Overview

PMD is a free, extensible static code analyzer for teams that want to catch common programming flaws across a broad mix of languages. Its built-in rules, custom-rule support and companion duplicate-code detector make it a strong fit for projects that want configurable checks in both local and CI workflows.

Its breadth comes with a practical constraint: running PMD requires Java 8 or above, and only the latest major version receives active development and regular fixes.

Key features

PMD ships with more than 400 rules for issues such as unused variables, empty catch blocks and unnecessary object creation. Teams can extend its checks with rules written in Java or XPath, which is useful when standard rules do not reflect a project's conventions. That flexibility also means the tool is best suited to teams prepared to choose and maintain a ruleset rather than expecting one fixed set of checks to fit every codebase.

Language coverage spans Java, JavaScript, Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Velocity, JSP, WSDL, Maven POM, HTML, XML and XSL. Scala is supported without Scala-specific rules, so coverage is not equally deep across the full list. CPD, distributed with PMD, adds duplicate-code detection across many programming languages; it makes PMD relevant to teams looking for both static analysis and copy-paste checks in one distribution.

PMD can run from the command line or as a Maven, Ant, Gradle or bld build operation. Its GitHub Action accepts a custom ruleset, produces SARIF reports and can fail builds according to violation counts. For GitLab, a documented CI/CD component converts PMD reports into GitLab Code Quality format. These options suit teams that want findings incorporated into build checks and reports, though the project also documents integrations for Bamboo and Jenkins rather than limiting CI use to GitHub.

IDE integrations include Eclipse, IntelliJ IDEA and Visual Studio Code, among others. Some listed plugins, including those for Apache NetBeans and Emacs, are marked as not actively maintained; teams relying on those editors should weigh that status before making the plugin their primary workflow.

Pricing

PMD is free under a BSD-style license. The PMD plan costs 0.00 USD per free and provides a downloadable static code analyzer. There is no free trial because the software is free to use; no paid tier or seat-based plan is part of this offer. That makes it a straightforward option for individuals and teams that can run and manage the tool themselves, rather than buyers seeking a priced hosted service or commercial support plan.

Platforms

PMD supports Linux, macOS, Windows and self-hosted use. It is distributed as a ZIP archive containing PMD and CPD, and requires Java 8 or above. Documentation covers execution on Linux/Unix and Windows through the pmd or pmd.bat commands. Since PMD 7.11.0, binary distributions have GPG signatures for download verification.

Who it's for

PMD is a good match for development teams working across its supported languages who want configurable static checks, duplicate detection and integration with build or CI pipelines without a license fee. It is less suitable for a team that cannot accommodate the Java runtime requirement, needs Scala-specific rules, or depends on an IDE integration marked as not actively maintained.

Pros and cons

Pros: More than 400 built-in rules plus Java- and XPath-based custom rules let teams tailor checks to their codebase.
Pros: CPD adds copy-paste detection in the same distribution, broadening its usefulness beyond flaw checks.
Pros: Build-tool, command-line and CI integrations let teams place checks in existing development workflows, including SARIF output and violation-based build failures in GitHub Actions.
Cons: Java 8 or above is required, which adds a runtime dependency for teams that do not already use Java.
Cons: Only the latest major version is actively developed and regularly updated, so older major versions become unsupported.
Cons: Scala has no Scala rules, and some IDE plugins are not actively maintained, limiting the consistency of support across languages and editors.

Alternatives

For a broader comparison, see Linters, Code Clone Detection Tools and Static Analysis Tools.

Biome is a free toolchain for web projects; choose it when that focus and its extension, desktop and web platform options better match your needs.
Cppcheck has a free core static-analysis plan and a freemium model; consider it when you want to compare another static-analysis option.
Ruff is a free option for readers evaluating another linter.
Astral offers free, open-source and permissively licensed tools including Ruff, uv and ty; choose it when that tool set better fits your needs.
golangci-lint is a free and open-source project built by volunteers; consider it when comparing another free linting tool.
Oxc is free and open source, making it another option to compare.
Stylelint is a free option for readers comparing another linting tool.
ESLint is an open-source JavaScript linting utility; choose it when you want a JavaScript-focused alternative.

Verdict

Choose PMD if you want free, configurable static analysis across several languages, with duplicate detection and practical build and CI integration. Its breadth and custom rules are compelling for teams willing to manage their own setup; look elsewhere if Java is an obstacle, Scala-specific checks are essential, or support for an older major version matters.

	PMD	SpotBugs
Free plan	Yes	No
Free trial	No	No
Paid from	Free	—
Open source	No	No
Platforms	Linux, macOS, self-hosted, Windows	Windows, macOS, Linux
Free plan	Yes	—
Custom rules	Yes	Yes
Language support	—	Java
Security analysis	—	Yes
IDE support	—	Yes
Deployment	—	self_hosted

PMD vs SpotBugs

PMD

SpotBugs