Why we open-sourced our plagiarism engine

Every plagiarism checker on the market asks you to do the same thing: paste in a document, get back a percentage, and trust it. Trust that the score means what it seems to mean. Trust that the corpus behind it is what the marketing page says. Trust that "no match" means the tool looked, not that it gave up.

We've been building plagiarism detection since 2014, and for most of that time we asked for the same trust. With the Noplag rebuild we decided to stop asking. The detection engine that powers every check on Noplag is open source, Apache 2.0 licensed, and runs on your own hardware if you want it to.

Black boxes are a bad fit for this job

A plagiarism report is not a casual artifact. It gets attached to a student's academic record, a journalist's byline, a legal filing. When a score can end someone's semester, "our proprietary algorithm flagged it" is not an acceptable explanation — for the accused or for the person doing the accusing.

The industry norm is the opposite of explainable. Scores come from undisclosed algorithms run against undisclosed corpora, and the tools rarely distinguish between "we found nothing" and "we didn't look very hard." If you've ever tried to work out why two tools gave the same essay a 4% and a 31%, you know the problem.

Our position: if you can't audit it, you shouldn't have to believe it.

What's actually open

The open-source engine is the real engine — the same code that runs every check on noplag.app, not a demo or a stripped-down mirror:

• The full detection pipeline. Text extraction, chunking, winnowing fingerprints for candidate retrieval, and character-exact alignment for the final matches. If a passage is flagged, you can trace the exact code path that flagged it.
• The evaluation harness. We benchmark against PAN, the standard academic plagiarism-detection corpus, and the harness that produces our published numbers ships with the engine. Run it yourself; you should get our numbers.
• The schema and API. The same report format, down to character offsets, whether you use our cloud or your own server.

What you pay us for is operation at scale: the hosted corpus with hundreds of millions of indexed documents, the live-web layer, the app around the engine. That split is deliberate. The part that makes accusations — the detection logic — is the part that must be auditable. The part that costs money to run is the part we charge for.

Honesty is a feature, so it's in the code

Publishing the engine forced a discipline we've come to like: the code can't overclaim. The repository says exactly what the engine detects today — verbatim and near-verbatim copying — and exactly what it doesn't yet: paraphrase, translation, AI-generated text. Those are on the roadmap, and they'll ship when they pass evaluation, not when marketing wants them to.

The same discipline shows up in the product. Reports disclose sources that were checked but not flagged, so "no match" is a statement you can inspect. If a very long document hits the time budget, the report says coverage was partial instead of pretending the scan was complete. None of that is normal for this industry. All of it is easier to commit to when anyone can read your code.

What this means in practice

If you're a user, probably nothing changes day to day — you still paste text and read a report. But the guarantees underneath are different:

• You can verify claims. Detection accuracy, corpus behavior, the meaning of a score — all reproducible from the public repository.
• You can leave. The engine runs on your infrastructure. If we disappear tomorrow, your plagiarism checking doesn't.
• You can keep sensitive documents at home. Law firms and research groups can self-host so privileged material never touches our servers — the strongest privacy guarantee there is, because it doesn't require trusting us at all.

The engine, the benchmarks, and the docs are at noplag.com/docs. Read the code. That's the point.