a posture.

There is also a fifth row worth knowing about: if you run on RHEL, the Red Hat build of OpenJDK 21 comes with full support to December 2029 included in your existing subscription, with extended support beyond that.

The decision checklist

Run these five steps this week, in order.

1. Inventory your vendor, not just your version. java -version tells you 21.0.x, not who built it. Check java -XshowSettings:properties -version 2>&1 | grep -i vendor across production, staging, and CI images. Only Oracle-built JDK 21 binaries are affected.
2. Find what pulls updates automatically. Search your Dockerfiles, Helm charts, base image registries, and package automation for Oracle JDK 21 download URLs. Anything that fetches a floating latest is a compliance incident waiting for October 21.
3. Pin or move, before October 20. Either pin every Oracle JDK 21 environment to 21.0.12, or point them at Temurin 21, Corretto 21, or JDK 25. Doing nothing is a decision too; it just gets made by your patch cron job instead of by you.
4. Pick the target by runway. Staying on 21 with minimum effort: Temurin (to at least December 2029) or Corretto (to October 2030). Want the current LTS: JDK 25 under NFTC until September 2028. Already RHEL-based: the Red Hat build you already pay for.
5. Calendar the repeat. Whichever you choose, the overlap rule fires again. JDK 29 LTS lands in September 2027, and JDK 25's free window closes around September 2028. Put a reminder there now, while it is cheap.

What I would do differently

If I were setting this up today, the boring answer wins: pin the estate to a non-Oracle OpenJDK build and decouple the security cadence from Oracle's licensing calendar entirely. Corretto or Temurin give you the same TCK-certified platform with longer free runways and no employee-count meter attached. Upgrading to JDK 25 is the better long-term technical move, but doing it as a forced march in a three-week window, driven by a license date, is how upgrades go wrong. Separate the two: pin now to stop the October 20 exposure, upgrade to 25 on your own schedule next year.

The deeper lesson is that the NFTC is not a free license. It is a subscription that bills in upgrade effort instead of dollars, on a two-year cycle, and Oracle is perfectly happy to let you pay either way.

---

I write about Java, the JVM ecosystem, and backend engineering every week. Subscribe, it is free.

Which build is your production estate on, Oracle JDK or an OpenJDK distribution? Did the JDK 17 transition catch your team, or did you move off Oracle builds back then?

Sources: Oracle Java SE Support Roadmap, Oracle JDK downloads page, Eclipse Adoptium support table, Amazon Corretto FAQ, Red Hat OpenJDK lifecycle.