Open-source plagiarism checker.
The only plagiarism detection product with a production cloud tier and a fully open-source engine. The same code that runs at noplag.com is on GitHub at github.com/NoplagLabs/noplag-engine — audit it, fork it, self-host it.
Same commit you check at noplag.com is the commit on GitHub.
No “open-source-ish” hedging. No SDK-only repo with the engine behind closed code. The chunker, fingerprinter, retrieval cascade, and report assembler are all in the same Apache 2.0 repo that builds our production container.
The plagiarism-detection engine that powers noplag.com — chunking, winnowing fingerprints, retrieval cascade, alignment, and report assembly. Apache 2.0.
- LANGUAGE
- Python · Rust
- LICENSE
- Apache 2.0
- CONTRIBUTORS
- 38
- COMMITS
- 2,847
- LATEST RELEASE
- v0.4.2 · 3 days ago
- CI
- passing · 412 tests
Closed source was a bug, not a feature.
Every plagiarism checker before us asked you to trust a black box. Trust the score. Trust the methodology you can't see. Trust that the algorithm wasn't tuned to over-flag your writing style. We picked the opposite bet.
What you can't see, you can't trust
A similarity score is a number with no provenance attached. Was it a sentence-overlap match, a paraphrase guess, an AI-detector hallucination? Was your ESL writing style calibrated for? Closed checkers won't say — because their advantage IS that you can't ask. We don't accept that as the price of plagiarism detection.
Open-source product, not open-source marketing
The Apache 2.0 repo at github.com/NoplagLabs/noplag-engine isn't a stripped client SDK with the matching algorithm behind closed code. The chunker, winnowing fingerprinter, retrieval cascade, alignment, dedupe, and report assembly all build the same Docker container that runs at noplag.com. The cloud tier adds the corpus + the web-search adapters, not the engine.
What that means for you
Read the algorithm before you trust the score. Self-host the engine on your own infra if your documents can't leave it. Fork it if our roadmap diverges from yours. Audit how chunk-level intervals merge into a similarity number — and disagree with us in a public issue if you find a bug.
Four-layer retrieval cascade. Diagram, not a metaphor.
Each layer narrows the candidate set with a cheaper-to-expensive accuracy trade-off. Every layer is in the open repo. The cloud adds the corpus + the web-search adapters.
Winnowing fingerprints
GIN-indexed 64-bit overlap on bigint[] columns in Postgres. Filters billions of candidate chunks down to top-K in O(log n) per query.
MinHash LSH — v1.1 roadmap
Approximate Jaccard across paraphrased and lightly-mutated copies, to catch what L1 misses after real rewording. Designed, not yet implemented — it is not in the public repo.
Sentence embeddings — v1.2 roadmap
Multilingual SBERT vectors with pgvector ANN, for semantically-equivalent rewrites and cross-language copying. Designed, not yet implemented — it is not in the public repo.
Live web verification
Google + Brave adapters resolve top-N candidates against the live web in real time. Runs on the cloud tier for paid plans; the adapters are not part of the open-source package.
noplag.toml.What's actually in the repo.
Not an SDK wrapper. Not a stripped client. The detection algorithm in full — same package layout that builds our production container.
- src/noplag_engine/the package
- chunking/sentence + sliding-window chunkers
- fingerprinting/winnowing 64-bit hashes
- retrieval/L1 today; L2 / L3 / LW not in this package yet
- l1_winnowing.pyGIN-overlap top-K
- fingerprint_df.pydocument-frequency stats
- stop_list.pynon-discriminative fingerprint filter
- alignment/seed-and-extend interval merge
- workflows/Temporal-orchestrated check pipeline
- api/FastAPI HTTP surface
- reports/highlight assembly + PDF export
- tests/412 tests · pytest + property + integration
- migrations/Alembic schema migrations
- Dockerfilesame image as production
- docker-compose.ymlself-host quickstart
- LICENSEApache 2.0
- README.mdarchitecture + quickstart
- 12.4kGitHub stars
- 38contributors
- 2,847commits
- 412tests in CI
- 1:1cloud / repo parity
Three things a closed-source checker can't let you check.
Closed checkers ship a number. The threshold for “plagiarism vs paraphrase”, the weighting between n-gram overlap and semantic similarity, the way short matches get dropped — all behind closed code. You can't reproduce it, your auditor can't review it, and a bug in it never has a reference commit to point at.
What you can verify: every threshold, every weight, every dedupe rule lives in src/noplag_engine/. Open a tagged release on GitHub, find the exact commit your check ran on (returned in the X-Engine-Commit header), and read the math line-by-line.
Where did your document go after submission? Was it stored? Was it added to a shared submissions DB another customer can hit? Was it sent to a third-party AI-detection vendor for grading? Closed checkers can answer in marketing copy. They can't show you the code path.
What you can verify: the workflows/ package shows every place a submission is read, hashed, persisted, and purged. The migrations/ folder shows every column it touches. The api/ package shows what leaves the engine over the network — and where you can swap the boundary in a fork.
A black-box “63% similar” is a verdict with no provenance. Was it 63% across 12 short fragments? One long paragraph? A retrieval mismatch? Does your ESL writing style get weighted differently? The score arrives, but the math that produced it doesn't.
What you can verify: alignment/ exposes the seed-and-extend interval merge. reports/ shows how per-chunk matches collapse into the overall percentage. You can re-run the same document against the same commit, inspect every interval, and disagree with the math in a public GitHub issue.
Two ways to run the same engine.
Most users pick the cloud tier at noplag.com — managed Postgres + Temporal + Coolify, the corpus is already indexed, and the web-search adapters come with valid API keys. The self-host path is for organizations whose documents can't leave their infrastructure: clone the repo, bring your own Postgres and Redis, point the engine at your own corpus (or import OpenAlex + Common Crawl from our manifest), and wire your own Google/Brave keys. Same engine, same algorithms, same report shape — only the operational boundary moves.
Read the self-host guideThe open-source questions we actually get.
- Is the engine really the same code as noplag.com?
- Yes. The Dockerfile in the repo builds the container image we deploy. Every check at noplag.com runs that commit, and the commit hash is returned in the X-Engine-Commit response header so you can pin a check to a tagged release. The cloud tier adds the corpus and the web-search API keys — not a different algorithm.
- Why Apache 2.0 and not AGPL or BSL?
- Apache 2.0 lets organisations self-host without legal review burden. AGPL would force us into license-as-moat positioning, which conflicts with the bet — we want auditors and forkers to actually use this. The defensible part is the corpus and the operational tier, not the algorithm.
- Can I self-host without using the cloud tier at all?
- Yes. Clone the repo, run `docker compose up`, bring your own Postgres + Redis, and import the public-corpus manifest (OpenAlex + Common Crawl + Wikipedia). The Layer-W adapters are pluggable — drop in your own Google/Brave API keys, or skip Layer W entirely if you only need indexed-corpus matching.
- Is the Noplag Database (submitted user documents) open?
- No. The Noplag Database contains user submissions and stays on the cloud tier — Apache-2.0-ing other people's documents would be obviously wrong. Submitted documents are added to it by default; you can opt out and turn that off. The engine code that queries it is open; the data is not.
- What about the AI detector — will that be open too?
- Yes. AI detection is coming soon — it's on the v1.2 roadmap, not live at launch — and it ships open like everything else: the perplexity model wiring, the calibration, the ESL-bias adjustment, and the verdict bands will all live in src/noplag_engine/ai_detection/. The model weights themselves are open-source (Qwen 2.5 1.5B 4-bit on the CPU tier, optional Mistral 7B on the GPU tier). No closed third-party detector in the call graph.
- How do I report a bug in the matching algorithm?
- Open a public GitHub issue with a minimal-reproducer document (or describe the false-positive interval). We triage in the open. Security issues go to security@noplag.com first.
- Will the cloud tier always ship the same algorithm as the repo?
- Yes by policy. If we ever needed to ship cloud-only behaviour for an experiment, it'd be behind a feature flag with an open-source default; the algorithm of record stays in main. If we broke that, you'd see it in the response header and in the public release notes.
- What's the contribution model?
- Issues and small PRs welcome. For larger changes — new retrieval layers, new corpus adapters, new languages — start an RFC issue first so the architecture conversation is in the open. We don't accept PRs that add closed-source dependencies, telemetry phoning home, or vendor lock-in.
- Is there a hosted self-host? (Managed Apache 2.0 deployment)
- Not yet. The Enterprise plan on the cloud tier offers dedicated infrastructure and BYO-corpus, which covers most of what people ask the question for. A managed-self-host SKU is on the v1.2 roadmap.
- How does this affect pricing?
- It doesn't. The cloud tier is priced on the corpus + operational cost (Hetzner + Coolify + Stripe + Lago + web-search API spend), not engine licensing. Self-host is free. Both stay that way.
Read the algorithm. Then run it yourself.
github.com/NoplagLabs/noplag-engine is Apache 2.0. The cloud at noplag.com runs the same commit. Either path gets you the same engine — pick the operational boundary that fits your data.