Icon Licenses Explained: MIT vs Apache 2.0 vs CC BY vs CC0
Every open-source icon license decoded for developers — what you must include, what you can skip, and where teams actually get burned. Backed by license data from 134,701 real icons across 28 libraries.
The 30-Second Answer
TL;DR — Icon licensing in five sentences
MIT, Apache 2.0, ISC, and CC0 icons are free for commercial use with no attribution in your UI. Together those four licenses cover 127,291 of the 134,701 icons (94.5%) in the IconStash dataset. CC BY 4.0 icons (5.5% of the dataset) additionally require a credit line — one sentence on your About page is enough. The practical difference between MIT and Apache 2.0 is that Apache adds an explicit patent grant; for icon consumption they behave identically. The licenses that actually get teams in trouble are not these — they're "free for personal use" pseudo-licenses and stock-site EULAs, which are not open source at all.
This is not legal advice — it's an engineering field guide. But unlike most articles on this topic, every number here comes from a real, verifiable dataset: the license metadata of all 134,701 icons indexed by IconStash, published as open data (CC BY 4.0) on our statistics page.
What an Icon License Actually Governs
An icon license answers four questions, and only four:
- Use — can you ship the icon in a product, including a commercial one?
- Modification — can you recolor, resize, restyle, or combine it?
- Redistribution — can you pass the icon files on to others (in a template, a library, a design kit)?
- Conditions — what do you owe in return: attribution, license text, change notices, nothing?
Everything else — pricing, API limits, "premium" tiers — is a business model, not a license. Keep those two ideas separate and 90% of icon-licensing confusion disappears.
The License Landscape, Measured
Most licensing articles speak in generalities. Here is the actual distribution across every icon in the IconStash index (snapshot 2026-05-05):
| License | Icons | Share | Attribution in UI? | Notable libraries |
|---|---|---|---|---|
| Apache 2.0 | 62,385 | 46.3% | Not required | Material Symbols, Material Design Icons, Remix Icon |
| MIT | 59,213 | 44.0% | Not required | Fluent UI, Tabler, Phosphor, Heroicons |
| CC BY 4.0 | 7,410 | 5.5% | Required (one line) | Solar Icons |
| CC0 1.0 | 3,714 | 2.8% | Not required | Simple Icons |
| ISC | 1,979 | 1.5% | Not required | Lucide |
94.5% of the open-source icon ecosystem requires nothing from you at runtime. The license fear that keeps teams paying for stock icons is, statistically, unfounded.
MIT: The Default of the Ecosystem
The MIT License is ~170 words long. It grants unrestricted use, modification, merging, publishing, distribution, sublicensing, and sale. Its single condition: the copyright notice and license text must accompany "all copies or substantial portions of the Software."
What that means for icons, concretely
- Using icons in your app or site: nothing to do. Rendered icons in a UI are output, not a redistribution of "the Software."
- Bundling via npm: nothing extra to do — the license file ships inside
node_modules, and standard tooling (e.g., license-extraction plugins) already satisfies compliance for minified bundles. - Redistributing the SVG files themselves (a UI kit, a forked icon set, a Figma template you sell): include the original LICENSE file. That's the whole obligation.
MIT covers 59,213 icons (44.0%) in our index — including Microsoft's Fluent UI Icons (20,170 icons, the single largest library we index), Tabler, Phosphor, and Heroicons.
Apache 2.0: MIT Plus a Patent Shield
Apache 2.0 grants the same freedoms as MIT, with two additions that matter to large organizations:
- Explicit patent grant: every contributor licenses any patents their contribution embodies. If someone later sues you over a patent in the work, their license terminates. MIT is silent on patents; Apache 2.0 closes that gap in writing.
- Change notices: if you modify and redistribute the files, you must state that you changed them. Recoloring an icon inside your app doesn't trigger this; republishing an edited icon set does.
This is why Google standardizes on it: Material Symbols, Material Symbols Light, and Material Design Icons — 48,517 icons across the three Material families — are all Apache 2.0. That single corporate decision is the main reason Apache 2.0 is the #1 license by icon volume at 46.3%.
Rule of thumb: as an icon consumer, MIT and Apache 2.0 are interchangeable. As an icon redistributor, Apache 2.0 asks for one extra courtesy — a note that you changed things.
ISC: MIT with Fewer Words
The ISC license is functionally identical to MIT — same permissions, same single attribution-in-source condition — just written more concisely. It's the license of Lucide (1,979 icons), the community successor to Feather and one of the most-shipped icon sets in modern SaaS. If your legal team has approved MIT, ISC is the same conversation.
CC0: The Public-Domain Dedication
CC0 isn't a license with conditions — it's a waiver. The author dedicates the work to the public domain and gives up copyright entirely. You may use, modify, sell, and redistribute CC0 icons with zero obligations. No notice, no credit, no license file.
The one trap: trademarks survive CC0
CC0 waives copyright, not trademark. This matters enormously for Simple Icons (3,714 icons in our index) — the definitive brand-logo set. The SVG path data is CC0, but the GitHub logo still belongs to GitHub and the Visa mark still belongs to Visa. You can render them to link to your GitHub repo; you cannot use them to imply endorsement or brand your own product. That restriction comes from trademark law, and no icon license can remove it.
CC BY 4.0: Free, but Say Thank You in Writing
CC BY 4.0 grants full commercial use and modification rights, on one condition: reasonable attribution. In our dataset this is Solar Icons — 7,410 icons, 5.5% of the index, and the only attribution-bearing license among all 28 libraries.
What "reasonable attribution" actually requires
Per the license, attribution must identify the work, the creator, the license (with link), and whether you made changes — "in any reasonable manner based on the medium." For software, this satisfies it:
- Websites: one line in the footer or an
/aboutor/creditspage — "Icons by Solar Icons, licensed under CC BY 4.0." - Mobile apps: an entry in the open-source licenses screen (the one you already have for your npm/Gradle dependencies).
- Not required: a caption next to every icon, a splash-screen credit, or a link in your navigation.
Side-by-Side: What Each License Demands
| Obligation | MIT / ISC | Apache 2.0 | CC0 | CC BY 4.0 |
|---|---|---|---|---|
| Commercial use | Yes | Yes | Yes | Yes |
| Modify / restyle | Yes | Yes | Yes | Yes |
| Attribution in your UI | No | No | No | Yes — one credit line |
| License text when redistributing files | Yes | Yes | No | Yes (license link) |
| State changes on redistribution | No | Yes | No | Yes |
| Explicit patent grant | No | Yes | N/A | No |
| Waives trademark rights | No | No | No | No |
The Licenses That Actually Burn Teams
None of the five licenses above has ever been the source of an icon-licensing dispute we could find. The real risks live outside open source:
- "Free for personal use" — this is a proprietary license with the word "free" in it. It prohibits exactly the thing developers do: shipping products. Common on font/icon download sites.
- Stock-site EULAs with attribution tiers — e.g., free tiers requiring a visible credit link per icon, with back-billing if you miss one. Read the EULA, not the marketing page.
- Relicensed scrapes — icon packs on marketplaces that repackage MIT sets under a paid "extended license." The original license already gave you those rights for free.
- AI-generated icon packs with no license at all — no license means all rights reserved by default. Absence of a license is the most restrictive license.
The safest icon strategy in 2026 is also the cheapest one: use icons whose license is a standard, court-tested open-source text — MIT, Apache 2.0, ISC, CC0, or CC BY.
The 60-Second Compliance Checklist
Before you ship
- 1. Know your sources. List which icon libraries your product uses (your
package.jsonalready knows). - 2. MIT / Apache / ISC / CC0? You're done. npm + standard build tooling handles notice preservation.
- 3. Any CC BY icons? Add one credit line to your About/credits/licenses page. Done.
- 4. Redistributing icon files themselves? Include the upstream LICENSE file next to them.
- 5. Using brand logos? Copyright is cleared (CC0), but respect trademark: identify, don't imply endorsement.
- 6. Avoid anything "free for personal use." It is not free for you.
Frequently Asked Questions
Can I use MIT-licensed icons in a commercial product?
Yes — use, modify, and sell freely, with no visible attribution in your UI. The MIT notice-preservation rule applies when you redistribute the icon source files themselves, not when you render icons in a product.
What's the real difference between MIT and Apache 2.0 for icons?
For consuming icons: none in practice. Apache 2.0 adds an explicit patent grant and a requirement to note changes when redistributing modified files. Across our 134,701-icon dataset, Apache 2.0 covers 46.3% of icons and MIT 44.0% — together, nine out of ten open-source icons.
Do CC0 icons require attribution?
No. CC0 waives copyright entirely — zero conditions. The only caveat is trademark law: brand logos (like those in Simple Icons) remain trademarks of their owners regardless of the CC0 dedication.
How do I attribute CC BY 4.0 icons correctly?
One reasonable credit — set name, author, license link, and a note if you modified the icons — placed in your footer, About page, or licenses screen. Per-icon captions are not required.
Where does this data come from?
From the IconStash Icon Library Statistics 2026 dataset: verified per-library icon counts and license metadata for all 28 libraries we index, published as open data under CC BY 4.0. Cite it freely.