SpotBugs
SpotBugs is a free, open-source static analysis tool for finding likely errors in Java code.
What SpotBugs is
SpotBugs is a free, open-source static analysis tool for finding likely errors in Java code. It checks code patterns associated with bugs and covers more than 400 bug patterns. It runs on GNU/Linux, Windows, and macOS, either on its own or through Ant, Maven, Gradle, and Eclipse. The project supports plugins that add detectors, with fb-contrib and Find Security Bugs among the examples. SpotBugs requires a Java 11 or later runtime, and its manual recommends at least 512 MB of memory; very large projects may need more. Binary distributions come in gzipped tar and zip formats. The manual includes a security bug category and guidance for connecting Find Security Bugs to the Maven plugin. SpotBugs is a community-supported fork of the now-abandoned FindBugs project. Warnings can be false positives; the Maven plugin introduction describes the rate as generally under 50%. Scanning bytecode generated by JDK 11 and newer remains experimental, while bytecode from JDK 10, 9, 7, and earlier is unsupported. Users can report issues on GitHub or contact the project through its general-purpose mailing list.
Good
- Checks more than 400 bug patterns.
- Supports Ant, Maven, Gradle, and Eclipse.
- Plugins can add new detectors.
- Available for Linux, macOS, and Windows.
Watch out
- Requires a Java 11 or later runtime.
- JDK 11-and-newer bytecode scanning is experimental.
- Bytecode from JDK 10, 9, 7, and earlier is unsupported.
- Warnings can be false positives.
Who it suits
SpotBugs suits Java developers who want static analysis in a standalone workflow or through Ant, Maven, Gradle, or Eclipse. It can also suit teams that want to extend checks with detector plugins.
Verdict
SpotBugs offers broad Java pattern checks and several ways to integrate or extend its analysis. Check its runtime and bytecode limitations before adopting it for a project.
Plans and prices
From SpotBugs's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SpotBugs | Free | Free software under the GNU Lesser General Public License |
The facts
Each one read from SpotBugs's own pages, with the date it was checked.
What it does
- Accuracy caveat
- SpotBugs may produce false warnings, and the Maven plugin introduction says its false warning rate is generally less than 50%.checked 9 Oct 2026
- Analysis
- It looks for code patterns that are likely to be errors.checked 9 Oct 2026
- Bytecode support
- The manual says support for scanning bytecode generated by JDK 11 and newer is still experimental, and outdated JDK bytecode such as 10, 9, 7, and older is unsupported.checked 9 Oct 2026
- Distribution
- Binary distributions are available in gzipped tar and zip formats.checked 9 Oct 2026
- Extensibility
- New detectors can be added through plugins, and the site lists fb-contrib and Find Security Bugs as examples.checked 9 Oct 2026
- Integrations
- The project lists standalone use and integrations for Ant, Maven, Gradle, and Eclipse.checked 9 Oct 2026
- Memory requirement
- The manual recommends at least 512 MB of memory and says very large projects may need more.checked 9 Oct 2026
- Pattern coverage
- SpotBugs checks for more than 400 bug patterns.checked 9 Oct 2026
- Project background
- SpotBugs is a community supported fork of the now abandoned FindBugs project.checked 9 Oct 2026
- Purpose
- SpotBugs uses static analysis to look for bugs in Java code.checked 9 Oct 2026
- Runtime requirement
- SpotBugs requires a Java 11 or later runtime environment.checked 9 Oct 2026
- Security analysis
- The manual includes a security bug category and instructions for integrating Find Security Bugs with the Maven plugin.checked 9 Oct 2026
- Support
- Users can report issues on GitHub or contact the project through its general purpose mailing list.checked 9 Oct 2026
Where it runs
- Platform support
- The manual says SpotBugs is known to run on GNU/Linux, Windows, and MacOS X.checked 9 Oct 2026
Alternatives to SpotBugs
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Qodana
Free planWebAPIExtensionLinux7.9From $5 a month - 3
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 4
Cppcheck
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 5
Gitar
Free planWebAPISelf-hosted7.2From $20 a month - 6
gosec
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan