Breezo — File tools that never upload your files

Open Source Licences

Last updated:

Breezo runs on other people's work. This page lists the third-party components your browser actually downloads and executes when you use this site, the licence each one is distributed under, and where its source code can be obtained. It states facts rather than legal conclusions: what we use, what we have checked, and what we have not.

What this page covers

Everything below is something your browser downloads and runs. That distinction does real work here. A lot of software is involved in building this site — compilers, bundlers, image optimisers, test runners — and none of it is sent to you. Listing build tools alongside the code running on your machine would pad this page and bury the parts that matter, so they are described near the end instead, under their own heading.

A plain-text version of this page, including full copyright lines and the file hashes we record for the components we keep a copy of, is published alongside the licence texts themselves. Every licence referred to here is hosted on this site: you do not have to follow a link to somebody else's server to read the terms you are being told about.

HEIC images: heic-to and libheif

HEIC and HEIF files — the format an iPhone camera produces by default — are decoded by heic-to 1.5.2, which embeds libheif 1.22.2. heic-to is distributed under the GNU Lesser General Public License, version 3 or later. The obligation originates with libheif rather than with heic-to itself: libheif's own terms place the library under the LGPL, while its sample applications and language wrappers are under the MIT licence. We use the library.

It is delivered as a single self-contained JavaScript module under /_astro/, with a file name that begins "heic-to." followed by a content hash. It is downloaded only when a HEIC file is actually processed, and it is the only place that code exists on this site. It contains no Breezo code of any kind, and it ends with an ordinary module export — which means it can be replaced. If you want to run a different build, including a modified one, produce a module that exports heicTo and substitute it for that file.

One thing is better stated plainly than left for you to discover: the file we publish is not byte-identical to the one the heic-to project publishes. We change none of its source, but our build compresses it a second time. Whether a re-compressed module satisfies every reading of the LGPL's requirement to supply the library in a form suitable for relinking is a question we are not qualified to settle, and we would rather write this sentence than pretend the question does not exist.

There is also a thing that did not go wrong, which is worth recording because you cannot see it from the outside. The build instructions for heic-to mention an optional HEVC encoder, x265, which carries the GPL rather than the LGPL — a stricter licence with wider consequences. We examined the file we actually publish and found no trace of x265 or of libaom: this site only decodes HEIC, so the encoders were never included. That is now asserted automatically on every build, so it cannot change quietly.

Video: mediabunny

The video tools use mediabunny 1.53.0, under the Mozilla Public License 2.0, to move already-encoded video packets from one container format into another. That is why those tools are fast and do not cost you quality: nothing is re-encoded, the stream is carried across untouched.

The MPL is a file-level copyleft licence — its requirements attach to the files it covers rather than to the whole program that uses them. We do not modify those files. mediabunny is delivered as its own module, contains no Breezo code, and its source is published at the address below.

Two files we keep a copy of ourselves

Most components arrive through the usual package manager. Two do not: we keep the exact bytes in our own repository, because in both cases the version we need is not the version the package manager offers. For those two we also record the file size and a SHA-256 hash, so that anyone can check that what we ship is what the upstream project published.

SheetJS Community Edition 0.20.3 (Apache License 2.0, © 2013–present SheetJS LLC) reads spreadsheets for the XLSX-to-PDF tool. It is 951,904 bytes and is shipped exactly as SheetJS published it, without re-compression.

harfbuzz-subset.wasm is a WebAssembly build of HarfBuzz, published by the harfbuzzjs project and distributed under the permissive licence HarfBuzz calls "Old MIT". It is 612,552 bytes, taken from harfbuzzjs release v1.6.0, and again shipped byte-for-byte. It cuts each embedded font down to the characters a document actually uses, which is what keeps Office-to-PDF conversions from carrying a whole CJK font family in every file.

The rest of what your browser downloads

PDF pages are rendered to images by PDF.js (pdfjs-dist 6.2.108, Apache License 2.0, Mozilla Foundation). PDF files are created and edited by pdf-lib 1.17.1 (MIT, © 2019 Andrew Dillon), which includes pako 1.0.11 (© 2014–2017 Vitaly Puzrin and Andrei Tuputcyn) for compression and embeds fonts through @pdf-lib/fontkit 1.1.1 (MIT). Password-protected PDFs are decrypted, and newly protected ones encrypted, by @cantoo/pdf-lib 2.8.1 (MIT), a fork of pdf-lib that implements the standard security handler; it uses crypto-js 4.2.0 (MIT, © 2009–2013 Jeff Mott and contributors). That fork is loaded on the two pages that add or remove a password, and on every other page only when a file turns out to be encrypted, so most visits never download it.

ZIP archives are read and written by fflate 0.8.3 (MIT, © 2026 Arjun Barrett). QR codes come from qrcode 1.5.4 (MIT, © 2012 Ryan Day). Images are encoded, decoded, losslessly optimised and resized by the jSquash packages (Apache License 2.0), which are WebAssembly builds derived from Google's Squoosh — that is where MozJPEG, libwebp and oxipng enter the picture. Which build of those codecs your browser receives is decided at runtime by wasm-feature-detect 1.8.0 (Apache License 2.0, Google).

The site itself is built with Astro 7.2.0 (MIT, © 2021 Fred K. Schott). Astro is mostly a build-time tool, but it contributes a small amount of runtime code to every page, so it belongs on this side of the line rather than the next one.

What is not on this list, and why

Several components under copyleft licences are used to build this site but never reach you — the image optimiser sharp with its libvips core, and the CSS transformer lightningcss, among more than twenty others. What they produce is ordinary images and ordinary CSS; their own code stays on the machine that builds the site. We searched the published files for any trace of them and found none.

This is worth saying out loud because it is the single judgement on this page with the widest reach: it is the reason those components are absent rather than listed. If that judgement is wrong, this page is incomplete. We would rather state it in the open than leave it implicit and hope nobody asks.

Where we are not certain

Three things here are open rather than settled. Rounding them off would make this page read better and be worth less.

The first is the re-compression question described in the HEIC section. We have not found authoritative guidance on how the LGPL's relinking requirement applies to a JavaScript module that a bundler has minified, and we are not going to invent an answer.

The second is the image codecs. The jSquash packages that publish those WebAssembly binaries declare the Apache License 2.0, and that is what is recorded above. We have not separately opened the licence file of every upstream codec compiled into them — MozJPEG, libwebp, oxipng and the rest — so treat the entry for those as the publisher's declaration rather than as our own verification.

The third is libde265, the HEVC decoder named in heic-to's build configuration. We know it is there; we have not read its licence directly.

None of the above is a claim that we are, or are not, compliant with anything. It is a description of what we use, what we checked, and where we stopped.

Corrections

If anything on this page is wrong, incomplete or out of date — a version that has moved on, a copyright line we got wrong, a component we failed to notice — please write to hello@breezofile.com. Corrections get made here, on the page, rather than only answered privately.