Welcome to the download page for the general edition of Bouncy Castle Java. In addition to the available access options, including GitHub, Maven Central, and direct download, you will find searchable release notes and links to API and other documentation.

The Bouncy Castle Java jars are mirrored on the Maven central repository
We facilitate effortless downloads through bouncycastle.org, simplifying the process for our users.
Access the Bouncy Castle APIs Java package on GitHub, where you can also report issues, join discussions, and contribute to the software.
Explore the Bouncy Castle for Java documentation online for concise guidance and examples.
You can ask questions and learn from specialists in the Bouncy Castle Java forum on GitHub Discussions. We highly appreciate and value your input.
If you encounter any issues that require attention, feel free to report them in our GitHub repository.
Find out detailed information about the latest release and search in older release notes.
The current working betas, when available, for the next release for JDK 1.8 and later can be found here. If you need a beta to be made available for another version of Java please ask by emailing: feedback-crypto@bouncycastle.org.
Supporting Bouncy Castle is now a substantial effort, the Java API is now over 300,000 lines, the C# one well past 140,000.
Except where otherwise stated, this software is distributed under the regular Bouncy Castle license. For full details of other licenses involved, see Third party licenses.
To confirm the integrity of the distributions, checksums are available:
If you are trying to confirm the signatures for artifacts from Maven Central, you can use the public key linked below.
Find out detailed information about the latest Bouncy Castle Java releases and search in older release notes.
Bouncy Castle 1.87 is mainly a security and correctness release. It fixes twelve CVEs affecting OpenPGP key merging, RFC 3161 time-stamp validation (which no longer accepts MD5 imprints), X.500 name comparison, CMS and MIME parsing, PKIX revocation checking, and the NTRU+ and SNTRU Prime post-quantum KEMs. It also includes more than 200 other defect fixes across ASN.1/OER decoding, TLS 1.3, certificate path validation, the BCFKS, PKCS#12 and JKS key stores, and the ML-DSA, ML-KEM and SLH-DSA implementations.
New capabilities include OpenPGP post-quantum support per RFC 9980, composite ML-KEM through javax.crypto.KEM, updated HPKE, MLS, Merkle Tree Certificate and C509 drafts, Ascon algorithms in the BC provider, full RFC 4211 CRMF controls, and OpenPGP smart-card signing. There are also large speedups for SM9 (about 120× for pairing), BLS12-381, the NTRU-family KEMs, Blake3 and ChaCha20-Poly1305. Several changes are incompatible with 1.86, including HQC, Merkle Tree Certificates, C509 and ML-KEM key derivation. The old XMSS and LMS implementations under org.bouncycastle.pqc.crypto are removed, and Classic McEliece is deprecated.
For more information on the 1.87 release, see the release notes on GitHub.
If you have not already, please consider either donating or getting a support contract so that we can keep this software Free, Open Source, and Maintained. Think of it as an investment in the future.
If you do not feel you can support the project at the moment there are no hard feelings, we know what it is like to be under-resourced. Just select option 3 and proceed, you can get back to us later! Entering fake email addresses simply wastes our time, we would much rather devote our efforts to improving the libraries.