- Home
- Package Registries
- Maven Central
Maven Central
8161 Maple Lawn Blvd #250, Fulton, MD 20759, United States
What it is
Maven Central is a public distribution platform for release-ready community open-source software in the Java ecosystem. It is the default repository for Apache Maven, SBT, and other build systems, and tools such as Apache Ant/Ivy and Gradle can also use it. The website supports searching and browsing components, popular packages, namespaces, and categories. Publishers can submit releases through Maven with the central-publishing-maven-plugin; they need user-token credentials in settings.xml, and uploads are checked against repository requirements. Its free plan costs nothing and is for ordinary community open-source publishing, with monthly file-count, release-size, and release-count limits. Higher limits or exemptions can be reviewed. HTTPS is intended to protect artifact downloads, while checksums and GPG signatures help verify component identity. Published components are not removed or modified. Sonatype does not pre-screen materials or guarantee component safety, though it maintains known-vulnerability information through Nexus Lifecycle and a limited version in Nexus Repository Manager Repository Health Check.
For and against
For
- Free plan for community open-source publishing
- Default repository for Apache Maven and SBT
- Search and browse components and packages
- Checksums and GPG signatures help verify identity
Against
- Monthly publishing limits apply to the free plan
- Sonatype does not pre-screen materials or guarantee component safety
- Private packages are not supported
The verdict
Maven Central provides component discovery and publishing for community open-source Java projects. Its free tier has monthly limits, and users should note that components are not pre-screened for safety.
Who it suits
It suits Java developers and publishers who need to find or distribute community open-source components through common build tools.
Plans and prices
Free
ordinary community open-source publishing · monthly file-count, release-size and release-count limits · higher-limit or exemption review available
Read 1 Oct 2026 · central.sonatype.org
Maven Central Publisher Pro
higher publishing capacity · dedicated support · required for commercial-nature artifacts from October 1, 2026
Read 1 Oct 2026 · sonatype.com
On the record
- Account login
- The Central Portal supports Google and GitHub social logins as well as username and password accounts.central.sonatype.org · read 1 Oct 2026
- Component discovery
- The Maven Central website provides OSS component search, browsing, popular packages, namespaces and categories.central.sonatype.com · read 1 Oct 2026
- Default repository
- The Central Repository is the default repository for Apache Maven, SBT and other build systems.central.sonatype.org · read 1 Oct 2026
- Immutability
- Published components are not removed or modified, and checksums and GPG signatures help users verify component identity.central.sonatype.org · read 1 Oct 2026
- Partner program
- Maven Central partners can receive exposure, Sonatype partner certification and joint marketing opportunities.central.sonatype.com · read 1 Oct 2026
- Publishing authentication
- Maven publishing requires user-token credentials configured in settings.xml.central.sonatype.org · read 1 Oct 2026
- Publishing validation
- Uploaded components are validated against Maven Central requirements before publication.central.sonatype.org · read 1 Oct 2026
- Publishing workflow
- The Central Publisher Portal supports publishing through Maven using the central-publishing-maven-plugin.central.sonatype.org · read 1 Oct 2026
- Repository purpose
- The Central Repository is a public distribution platform for release-ready community open-source software in the Java ecosystem.central.sonatype.org · read 1 Oct 2026
- Security limitation
- Sonatype says it does not pre-screen materials and cannot guarantee the safety of components in Maven Central.central.sonatype.org · read 1 Oct 2026
- Security transport
- HTTPS connections to Central are intended to prevent man-in-the-middle attacks against artifact downloads.central.sonatype.org · read 1 Oct 2026
- Support
- Publishers can contact [email protected] for usage reviews, higher limits, exemptions or commercial-scale publishing guidance.central.sonatype.org · read 1 Oct 2026
- Tool integrations
- Central can be used from Apache Ant/Ivy, Gradle and many other tools.central.sonatype.org · read 1 Oct 2026
- Usage monitoring
- The Usage Center shows organization-level release size, file count and release count metrics.central.sonatype.org · read 1 Oct 2026
- Vulnerability intelligence
- Sonatype maintains a database of known vulnerabilities for Central artifacts through Nexus Lifecycle, with a limited version in Nexus Repository Manager Repository Health Check.central.sonatype.org · read 1 Oct 2026
