How to Install Java (JDK) on Windows and Linux, Safely

To install Java, pick one official JDK build and get it from that provider's own site or package repository. On Windows, run the provider's MSI or use winget, for example winget install EclipseAdoptium.Temurin.25.JDK. On Ubuntu or Debian, run sudo apt install openjdk-21-jdk or add a vendor repository; on RHEL, run sudo yum install java-21-openjdk-devel.

The rest of this guide covers doing it properly: what separates the JDK builds you will see (Eclipse Temurin from Adoptium, Oracle JDK, OpenJDK builds from Oracle on jdk.java.net, the Microsoft Build of OpenJDK, and your Linux distribution's own OpenJDK packages), which version to choose, how to verify the file, how to run several JDKs side by side, and how to keep up with Java's quarterly security updates. Every command comes from the provider's own documentation, linked under Sources. On a Mac, see our separate guide to installing and verifying Java on macOS.

Key takeaways

• Most developers need a JDK, which includes the runtime plus the compiler (javac). Install a JRE only on machines that run Java applications and never build them.
• Several providers build the same OpenJDK source. They differ in license, support period, installers and verification, not in the language. This guide ranks none of them.
• The long term support (LTS) lines are 8, 11, 17, 21 and 25. For new projects, 25 or 21 gives the longest runway; check your framework's supported versions first.
• Java security fixes arrive on a quarterly schedule. Oracle's October 2026 Critical Patch Update, published 20 October 2026, contains 55 new security patches for Oracle Java SE, and Oracle says 49 of them may be remotely exploitable without authentication.
• Verify before you run. Temurin, Oracle and Microsoft publish SHA-256 files for their downloads. Temurin and Microsoft also publish detached .sig signatures, and the Adoptium and Oracle Linux packages are signed for your package manager to check.
• Keep JAVA_HOME and PATH on the same JDK, remove old JDKs, and check versions everywhere after each quarterly release.

JDK or JRE: what do you actually need?

The JRE (Java Runtime Environment) runs compiled Java programs. The JDK (Java Development Kit) contains the JRE plus the tools to build them, such as javac, jar and jshell. Red Hat's documentation puts it plainly: if you are unsure whether you need the JRE or the JDK, install the JDK.

Some providers still package a separate runtime:

• Adoptium offers temurin-<version>-jre packages and a smaller jre-headless package that leaves out GUI libraries such as AWT.
• Red Hat names its packages so the difference is easy to miss: java-21-openjdk is the runtime, and java-21-openjdk-devel is the JDK with javac.
• Oracle publishes the JDK on its download page; its roadmap says free public Java SE 8 updates for personal and development users continue through java.com.

If a game or desktop application asks for Java, follow that application's own instructions and download Java only from java.com, the application vendor or a provider page listed here, never from a forum link or pop up.

Which OpenJDK build should you choose?

Every build below is compiled from OpenJDK source. The table summarizes each provider's own pages as fetched on 23 October 2026. It is not a ranking; pick the build whose license and support terms fit your organization.

A few notes on reading that table:

• Oracle JDK licensing changed recently for JDK 21. Oracle's download page states that the OTN license used for JDK 21 updates 21.0.13 and greater "is substantially different from prior Oracle JDK 21 licenses." It permits personal and development use at no cost, and other uses may need a paid subscription. The same change happened for JDK 17 from update 17.0.13, in October 2024.
• Oracle JDK 25 is free for all users for now. Oracle states that JDK 25 receives updates under the NFTC until September 2028, a year after the next LTS, and that later JDK 25 updates are planned under the OTN license.
• Adoptium is community supported, on a best effort basis; its support page points organizations that need a service level to commercial support providers.
• Red Hat's install guide lists a registered RHEL subscription as a prerequisite.
• Ubuntu certifies some of its builds. Ubuntu's developer documentation says OpenJDK 17 and 21 are TCK certified on Ubuntu 24.04 LTS.

Which Java version should you install?

Java ships a new feature release every six months, and every two years one of them is designated long term support. Adoptium describes the cadence like this: OpenJDK produces "a new feature release every six months, and a maintenance/security update based upon each active release every three months." Non-LTS releases stop receiving updates when the next feature release arrives.

As of 23 October 2026:

Oracle's dates apply to customers with a commercial support entitlement. Oracle lists Java 29, planned for September 2027, as the next LTS, noting that dates "are subject to change."

How to decide:

1. Check what your framework and build tools support. Their documentation is the deciding source.
2. For new work, prefer an LTS line. 25 is the most recent LTS. 21 is widely supported and still has years of updates from every provider above.
3. Avoid non-LTS releases in production unless you are prepared to upgrade every six months. Java 26 reached end of service in September 2026, six months after it shipped.

How to avoid fake "Java download" sites and bundled installers

"Java download" is heavily searched, which attracts lookalike pages that bundle adware into repackaged installers or serve outdated builds. A developer machine holds source code, signing keys and cloud credentials, so a bad installer is costly.

Stick to these rules:

1. Type the provider's address yourself. The official starting points are adoptium.net (Temurin), oracle.com/java/technologies/downloads (Oracle JDK), jdk.java.net (OpenJDK builds from Oracle), learn.microsoft.com/java/openjdk (Microsoft Build of OpenJDK) and java.com (Oracle's consumer Java 8 runtime).
2. Prefer a package manager you already trust. winget on Windows, or apt, dnf and yum on Linux, check signatures or hashes that a web page cannot. Adoptium itself says "the recommended way to install Eclipse Temurin on most systems is through a package manager."
3. Ignore sponsored results and download managers. None of the providers in this guide distribute through download managers or repack sites, and this guide links no third party mirrors.
4. Do not trust a file name. Anyone can name a file OpenJDK25U-jdk_x64_windows_hotspot.msi. Only a hash or signature check tells you what you actually have.
5. Watch the URL behind redirects. Temurin downloads resolve to github.com/adoptium/... release assets through api.adoptium.net; Microsoft's links start with aka.ms/download-jdk; Oracle's start with download.oracle.com. If a link lands anywhere else, stop.

How to install the JDK on Windows, step by step

The steps below use Eclipse Temurin's MSI because Adoptium documents every installer option publicly. Oracle and Microsoft installers follow the same pattern; their differences are noted at the end of this section.

Step 1: download the installer from the provider

Go to the Temurin releases page linked from adoptium.net/installation/windows, choose your version, Windows and x64, and download the .msi file. Adoptium notes that its Windows installer packages are supported only on Windows x64. At the time of writing the newest Temurin builds are the August 2026 releases, for example OpenJDK25U-jdk_x64_windows_hotspot_25.0.4.1_1.msi and OpenJDK21U-jdk_x64_windows_hotspot_21.0.12.1_1.msi. The October 2026 updates are covered in the patching section below.

Download the matching .sha256.txt file from the same release.

Step 2: verify the installer before running it

Compare the installer's hash with the published value. Adoptium's documentation gives certutil for Command Prompt:

certutil -hashfile <downloaded_file>.msi SHA256

Or, in PowerShell, using the pattern from Adoptium's CI guide:

$ExpectedHash = (Invoke-WebRequest -Uri "$DownloadUrl.sha256.txt").Content.Split(" ")[0]
$ActualHash = (Get-FileHash $FileName -Algorithm SHA256).Hash
if ($ExpectedHash -ne $ActualHash) {
    Write-Error "Checksum verification failed!"
    exit 1
}

If the hashes differ, delete the file and download it again from the provider. The GPG signature check, which is stronger, is covered in the verification section.

Step 3: run the installer and choose features

Double click the MSI, accept the license if you are happy with it, and stop at the Custom Setup screen. By default Temurin installs to C:\Program Files\Eclipse Adoptium\ followed by a folder for the package, with these features:

Two choices matter for security and sanity:

• Turn on JAVA_HOME if you use Maven, Gradle or an IDE that reads it. Leaving it unset, or pointing at an older JDK, is the most common cause of "wrong version" problems.
• Think about the .jar association. It is convenient, but it also means a double clicked .jar from a download folder runs immediately. On machines where nobody launches desktop Java applications, you can deselect it.

Adoptium documents FeatureOracleJavaSoft as a way to stop an older Oracle Java from launching through PATH after Temurin is uninstalled. Only select it if you are replacing an Oracle Java install.

Click Next, then Install, then Finish.

Step 4: confirm the install

Open a new terminal window, because existing windows keep the old PATH, and run:

java -version
javac -version

Both should report the version you just installed. If javac is not found, you installed a JRE rather than a JDK, or PATH points somewhere else; see "Common errors" below.

Silent installs for IT teams

For fleet deployment, Adoptium documents silent MSI installs. This example installs Temurin, updates PATH, associates .jar files and sets JAVA_HOME:

msiexec /i <package>.msi ADDLOCAL=FeatureMain,FeatureEnvironment,FeatureJarFileRunWith,FeatureJavaHome INSTALLDIR="c:\Program Files\Temurin\" /quiet

Adoptium notes that you must use INSTALLDIR with FeatureMain. INSTALLLEVEL=1 is a shortcut for the three default features:

msiexec /i <package>.msi INSTALLLEVEL=1 /quiet

The Microsoft Build of OpenJDK's legacy MSI accepts the same feature names. Microsoft's newer EXE installer uses different switches, documented on its install page:

.\<package>.exe /SILENT /SUPPRESSMSGBOXES /ALLUSERS /TASKS="FeatureEnvironment,FeatureJarFileRunWith" /DIR="C:\Program Files\Microsoft\"

Microsoft warns to use only one installation method (EXE, MSI or ZIP) at a time for each JDK version; uninstall before switching methods.

Installing with winget

winget installs the same vendor installers from the command line. Adoptium's install page lists:

winget install EclipseAdoptium.Temurin.25.JDK
winget install EclipseAdoptium.Temurin.11.JDK

Microsoft documents:

winget search Microsoft.OpenJDK
winget install Microsoft.OpenJDK.25

Use the exact package ID from the provider's documentation, not a lookalike search result.

Oracle JDK on Windows: what is different

Oracle's installer uses C:\Program Files\Java\jdk-25 by default and copies java.exe, javaw.exe, javac.exe and jshell.exe into C:\Program Files\Common Files\Oracle\Java\javapath. If you later install another provider's JDK and still see Oracle's version, check whether that folder appears in PATH ahead of your intended JDK. Oracle also warns not to replace a JDK while Java processes are running.

The ZIP archive route

Archives need no administrator rights. Adoptium documents:

Expand-Archive -Path .\<downloaded_file>.zip -DestinationPath .
set PATH=%cd%\<extracted_directory>\bin;%PATH%
java -version

To make it permanent, Adoptium suggests System Properties, then Environment Variables, or:

setx JAVA_HOME "C:\path\to\<extracted_directory>"
setx PATH "%JAVA_HOME%\bin;%PATH%"

Be careful with that second setx on a machine with a long or carefully ordered PATH. Editing PATH in the Environment Variables dialog lets you see exactly what changes.

How to install the JDK on Ubuntu and Debian

Option 1: your distribution's OpenJDK packages

This is the simplest route, updated by your normal apt upgrades. Ubuntu's developer documentation gives:

sudo apt install default-jdk

To pick a specific LTS:

sudo apt install openjdk-21-jdk

The general pattern is openjdk-<version>-jdk. Ubuntu also mentions a community maintained OpenJDK snap; for production machines, the archive packages for your LTS release are the conservative choice.

Option 2: the Adoptium apt repository (Temurin)

Adoptium's Linux page documents adding its signed repository. First, install the prerequisites:

sudo apt install -y wget apt-transport-https gpg

Download the Adoptium GPG key and store it as a trusted apt key:

wget -qO - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/adoptium.gpg > /dev/null

Before you trust that key, check its fingerprint. Adoptium's GPG page names the signing key as 3B04D753C9050D9A5D343F39843C48A565F8F04B. A key you download over HTTPS from the same server as the packages is only as trustworthy as that server, so comparing the fingerprint against the documentation is a cheap extra check.

Add the repository for your release codename:

echo "deb https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | sudo tee /etc/apt/sources.list.d/adoptium.list

Adoptium notes that on Linux Mint you must replace VERSION_CODENAME with UBUNTU_CODENAME. Then install:

sudo apt update
sudo apt install temurin-25-jdk

Package names follow temurin-<version>-jdk, for example temurin-21-jdk or temurin-8-jdk. Adoptium points out that its repository URLs are meant for package managers and may return 404 in a browser; that is expected.

Note that /etc/apt/trusted.gpg.d/ is trusted for every configured repository; if your organization requires per repository keyrings, apply that policy here.

Option 3: the Microsoft repository (Microsoft Build of OpenJDK)

Microsoft documents this for Ubuntu 18.04, 20.04, 22.04 and 24.04:

ubuntu_release=`lsb_release -rs`
wget https://packages.microsoft.com/config/ubuntu/${ubuntu_release}/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
sudo apt-get install apt-transport-https
sudo apt-get update
sudo apt-get install msopenjdk-25

For Debian, Microsoft's page uses the same steps with https://packages.microsoft.com/config/debian/$(lsb_release -rs)/packages-microsoft-prod.deb. For other Ubuntu versions, Microsoft says to use the tar.gz package.

Option 4: Oracle JDK .deb

Oracle publishes a Debian package on its download page. After downloading and verifying it (see the verification section), Oracle documents:

sudo dpkg -i jdk-25_linux-x64_bin.deb

The JDK lands in /usr/lib/jvm/jdk-25-oracle-x64. Note that a downloaded .deb installed with dpkg does not add a repository, so it will not update with apt upgrade. You have to repeat the download each quarter.

Confirm the install

java -version
javac -version

How to install the JDK on RHEL, Fedora and other RPM distributions

Option 1: Red Hat build of OpenJDK on RHEL

Red Hat documents installing the JDK with yum on a registered system:

sudo yum install java-21-openjdk-devel
javac -version

For a runtime only, install java-21-openjdk. The same pattern works for other lines: java-17-openjdk, java-11-openjdk and java-1.8.0-openjdk, each with a -devel package for the JDK. To see what is installed:

sudo yum list installed "java*"

On RHEL 8 and later, dnf accepts the same package names.

Option 2: the Adoptium RPM repository (Temurin on RHEL, Fedora, CentOS)

Adoptium documents adding a repository file. The gpgcheck=1 line is what makes dnf verify every package signature:

# Uncomment and change the distribution name if you are not using CentOS/RHEL/Fedora
# DISTRIBUTION_NAME=centos
sudo cat <<EOF > /etc/yum.repos.d/adoptium.repo
[Adoptium]
name=Adoptium
baseurl=https://packages.adoptium.net/artifactory/rpm/${DISTRIBUTION_NAME:-$(. /etc/os-release; echo $ID)}/\$releasever/\$basearch
enabled=1
gpgcheck=1
gpgkey=https://packages.adoptium.net/artifactory/api/gpg/key/public
EOF

One practical catch: as written, the redirect > /etc/yum.repos.d/adoptium.repo runs in your own shell, not under sudo, so it fails for a normal user. Run it from a root shell, or write the same content with sudo tee. Then install:

sudo dnf install temurin-25-jdk

Or with yum: sudo yum install temurin-25-jdk. Adoptium also lists JRE packages, such as temurin-21-jre, and a headless runtime, temurin-21-jre-headless. Confirm with:

java -version
rpm -qa | grep temurin

Option 3: Oracle JDK RPM

Oracle documents installing its downloaded RPM on any RPM based distribution:

sudo rpm -ivh jdk-25_linux-x64_bin.rpm

And upgrading:

sudo rpm -Uvh jdk-25_linux-x64_bin.rpm

Oracle's RPMs are signed with Oracle Linux keys. On other distributions, rpm will warn that it cannot verify the signature, with a message like Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY. That is a missing key, not a broken package, and Oracle documents the fix:

wget https://yum.oracle.com/RPM-GPG-KEY-oracle-ol9
sudo rpm --import RPM-GPG-KEY-oracle-ol9

Do not "fix" a NOKEY warning by turning signature checking off. Import the right key, then install again so the signature is actually checked.

On Oracle Linux itself, Oracle prefers its repositories, with two packages that together form the full JDK:

sudo dnf install jdk-25-headless
sudo dnf install jdk-25-headful

Oracle documents that its RPM installs integrate with the alternatives framework and that you can check which package provides java with:

rpm -q --whatprovides java

Option 4: an archive on any Linux

Archives work without root. Adoptium documents:

tar xzf <openjdk_binary>.tar.gz
export PATH=$PWD/<extracted_directory>/bin:$PATH
java -version

Add the export line to ~/.bashrc or ~/.zshrc to make it permanent. Red Hat's archive instructions also set JAVA_HOME and check it:

export JAVA_HOME=~/jdks/java-21
printenv | grep JAVA_HOME
export PATH="$JAVA_HOME/bin:$PATH"

Oracle's equivalent is tar zxvf jdk-25_linux-x64_bin.tar.gz, which creates a jdk-25 directory. Remember that nothing updates an archive install for you.

How do you verify a JDK download?

Checksums: what they prove and what they do not

A SHA-256 checksum proves that the file on your disk matches the file the provider listed. It catches corruption and swapped files on a mirror. It does not prove who made the file if an attacker controls the page that lists the checksum. Adoptium says it directly: checksums verify a download was not corrupted, but "they may also be compromised in a man-in-the-middle attack." A signature made with a key you obtained and checked separately closes that gap. For more on the distinction, see checksum vs signature: which to trust for a download.

Use both when you can: the checksum as a quick sanity check, the signature as the real proof.

Eclipse Temurin: SHA-256 and GPG

Every Temurin archive and installer has a .sha256.txt file next to it. On Linux, Adoptium documents checking it in one step, run in the directory that holds the download:

wget -O- -q -T 1 -t 1 <url_to_checksum_file> | sha256sum -c

Adoptium's documented hash commands for each OS are sha256sum <file> on Linux, shasum -a 256 <file> on macOS and certUtil -hashfile <file> SHA256 on Windows.

For the signature, Adoptium publishes a .sig file at the binary URL with .sig appended. Its GPG page walks through it. First, the signature check:

gpg --verify <binary_filename>.sig <binary_filename>

Without the key you will see Can't check signature: No public key, along with the key ID. Fetch the key by its full fingerprint:

gpg --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B

Run the verify command again. You should see Good signature from "Adoptium GPG Key (DEB/RPM Signing Key)", plus a warning that the key is not certified with a trusted signature. That warning means you have not personally marked the key as trusted. It does not mean the signature is bad. What matters is that the fingerprint gpg prints matches the one on Adoptium's page. Adoptium documents gpg --edit-key 3B04D753C9050D9A5D343F39843C48A565F8F04B trust to remove the warning; only do that after you have compared the fingerprint.

Oracle JDK: SHA-256 per file

Oracle's Java download page lists a sha256 link next to every file, for example https://download.oracle.com/java/25/latest/jdk-25_windows-x64_bin.msi.sha256, and links the Oracle Linux 9 GPG key for its RPMs. Compare with certutil or Get-FileHash on Windows and sha256sum on Linux, as above. For RPMs, importing the Oracle Linux key (shown earlier) lets rpm check the package signature itself.

Microsoft Build of OpenJDK: SHA-256 and signatures

Microsoft's download page links a .sha256sum.txt file for every package and a .sig file for the tar.gz and zip archives, for example microsoft-jdk-25.0.4.1-windows-x64.zip.sig. The page links Microsoft's public key for verifying those .sig files. The .exe, .msi and .pkg installers have checksum files listed but no .sig link.

OpenJDK builds on jdk.java.net

Each build on jdk.java.net has a sha256 link; we found no detached signatures on that page.

Repository installs

When you install through apt or dnf from a configured repository, the package manager checks repository metadata and package signatures against keys you imported. That is why the key import step matters, and why gpgcheck=1 must stay on in the Adoptium repo file.

Managing multiple JDKs

Many developers need several JDKs at once. The aim is to always know which one runs.

On Linux: alternatives

Debian, Ubuntu and RHEL use the alternatives system to decide which java is on the default path. Red Hat documents switching interactively:

sudo update-alternatives --config 'java'

On Debian and Ubuntu, update-java-alternatives switches java, javac and the other tools together. Its manual page documents -l to list installed JDKs, -s to set one and -a to return to automatic mode. Microsoft gives this example for its own package:

sudo update-java-alternatives --set msopenjdk-25-amd64

Run update-java-alternatives -l first and use a name from that list; switching only java can leave javac on another version.

On Windows: JAVA_HOME and PATH order

Windows has no alternatives system. Two variables decide which JDK runs:

• PATH decides which java.exe a terminal finds. The first match wins.
• JAVA_HOME is read by Maven, Gradle, many IDEs and many scripts.

Keep them consistent. If you use the Temurin or Microsoft MSI with FeatureJavaHome, the installer sets both. If you install several JDKs, decide which one is the default, make sure its bin folder appears before the others in PATH, and point JAVA_HOME at the JDK folder itself, not at its bin subfolder.

In your build: pin the version per project

Do not rely on whatever JDK happens to be default on a machine. Maven and Gradle can both select a JDK per project with toolchains. Gradle can also download one automatically; our post on whether to allow Gradle's toolchain JDK auto download covers the trade offs, because an automatic download is a download you did not verify yourself. For Maven setup, see how to install Maven.

How do you keep Java patched?

The quarterly cadence

OpenJDK security updates ship four times a year. Oracle publishes its Critical Patch Updates on a fixed schedule, and the next dates it lists are 19 January 2027, 20 April 2027, 20 July 2027 and 19 October 2027. Oracle also publishes a pre-release announcement on the Thursday before each update. Microsoft states that its updates ship every quarter, in January, April, July and October, and Adoptium follows the same OpenJDK schedule, typically the third Tuesday of those months.

The October 2026 update shows why this matters. Oracle's Critical Patch Update of 20 October 2026 lists 55 new security patches for Oracle Java SE and says 49 of them "may be remotely exploitable without authentication." The affected versions it lists include Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27.

Plan for provider lag

Builds from different providers do not all appear on the same day. Adoptium says its binaries can take "up to three weeks" after the upstream date while it completes build and test cycles, with the most popular platforms usually within a few days. When we checked on 23 October 2026, Adoptium's API still returned the August 2026 builds (25.0.4.1, 21.0.12.1 and 17.0.20.1) as the latest, with 25.0.5, 21.0.13 and 17.0.21 listed as due in October. Oracle's download page already offered JDK 21.0.13 and 17.0.21.

So subscribe to your provider's announcements and to Oracle's Critical Patch Update notices (Oracle offers email and RSS), patch within your normal window after your provider ships, and read the risk matrix while you wait. Adoptium also notes that OpenJDK sometimes ships out of cycle security releases with four part version numbers, such as 25.0.5.1.

Update commands for each route

One Windows gotcha from Adoptium's documentation: MSI upgrades only work across the first three digits of the version number, because of a Windows Installer limitation. Upgrading 8.0.2.1 to 8.0.3.1 works, but 8.0.2.1 to 8.0.2.2 does not; uninstall the previous MSI and install the new one. That matters for releases such as 25.0.4.1, which add a fourth digit. Adoptium also states that Temurin "does not provide upgrades for major versions," so 21 to 25 is a side by side install, not an upgrade.

After any update, open a new terminal and run java -version to confirm the running version actually changed. A machine with two JDKs can update one and keep running the other.

How do you uninstall old JDKs cleanly?

Old JDKs keep their vulnerabilities, and tools can still find them through registry keys, alternatives or a stale JAVA_HOME. Remove what you no longer use.

Windows

• Oracle JDK: Oracle documents removing it with Add/Remove Programs (Settings, then Apps, on current Windows). For silent removal, Oracle documents MsiExec.exe /X followed by the product's uninstall GUID, which you find under HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Uninstall by searching for the version string, for example jdk-25. Oracle's example:

MsiExec.exe /X{B1405ADC-C0CA-5E63-B1E0-51F5A9A2627C}

That GUID is Oracle's example for JDK 18; yours will differ. Append REBOOT=R to suppress a reboot.

• Temurin and Microsoft MSI or EXE installs: remove them from Settings, then Apps, like any other application.
• Old Oracle Java 8 runtimes: java.com offers a Java Uninstall Tool, which java.com says works only on Windows.
• ZIP installs: delete the folder, then remove its entries from PATH and JAVA_HOME.

Linux

Remove packages with the same package manager that installed them. The apt manual documents remove, purge (which also removes configuration files) and autoremove (which removes dependencies nothing else needs). For example, with the package names used above:

sudo apt remove openjdk-17-jdk
sudo apt autoremove

On RHEL and Fedora, remove the package with dnf or yum, using the exact name shown by sudo yum list installed "java*". For Oracle RPMs, rpm -q --whatprovides java shows which installed package provides java. For archive installs, delete the directory and remove the PATH and JAVA_HOME lines from your shell profile.

Cleanup on any OS

Afterwards, check that JAVA_HOME, PATH (including Oracle's javapath folder on Windows) and, on Linux, the alternatives default no longer point at the removed JDK, then run java -version and javac -version.

Common errors and how to fix them

"'java' is not recognized as an internal or external command"

Windows cannot find java.exe on PATH. Either the installer's PATH feature was deselected, or you are in a terminal opened before the install. Open a new terminal first. If that does not help, add the JDK's bin folder to PATH in System Properties, then Environment Variables, or reinstall with FeatureEnvironment selected.

"javac: command not found" or javac missing on Windows

You installed a runtime, not a JDK. On RHEL that usually means java-21-openjdk without -devel; with Temurin packages it means a -jre package. Install the JDK package. If you do have a JDK, PATH may find a runtime first; on Linux, update-java-alternatives -s switches javac together with java.

"JAVA_HOME is set to an invalid directory" or JAVA_HOME points to a JRE

JAVA_HOME must point at the JDK's top level folder, such as C:\Program Files\Eclipse Adoptium\ plus the JDK folder name, or /usr/lib/jvm/jdk-25-oracle-x64, not at its bin folder and not at a runtime. Build tools that need javac fail when it points at a runtime. Fix the variable, then open a new terminal.

UnsupportedClassVersionError

This error means a class was compiled for a newer Java release than the one running it, and the message names the class file version. The JVM specification defines which class file major versions each Java release accepts; a Java SE 25 runtime accepts major versions 45 through 69. Run the application with the newer JDK the class requires, or rebuild it targeting the older release your runtime supports.

Common mistakes

• Downloading Java from a search ad or a "free download" site instead of the provider's own page or a package manager.
• Skipping verification because the download came over HTTPS, which protects the transfer, not the content.
• Choosing a build without reading its license, especially for Oracle JDK 17 and 21 updates under the OTN license.
• Running a non-LTS release in production and missing that its updates ended six months after release.
• Letting JAVA_HOME and PATH drift apart, so the terminal and the build tool use different JDKs.
• Installing with dpkg or rpm from a download and forgetting that nothing will ever update that JDK automatically.
• Assuming a quarterly update is installed everywhere without checking java -version on CI agents, build images and servers.
• Turning off gpgcheck or ignoring a NOKEY warning instead of importing the right key.

Where Safeguard fits, honestly

Safeguard does not install a JDK, update the JDK on your laptop or check the version of Java on a developer machine. Choosing a provider, verifying the download and applying the quarterly update with the commands above is your job.

Where Safeguard helps is in what you build and ship with that JDK. Safeguard scans repositories, container images and SBOM files (safeguard scan --dir ., --image <name> or --sbom <file>) and lists their components, including the Maven and Gradle dependencies a Java project declares. When a JDK or JRE ships inside a container image you build, an image scan lists it among the image's packages, so an old runtime in an image shows up as a finding rather than surviving unnoticed. Components are matched against vulnerability databases, reachability analysis ranks the findings your code actually calls, and the platform shows every project that contains a given component and version. When a fixed version exists, autonomous remediation can open a pull request that bumps the dependency in pom.xml or build.gradle. Remediation ships switched off by default.

Fix it without waiting for upstream

The JDK itself you patch with the quarterly updates above. The libraries your Java projects pull from Maven Central are a different story: they carry their own vulnerabilities, on their own maintainers' schedules, and that is where the next section applies.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

FAQ

How do I install Java on Windows 11?

Choose a provider, download its x64 MSI or EXE from the provider's own site, check the SHA-256 with certutil -hashfile or Get-FileHash, and run it with the PATH and JAVA_HOME options selected. Or use winget with the provider's documented ID, such as winget install EclipseAdoptium.Temurin.25.JDK or winget install Microsoft.OpenJDK.25. Open a new terminal and run java -version.

How do I install Java on Ubuntu?

Run sudo apt install default-jdk for Ubuntu's default JDK, or sudo apt install openjdk-21-jdk for a specific LTS. If you want Eclipse Temurin or the Microsoft Build of OpenJDK, add the provider's signed apt repository as shown above and install temurin-25-jdk or msopenjdk-25.

Which version of Java should I install?

For new projects, an LTS release: 25 is the newest LTS and 21 is widely supported. Check that your framework and build tools support it. Avoid non-LTS releases in production, because they stop receiving updates after six months.

Is Java free to use?

Eclipse Temurin and the jdk.java.net builds are free under GPLv2 with the Classpath Exception, and Linux distributions ship OpenJDK in their repositories; check Microsoft's pages for its build's terms. Oracle JDK 25 and 27 are currently under Oracle's No-Fee Terms and Conditions. Oracle JDK 8, 11, 17 and 21 updates come under the OTN license, which is free for personal and development use; other uses may need a paid subscription.

How do I set JAVA_HOME?

On Windows, select the JAVA_HOME feature in the Temurin or Microsoft MSI, or set it in System Properties, then Environment Variables, pointing at the JDK folder (not its bin folder). On Linux, add export JAVA_HOME= followed by your JDK path to ~/.bashrc, then export PATH="$JAVA_HOME/bin:$PATH", and check with printenv | grep JAVA_HOME.

How do I check which version of Java I have?

Open a new terminal and run java -version and javac -version. If they disagree, PATH or alternatives point at different installs.

How do I verify that my Java download is genuine?

Compare the file's SHA-256 with the .sha256 file the provider publishes next to it. For Temurin, also run gpg --verify against the .sig file and check that the signing key fingerprint is 3B04D753C9050D9A5D343F39843C48A565F8F04B, as published by Adoptium. Microsoft publishes .sig files and a public key for its archives.

How often do I need to update Java?

Every quarter. Security updates ship in January, April, July and October; Oracle's next dates are 19 January, 20 April, 20 July and 19 October 2027. Providers can lag by days or weeks, so watch your own provider's announcements.

See how Safeguard would help

None of these demos install a JDK. They show what happens one step later, once that JDK is building projects full of third party libraries. If you want to try the CLI yourself, download it from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli .

The first demo is a real CLI session. After install, safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The demo project uses npm; on a Java project you would ask the same way about a vulnerable library in pom.xml or build.gradle, and approve each build and test command just as you approve npm here.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and then scans from the terminal. It shows how to get dependency inventory and vulnerability checks running locally once your JDK and projects are in place.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. If you use an assistant while upgrading Java projects, this is how you let it look up findings and safe versions without giving it more access than you intend.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Adoptium: Install Eclipse Temurin
• Adoptium: Windows MSI installer packages
• Adoptium: Linux (RPM/DEB/APK) installer packages
• Adoptium: Archive installation
• Adoptium: What is GPG signing?
• Adoptium: Using the Adoptium API in CI/CD pipelines
• Adoptium: Temurin support and release roadmap
• Adoptium: FAQ
• Adoptium API: available releases
• OpenJDK: Download and install
• jdk.java.net: JDK builds from Oracle
• jdk.java.net: OpenJDK JDK 27 GA release builds
• Oracle: Java downloads
• Oracle: JDK 25 installation guide
• Oracle: Installation of the JDK on Microsoft Windows platforms (JDK 25)
• Oracle: Installation of the JDK on Linux platforms (JDK 25)
• Oracle: Java SE support roadmap
• Oracle: Critical Patch Updates, Security Alerts and Bulletins
• Oracle: Critical Patch Update Advisory, October 2026
• Oracle: Java Virtual Machine Specification, Java SE 25, chapter 4
• java.com: Java Uninstall Tool
• Microsoft Learn: Install the Microsoft Build of OpenJDK
• Microsoft Learn: Download the Microsoft Build of OpenJDK
• Microsoft Learn: Support roadmap for the Microsoft Build of OpenJDK
• Ubuntu for Developers: How to set up a development environment for Java
• Ubuntu manpage: apt(8)
• Ubuntu manpage: update-alternatives(1)
• Ubuntu manpage: update-java-alternatives(8)
• Red Hat: Installing and using Red Hat build of OpenJDK 21 on RHEL

Last reviewed: 23 October 2026.