Products
| Product | What it is | Java versions | Browsers |
|---|
| CheerpJ Core | The runtime, loaded by a web page and served from your own infrastructure or the CheerpJ CDN | Java 8, 11, 17 and 21, with Java 25 in preview | Chrome, Edge, Firefox and Safari, with mobile |
| CheerpJ Applet Runner | A Manifest V3 browser extension that runs Java applets on existing web pages | Java 8 | Chrome and Edge |
| CheerpJ JNLP Runner | A Manifest V3 browser extension that runs Java Web Start (JNLP) applications from the browser | Java 8 | Chrome and Edge |
Java versions
Each Java version runs on its own full build of OpenJDK, including its native JNI code compiled to WebAssembly. The class library is the full JDK’s, not only the JRE subset. CheerpJ Core runs Java 8 unless you choose another version with the version option of cheerpjInit.
| Java version | OpenJDK build | CheerpJ Core | Applet Runner and JNLP Runner |
|---|
| Java 8 | 8u512 | Full support, and the default | Full support |
| Java 11 | 11.0.33 | Full support | Not available |
| Java 17 | 17.0.21 | Full support | Not available |
| Java 21 | 21.0.13 | Full support | Not available |
| Java 25 | 25.0.5 | Preview | Not available |
- Java 6 and 7 are supported on CheerpJ LTS versions, available on request, and so are specific OpenJDK runtime versions.
- CheerpJ is committed to supporting future Java long-term support releases.
- The browser extensions run Java 8 only. Java 8 is the last long-term support release to include the Java plug-in and Java Web Start, so the applets and JNLP applications the extensions serve were built for it, and a single runtime keeps the extensions small.
Application types
| Type | Support |
|---|
| Standalone Java applications | Run from their JAR files, unchanged |
| Java applets | On Java 8, through CheerpJ Core on your pages or the Applet Runner on pages you do not control |
| Java Web Start (JNLP) | On Java 8, through CheerpJ Core or the JNLP Runner |
| Oracle Forms and Oracle EBS | Forms 6i, 10g, 11g and 12c applications, and the Forms-based parts of Oracle E-Business Suite, without desktop Java |
| Java libraries | Called from JavaScript in a web application |
Java language and bytecode
| Area | Status | Notes |
|---|
| Java language | Supported | Runs any Java SE application without source changes |
| Bytecode | Supported | 100% of the Java bytecode, executed by a multi-tier JVM |
| Reflection | Supported | Works without rewrites |
| Proxy classes | Supported | |
| Dynamic constructs | Supported | Including invokedynamic and lambdas |
| Custom class loaders | Supported | Including dynamic class loading |
| Encrypted or obfuscated bytecode | Supported | |
| Threads and garbage collection | Supported | Java threads take turns on the page’s thread; the browser collects garbage |
The how CheerpJ works page explains how the JVM runs the bytecode.
Class libraries and system features
| Area | Status | Notes |
|---|
| Core class libraries | Supported | The full OpenJDK class library of Java 8, 11, 17, 21 and 25 |
| HTTP and HTTPS | Supported | Through the browser’s networking, under the browser’s security model |
| TCP and UDP | Supported | Through Tailscale, with a relay and control server you host, or a custom networking backend |
| Virtual file systems | Supported | Read-only files from your server, browser storage for the page’s origin, and memory |
| Local files | Supported | Through browser uploads and downloads, or integration with the File System Access API |
| Clipboard | Supported | Internal to the Java VM by default; the system clipboard is optional |
| Printing | Supported | Pages are rendered to images and passed to the browser’s print dialog |
| Audio | Supported | |
| Process execution | Not supported | Runtime.exec is rejected, unless you supply a JavaScript function to run in its place |
Native code
| Area | Status | Notes |
|---|
| OpenJDK native methods | Supported | OpenJDK’s own JNI code, compiled to WebAssembly |
| Application native methods | Supported | When compiled to WebAssembly or implemented in JavaScript |
| Pre-built native binaries | Not supported | Files such as .dll and .so cannot run in a browser; JavaScript integration can replace them with web-native code |
UI frameworks
| Framework | Status | Notes |
|---|
| Swing | Supported | Standard Swing applications, with a built-in window manager |
| AWT | Supported | Standard AWT widgets |
| JavaFX | Not supported | |
| SWT | Not supported | |
Browsers
| Browser | Minimum version |
|---|
| Google Chrome | 96 |
| Microsoft Edge | 96 |
| Other Chromium-based browsers | Chromium 96 |
| Mozilla Firefox | 79 |
| Safari on macOS | 15 |
| Chrome for Android | 96 |
| Firefox for Android | 79 |
| Safari on iOS and iPadOS | iOS 15 |
These are the first versions with every WebAssembly and JavaScript feature CheerpJ relies on. On iOS and iPadOS every browser uses Safari’s engine, so Chrome and Firefox there follow the Safari minimum. CheerpJ needs WebAssembly and JavaScript enabled.
CheerpJ 5.0 also includes an experimental WasmGC engine, switched on when you start CheerpJ. It needs Chrome or Edge 137, Firefox 153 or Safari 27 or later, which on iPhone and iPad means iOS and iPadOS 27.
Deployment
- CheerpJ Core and the application are static files, served from any web server or CDN, including servers inside your own network. There is no server-side process, API or database.
- The server needs to support HTTP Range requests. Production deployments should use HTTPS, with MIME types and caching headers configured. CheerpJ relies on the browser’s HTTP cache, so JAR files without caching headers are downloaded again on every visit. The Basic Server Setup guide covers configuration.
- CheerpJ Core can also be loaded from the CheerpJ CDN.
- The Applet Runner and JNLP Runner can be installed from the Chrome Web Store and Edge Add-ons, or force-installed by Group Policy from an internal update URL, with no public store involved.
- Self-hosted deployments can be fully air-gapped, and they never update automatically: you choose when to test and deploy a new release.
Security
Execution model
- Java runs inside the browser tab, with no local JVM, plug-in, service, installer or admin rights on the workstation, and no IE mode.
- Same-origin policy, CORS and Content Security Policy apply. CheerpJ adds no privileges beyond those of a normal web page, apart from the extensions’ own permissions.
- Java code cannot reach the local disk, start operating-system processes or load pre-built native binaries. Files leave only as browser downloads and enter only as user uploads.
- CheerpJ runs in the user’s existing browser session, so SSO, VPN and proxy settings apply as usual. It stores no credentials.
- The system clipboard needs the user’s permission or a central policy.
Network traffic
| Deployment | Traffic |
|---|
| CheerpJ Core | Browser to your web server or CDN over HTTPS: the page, the runtime files, the JARs and application traffic |
| Browser extensions | The runtime is packaged in the extension. Pages, JNLP files, JARs and application traffic go to your servers over HTTPS |
| Direct TCP (optional) | A Tailscale (WireGuard) tunnel over HTTPS to a relay you host, which opens the connection to the application server. The control server is self-hosted too. Off by default, and enabled by an administrator with an auth key |
| Leaning Technologies and third parties | Not involved in any network traffic |
- Java HTTP connections use the browser’s TLS, certificate checks, proxies and cookies, so your certificate store and browser policies apply, with no Java keystore to configure.
- HTTP requests are upgraded to HTTPS on HTTPS pages.
- Services on a different domain from the page need to allow cross-origin requests from it.
- No new inbound ports or firewall rules are needed.
No outbound connections
There is no licence server, analytics, logging or metering, and no online licence check: the licence is verified in the browser, for CheerpJ Core and the extensions alike. Self-hosted, CheerpJ contacts neither Leaning Technologies nor any third party, so it runs on networks with no internet access.
Browser extensions
- Manifest V3 extensions for Chrome and Edge.
- Access to websites is optional for both, and policy can restrict it to your application’s hosts.
- Group Policy sets the runtime options, such as clipboard mode, the user-agent settings and the licence token.
Endpoint-security controls
| Control area | With CheerpJ | Stays with you |
|---|
| Security updates | The out-of-support desktop JRE, Java Plug-in and JInitiator can be removed from every endpoint. CheerpJ is a set of versioned files on your server, updated centrally | Browser patching, and when to deploy a new CheerpJ release |
| Secure configuration | No installer, local service, admin rights, plug-in or IE mode. Extension permissions and website access can be locked down by policy | Browser and extension policy |
| User access control | Unchanged | Authentication and authorisation, in the application and your SSO |
| Malware protection | Java code runs inside the browser sandbox and cannot start processes or load native binaries | Endpoint protection, and the application’s own code and dependencies |
| Firewalls | No new inbound ports, and no outbound internet access needed | Backend exposure, segmentation and firewall policy, including the Tailscale relay if you use one |
Releases
- The runtime, the OpenJDK class library and third-party native libraries are built from source in Leaning Technologies’ own CI.
- Each release is a versioned, immutable artifact, and archives come with checksums to verify before deployment.
Recommended configuration
- Serve the application and CheerpJ over HTTPS only.
- Host CheerpJ Core on your own web server or internal CDN, and the extensions at an internal update URL.
- Force-install the extensions by Group Policy, with website access limited to your application’s hosts.
- Remove the desktop JRE, the Java Plug-in and IE mode once the rollout is done.
The security page describes the model in more detail.
Integration patterns to review
These patterns work differently in a browser and may need an architectural review before deployment.
| Pattern | What to expect |
|---|
| System-level integration | Process execution, local system services and OS-level hooks need adjusting |
| Direct file access | Uploads and downloads work, but some workflows that read or write local files need re-architecting |
| Direct hardware access | USB devices, serial ports, smart cards and proprietary hardware need web-compatible APIs |
| JNI and native dependencies | Custom native libraries need a WebAssembly or JavaScript build |
| Low-level networking | Non-HTTP protocols and raw sockets need Tailscale or a custom networking backend |
Production use
CheerpJ has been in production since 2017, and Fortune 500 companies and government agencies use it. More than a million people ran a CheerpJ application in the last 12 months, and the browser extensions have more than 170,000 users. The customers page lists organisations that use CheerpJ.
Licensing
CheerpJ licences follow who uses the application.
| Licence | Covers | Priced |
|---|
| Community | Personal, educational and hobby use, one-person companies, non-commercial open source, and technical evaluation by organisations of any size | Free |
| Desktop | Java applications your organisation uses, through the Applet Runner, JNLP Runner or CheerpJ Core | Per desktop. Enterprise (Desktop) includes the self-hosted build |
| Application | Software you build with CheerpJ for customers or the public | Per developer for Small Business, with self-hosting as an option, and per application for Enterprise, which includes self-hosting and redistribution |
Full terms and prices are on the licensing page.