WebBuilding

Languages and formats

Java

Summary

Java is a general-purpose, object-oriented programming language whose programs compile to bytecode that runs on the Java Virtual Machine on almost any computer. Sun Microsystems unveiled it on May 23, 1995, and released Java 1.0 on January 23, 1996. Its applets once ran inside web pages, but today Java runs mainly on servers; Oracle, which bought Sun in 2010, released JDK 27 on September 15, 2026.

Web Building Encyclopedia · Languages and formats · Last reviewed October 22, 2026 · 10 min read

What Java is

Java is a general-purpose programming language. Its specification describes it as concurrent, class-based and object-oriented, which means programs are built from classes that bundle data with the code that works on it, and can do several things at once.1

The language is strongly and statically typed: the type of every value is known and checked before the program runs. It also manages memory automatically, usually with a garbage collector, a part of the runtime that frees memory a program no longer needs.1

Java code is normally compiled into bytecode, a machine-independent format, instead of instructions for one kind of processor.12 The bytecode runs on the Java Virtual Machine, or JVM, which its specification calls “an abstract computing machine.” The JVM knows nothing of the Java language itself, only of the class file format that holds the bytecode.2

That design is what made Java portable. The JVM specification says programmers “can write a program once, and it will run on any machine supplying a Java run-time environment.”2 One of Sun Microsystems’ slogans for it was “write once, run anywhere,” as the US Supreme Court noted in 2021.3

Java is not JavaScript. MDN, Mozilla’s developer reference, warns that JavaScript is not “Interpreted Java” and that the two languages have very different syntax, meaning and use. Both names are trademarks of Oracle.4

On the web, Java mostly runs on the server, where it builds pages and data before they are sent to the browser. As of October 22, 2026, W3Techs finds Java on 5.4% of websites whose server-side language it can identify. PHP leads at 69.3%, followed by JavaScript at 8.1% and Ruby at 7.1%.5

Origins at Sun Microsystems, 1991 to 1996

Java began at Sun Microsystems in a small team called the Green Project. Patrick Naughton, one of its members, wrote in 1996 that the group was already meeting in January 1991 to plan its direction.6 A 1997 history by the programming author Elliotte Rusty Harold says the team settled on smart consumer electronics, and that James Gosling started a new language for it, called Oak after a tree outside his window.7

Sun’s white paper The Java Language Environment, now hosted by Oracle, says the goal was “a small, reliable, portable, distributed, real-time operating platform.” C++ was the team’s first choice, but its problems grew until a new language made more sense.8 The same paper lists the design aims: simple, object-oriented, architecture neutral, portable and multithreaded.8

By the summer of 1992 the team had finished the Star7, a handheld prototype, and Naughton recalled that Oak “was running pretty well.”6 The group was turned into a Sun company called FirstPerson, and in 1993 it lost a bid to supply software for Time Warner set-top boxes.67

The World Wide Web gave the work a new use. In 1994 Naughton and Jonathan Payne built what he called “a pretty credible Mosaic clone web browser,” named WebRunner, modeled on NCSA Mosaic.6 The JVM specification explains why the fit was good: compiled code had to travel across networks, run on any computer and be safe, and the web’s HTML pages on their own were too limited.2

Sun formally unveiled the Java language and the HotJava browser on May 23, 1995, in San Francisco.910 HotJava ran small Java programs inside web pages.2 Sun said those programs could be prevented from changing any files on the visitor’s machine.9 By the day of the announcement, Marc Andreessen of Netscape had agreed to build Java into the Netscape browser.10

Sun released alpha versions through 1995. On January 23, 1996, it announced that Java 1.0 was ready to download for Solaris, Windows 95 and Windows NT.11

Applets: Java inside the web page

An applet was a small Java program placed in a web page and run by the browser. HTML 3.2, a W3C Recommendation dated January 14, 1997, gave pages an APPLET element to “embed a Java applet into HTML documents.” It took a code attribute naming the compiled program, width and height in pixels, and PARAM elements for settings.12

An October 1995 report on Netscape’s new software listed support for Java applets among the features of Netscape Navigator 2.0.13

Applets depended on a plug-in, an add-on that connected the browser to the Java runtime on the visitor’s computer. Browser makers removed that kind of plug-in between 2015 and 2017:

  • Chrome. Google Chrome‘s November 2014 plan blocked these plug-ins by default from January 2015 and removed NPAPI, the plug-in interface they used, in September 2015. The post’s table showed Java’s monthly launch rate among Chrome users falling from 8.9% in September 2013 to 3.7% in October 2014.14
  • Firefox. Mozilla Firefox 52, released on March 7, 2017, dropped support for NPAPI plug-ins, Java among them. Only Adobe Flash kept working, until Firefox ended Flash support at the end of 2020.15

Oracle followed. On January 27, 2016, it said it planned to deprecate the Java browser plug-in in JDK 9, because browser vendors had removed or scheduled the removal of plug-in support. It pointed developers to Java Web Start, which ran Java programs outside the browser.16 Oracle’s support roadmap now says its Java deployment technology, which covers the plug-in and Java Web Start, is not supported beyond Java SE 8.17

The OpenJDK project then removed the pieces one by one. JDK 9 deprecated the Applet API in 2017, and JDK 11 removed the appletviewer tool in 2018. Since then, “there has been no way to run applets using the JDK.”18 JDK 17 marked the API for removal, and JDK 26, published on March 17, 2026, removed it.1819 The story runs in parallel with the end of Adobe Flash.

The HTML standard now lists applet among elements that are “entirely obsolete, and must not be used by authors,” and tells authors to use embed or object instead.20

Java on the server

Java’s lasting place on the web is on the server. The basic building block is the servlet. The current Jakarta Servlet specification “defines a server-side API for handling HTTP requests and responses.”21 An API, or application programming interface, is an agreed set of calls that one piece of software uses to work with another.

Because the API was shared, Java web code could move between servers. When Python developers designed their own web standard in 2003, they pointed out that Java’s servlet API let applications written with any Java framework run in any web server that supported it.22

Apache Tomcat began at Sun as the reference implementation of the Java Servlet and JavaServer Pages specifications, the working model other products are checked against. Sun gave the code to the Apache Software Foundation, home of the Apache HTTP Server, in 1999, and the first Apache release was Tomcat 3.0. Tomcat became its own top-level Apache project in 2005.23

From Java EE to Jakarta EE

Servlets and other server APIs were grouped into an enterprise edition of Java, known as J2EE and later as Java Platform, Enterprise Edition (Java EE).2425 Tomcat describes itself as an implementation of a subset of the Jakarta EE, formerly Java EE, technologies.26

On September 12, 2017, ADTmag reported that Oracle had chosen the Eclipse Foundation as the new home for Java EE, a decision taken with IBM and Red Hat, the platform’s other two biggest contributors.25 In a community poll in February 2018, almost 7,000 people voted and more than 64% chose the name Jakarta EE.27

The move changed code, not just names. Jakarta EE 9 replaced the javax.* package names with jakarta.*.27 Tomcat 10.0 implemented the Jakarta EE 9 versions of the specifications, and the Tomcat project publishes a migration tool for moving older applications to Jakarta EE. Tomcat 11.0, its current focus of development, implements Servlet 6.1 for Jakarta EE 11.26 Jakarta EE 11 supports Java 17 or later and adds Jakarta Data, a specification for simpler access to stored data.28

Frameworks

Many Java sites are built with the Spring family of frameworks, ready-made code for common web tasks. Spring Framework 1.0 was released on March 24, 2004, and its announcement called it “a complete Java/J2EE application framework,” with a web MVC framework and tools for databases and transactions.24

Spring Boot, a later project, describes itself as making it easy to build “stand-alone, production-grade Spring based Applications” that can simply be run. As of October 22, 2026, its project page lists version 4.1.1.29

Open source, Oracle and licensing

On November 13, 2006, Sun released the HotSpot virtual machine and the javac compiler under the GNU General Public License, version 2, as the OpenJDK project.30 OpenJDK now calls itself “the place to collaborate on an open-source implementation of the Java Platform, Standard Edition.”31 Its code carries the GPL version 2 with a Classpath Exception, which lets programs that link to the Java libraries keep their own licenses.32

“In 2010 Oracle Corporation bought Sun,” the Supreme Court wrote, and Oracle went on to sue Google over Android. Google had bought Android, Inc. in 2005, released Android in 2007 and copied roughly 11,500 lines of Java SE code that declare how programmers call its functions.3 On April 5, 2021, the Court ruled 6 to 2 that this copying “was a fair use of that material as a matter of law.”3

A release every six months

On September 6, 2017, Mark Reinhold, chief architect of the Java Platform Group at Oracle, proposed shipping a feature release every six months, in March and September, starting in March 2018.33 Under the plan, every three years starting in September 2018, one feature release would get long-term support (LTS).33 Oracle now says it intends to make LTS releases every two years.17

The LTS releases so far are Java SE 8, 11, 17, 21 and 25, and Oracle lists Java 29, planned for September 2027, as the next one.17 Releases between them are supported only until the next feature release replaces them.17

Who may use which build for free

Oracle’s own build, the Oracle JDK, has changed licenses several times. On September 14, 2021, Oracle announced that Oracle JDK 17 would be free for all uses, including commercial production, under its No-Fee Terms and Conditions (NFTC).34

As of October 22, 2026, Oracle’s download page says JDK 27 and JDK 25 can be used in production at no cost under the NFTC, with JDK 25 updates on those terms until September 2028. Updates to JDK 21 and JDK 17 now come under the OTN license, which is free only for personal and development use, and production use of JDK 11 needs a Java SE Universal Subscription or another Oracle license.35 Oracle says users who want permissively licensed builds should move to JDK 25 or later.17

Other groups build OpenJDK too. Eclipse Adoptium publishes Eclipse Temurin, which it says is “Java SE TCK certified,” meaning it passed the official compatibility tests, and is available free of charge without usage restrictions.36

Versions and security today

JDK 25, the newest LTS release, came out on September 16, 2025. Its latest update as of October 22, 2026, is 25.0.5, released on October 20, 2026.37

JDK 27, the newest feature release, came out on September 15, 2026.38 Its security changes include post-quantum hybrid key exchange for TLS 1.3, the encryption behind HTTPS. Post-quantum means designed to resist attacks by future quantum computers. In JDK 27 the hybrid group X25519MLKEM768 is on by default and is the most preferred choice.38

Oracle ships security fixes in quarterly Critical Patch Updates. JDK 27.0.1, released on October 20, 2026, carries the October 2026 fixes. Among other changes, its built-in HTTP server now rejects HTTP/1.1 requests that have no Host header or more than one.38 A further build, 27.0.1.0.2, dated October 21, 2026, stops trusting eMudhra intermediate certificate authority (CA) certificates that had been compromised, and addresses the Oracle Security Alert for CVE-2026-91403.38

Log4Shell

Many Java security problems sit in libraries, not in Java itself. The most serious recent case was CVE-2021-44228, called Log4Shell, in Apache Log4j, a widely used Java logging library. The Apache project rates it 10.0, the maximum CVSS severity score.39

The flaw let an attacker who could control logged text, such as a form field or a browser header that a site writes to its logs, run code fetched from an outside LDAP server. It was fixed in Log4j 2.15.0 for Java 8 and later, 2.12.2 for Java 7 and 2.3.1 for Java 6. The 2.15.0 fix proved incomplete in some non-default setups, a gap tracked as CVE-2021-45046 and closed for Java 8 and later in 2.16.0.39 In December 2021 the US Cybersecurity and Infrastructure Security Agency said the flaw posed “a severe risk” and was “being widely exploited by a growing set of threat actors.”40

Timeline

  1. JDK 25.0.5 and 27.0.1 carry the October 2026 security fixes38
  2. JDK 27 is released with post-quantum hybrid key exchange for TLS 1.338
  3. JDK 26 removes the Applet API19
  4. JDK 25, a long-term support release, is published37
  5. Log4Shell (CVE-2021-44228) in the Java library Log4j is exploited widely40
  6. Oracle makes Oracle JDK 17 free for production use under the NFTC34
  7. The US Supreme Court rules Google's copying of Java SE code a fair use3
  8. Oracle picks the Eclipse Foundation as the new home of Java EE25
  9. Mark Reinhold proposes a feature release every six months33
  10. Oracle announces plans to deprecate the Java browser plug-in16
  11. Oracle buys Sun Microsystems3
  12. Sun releases HotSpot and javac under the GPL as OpenJDK30
  13. Sun donates the Tomcat servlet code to the Apache Software Foundation23
  14. Sun announces that Java 1.0 is available for download11
  15. Sun unveils Java and the HotJava browser in San Francisco10

What it means for your website

Most small business sites never touch Java. Hosted builders run their own code, and WordPress is written in PHP. Java matters if a developer builds you a custom web app with Spring or Jakarta EE, if your company’s portal or online store runs on a Java platform, or if you inherit an old site that used applets.

  • Check that your hosting can run it. A Java site needs a JVM and a servlet container such as Tomcat, or a stand-alone Spring Boot application, not just a folder of files.2329 Ask the host before you sign up. Our web hosting definition covers what to ask.
  • Ask which Java version the site runs, and under which license. As of October 22, 2026, Oracle JDK 25 is free for production use under the NFTC, while new updates for Oracle JDK 21 and 17 are free only for personal and development use.35 A free OpenJDK build such as Eclipse Temurin avoids the license question.36
  • Prefer an LTS release. A feature release such as JDK 27 stops getting Oracle updates when the next one replaces it, which for JDK 27 is March 2027.1735
  • Apply the quarterly patches. The October 2026 fixes are in JDK 25.0.5 and 27.0.1, and build 27.0.1.0.2 also stops trusting compromised eMudhra intermediate certificates.3738 Our news report explains that incident.
  • Ask about libraries, not just Java. Log4Shell showed that one logging library can expose a whole site. Ask your developer to confirm that libraries such as Log4j are on fixed versions.39
  • Replace any applet. No current JDK or browser runs applets.18 A page that still depends on one needs rebuilding with HTML and JavaScript. Our website redesign guide helps you decide how far to go.

A custom Java build gives full control but leaves you responsible for these updates. If you are weighing that against a builder or WordPress, see our guide to builder vs WordPress vs agency.

See also

References

  1. The Java Language Specification, Java SE 25 Edition: Chapter 1, Introduction. Oracle. 2025. accessed October 22, 2026.
  2. The Java Virtual Machine Specification, Java SE 25 Edition: Chapter 1, Introduction. Oracle. 2025. accessed October 22, 2026.
  3. Google LLC v. Oracle America, Inc., No. 18-956 (opinion of the Court). Supreme Court of the United States. 2021-04-05. accessed October 22, 2026.
  4. JavaScript. MDN Web Docs (Mozilla). accessed October 22, 2026.
  5. Usage statistics of server-side programming languages for websites (as of October 22, 2026). W3Techs. 2026-10-22. accessed October 22, 2026.
  6. The Long Strange Trip to Java (epilogue to The Java Handbook). Patrick Naughton, hosted by blinkenlights.com. 1996-03-18. accessed October 22, 2026.
  7. The Prehistory of Java (lecture slides). Elliotte Rusty Harold, ibiblio.org. 1997. accessed October 22, 2026.
  8. The Java Language Environment: A White Paper, Chapter 1, Introduction. Sun Microsystems, hosted by Oracle. accessed October 22, 2026.
  9. Java on the Menu: Causing Jitters? (Internet World, June 1995). Tristan Louis, TNL.net. 1995-06-01. accessed October 22, 2026.
  10. Java language is three years old tomorrow. Tech Monitor (Computer Business Review). 1998-05-21. accessed October 22, 2026.
  11. Java 1.0 Turns 25 (Alex Blewitt). InfoQ. 2021-01-23. accessed October 22, 2026.
  12. HTML 3.2 Reference Specification. W3C. 1997-01-14. accessed October 22, 2026.
  13. Latest software from Netscape. Tech Monitor (Computer Business Review). 1995-10-20. accessed October 22, 2026.
  14. The Final Countdown for NPAPI (Justin Schuh). Chromium Blog, Google. 2014-11-24. accessed October 22, 2026.
  15. Why do Java, Silverlight, Adobe Acrobat and other plugins no longer work?. Mozilla Support. accessed October 22, 2026.
  16. Moving to a Plugin-Free Web (Dalibor Topic). Oracle Java Blog. 2016-01-27. accessed October 22, 2026.
  17. Oracle Java SE Support Roadmap. Oracle. 2026-10-20. accessed October 22, 2026.
  18. JEP 504: Remove the Applet API. OpenJDK. 2025-11-19. accessed October 22, 2026.
  19. JDK 26 Release Notes. Oracle. 2026-03-17. accessed October 22, 2026.
  20. HTML Living Standard, section 16: Obsolete features. WHATWG. accessed October 22, 2026.
  21. Jakarta Servlet. Jakarta EE Specifications, Eclipse Foundation. accessed October 22, 2026.
  22. PEP 333: Python Web Server Gateway Interface v1.0. Phillip J. Eby, Python Enhancement Proposals. 2003-12-07. accessed October 22, 2026.
  23. Apache Tomcat Heritage. The Apache Software Foundation. accessed October 22, 2026.
  24. Spring Framework 1.0 Final Released (Thomas Risberg). Spring Blog, spring.io. 2004-03-24. accessed October 22, 2026.
  25. Java EE Is Moving to the Eclipse Foundation (John K. Waters). ADTmag. 2017-09-12. accessed October 22, 2026.
  26. Which Version Do I Want?. Apache Tomcat, The Apache Software Foundation. accessed October 22, 2026.
  27. Jakarta EE FAQ. Jakarta EE, Eclipse Foundation. accessed October 22, 2026.
  28. Jakarta EE 11 release. Jakarta EE, Eclipse Foundation. accessed October 22, 2026.
  29. Spring Boot. Spring projects, spring.io. accessed October 22, 2026.
  30. Sun open sources Java (Gavin Clarke). The Register. 2006-11-13. accessed October 22, 2026.
  31. OpenJDK. OpenJDK. accessed October 22, 2026.
  32. LICENSE (GNU General Public License, version 2, with the Classpath Exception). openjdk/jdk repository, GitHub. accessed October 22, 2026.
  33. Moving Java Forward Faster (Mark Reinhold). mreinhold.org. 2017-09-06. accessed October 22, 2026.
  34. Introducing the Free Java License (Donald Smith). Oracle Java Blog. 2021-09-14. accessed October 22, 2026.
  35. Java Downloads. Oracle. accessed October 22, 2026.
  36. Eclipse Adoptium. Eclipse Foundation, adoptium.net. accessed October 22, 2026.
  37. JDK 25 Release Notes. Oracle. 2026-10-20. accessed October 22, 2026.
  38. JDK 27 Release Notes. Oracle. 2026-10-21. accessed October 22, 2026.
  39. Apache Logging Services: Security. The Apache Software Foundation. accessed October 22, 2026.
  40. Statement from CISA Director Easterly on "Log4j" Vulnerability. Cybersecurity and Infrastructure Security Agency. 2021-12-11. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].