How to Copyright Software: Registering Source Code with the Copyright Office

How software copyright registration works in practice: which versions to register, how to deposit source code without exposing trade secrets, what the application asks for, and what it costs.

Copyright protection for computer software begins the moment original code is created and saved. Registration is a separate step, a filing with the U.S. Copyright Office that you need before you can sue for infringement in federal court and that, made in time, opens the door to statutory damages and attorneys’ fees. So the short answer to how to copyright software is that copyright law already gives you a copyright in your own software, and registering it is what makes that copyright enforceable in a lawsuit.

Registering a computer program means filing an application, paying the filing fee, and depositing an identifying sample of the source code, under rules that let you keep trade secrets and other sensitive information out of the public file. The process breaks into six steps, and the judgment calls inside them are where the work is. For how copyright fits with trade secrets, patents, and licenses, start with the Protection of Software page.

Why copyright registration matters when copyright protection is automatic

Copyright exists without registration; the Copyright Act says registration “is not a condition of copyright protection” (17 U.S.C. § 408(a)), so your software code has had legal protection since the day it was created, the same as any other creative work. What registration changes is your ability to do anything about copyright infringement. No infringement lawsuit over a U.S. work can be filed until “registration … has been made” (17 U.S.C. § 411(a)), and the Supreme Court held in Fourth Estate Public Benefit Corp. v. Wall-Street.com that the Office has to have acted on the application before you can sue. A certificate issued before or within five years of first publication is also prima facie evidence that the copyright is valid (17 U.S.C. § 410(c)), and the registration creates a public record of copyright ownership in the Office’s online records.

Statutory damages, attorneys’ fees, and the timing rule in copyright law

Statutory damages run from $750 to $30,000 per work, up to $150,000 for willful infringement, and a court can award attorneys’ fees to the prevailing party (17 U.S.C. §§ 504(c), 505). Under 17 U.S.C. § 412, neither remedy is available unless the work was registered before the copyright infringement commenced or within three months after first publication; miss both windows and you are limited to actual damages.

“Commenced” is a trap for anyone who registers after infringement occurs, because the Fourth Circuit held in Bouchat v. Bon-Ton Department Stores that a continuing infringement commences with the first act in the series, so a later registration will not restore statutory damages or fees for that course of conduct. The same rule shapes license disputes, since a vendor that registered before an over-deployment began can put statutory damages on the table in the audit negotiation. A registration calendar tied to your release process keeps the window open for the code that matters.

Source code is a literary work: what a software copyright registration covers

The Copyright Act treats computer programs as literary works (17 U.S.C. § 101). Source code and object code are both copies of the program, and a registration covers both, along with the screen displays the code generates when the same party owns everything. Copyright law protects the copyrightable expression in the way you wrote the code and leaves the functionality and methods it implements unprotected (17 U.S.C. § 102(b)). A second limit concerns versions. The Act states that “where the work has been prepared in different versions, each version constitutes a separate work,” so a registration for version 3.0 covers version 3.0 and nothing on either side of it, including a subsequent version you ship next quarter. A registration also leaves out previously published or registered code, public domain code, and code owned by someone else.

Step 1: Decide which versions of the computer program to register

Because each version is a separate work, the first judgment call is which ones deserve a registration. A registration for a new version covers the changes and additions that appeared in that version for the first time (17 U.S.C. § 103(b)), and the Office will not register a few minor revisions, so a continuous-deployment shop needs a cadence rule, such as registering major releases or any release that ships a materially new module. In the Limitation of the Claim section of the registration application you identify the preexisting material and describe the new material claimed (17 U.S.C. § 409(9)). A group option can cover up to ten unpublished versions on one application (37 C.F.R. § 202.4), but it requires a complete copy of each version, so the redaction options below do not apply automatically.

A software company in the Western District of North Carolina learned recently how much this matters. It deposited pages from its 2021 source code while stating on the application that the work was completed and first published in 2012; the court held that the application defines the claim, found the company knew or was willfully blind to the mismatch, and invalidated the registration under 17 U.S.C. § 411(b). In practice counsel starts with the current release, the code you would sue over tomorrow, and works backward through earlier versions still in customers’ hands so no gap is left for a defendant to exploit.

Step 2: Confirm the author and the claimant on the copyright claim

The application asks who wrote the code, whether it was a work made for hire, and who the claimant is, meaning who owns the copyright now. Code written by an employee within the scope of employment is a work made for hire, and the employer is the author (17 U.S.C. §§ 101, 201(b)). Software is not one of the nine statutory categories that can be a commissioned work made for hire, though, so a “work made for hire” recital in a contractor agreement does nothing for code, and the company needs a signed written assignment (17 U.S.C. § 204(a)) before it can list itself as claimant. The founder exit case study shows what happens when that paper is missing.

Open source and third-party components are carved out in the “Material Excluded” field, and so is AI-generated material that is more than de minimis, while the human-authored contributions remain claimable; the D.C. Circuit confirmed in Thaler v. Perlmutter that the Act requires a human author. Accuracy carries legal weight, because a registration with knowingly inaccurate information that would have caused the Office to refuse it can be invalidated (17 U.S.C. § 411(b)), and the Supreme Court held in Unicolors, Inc. v. H&M Hennes & Mauritz that good-faith mistakes are excused while willful blindness is not.

Step 3: Decide whether the software is published or unpublished under the Copyright Act

Publication is the distribution of copies to the public by sale or other transfer of ownership, or by rental, lease, or lending; a public performance or display “does not of itself constitute publication” (17 U.S.C. § 101). Installable software or downloads delivered to users under a license are typically treated as published, while hosted SaaS that never leaves your servers is generally not, and is usually registered as unpublished. The status matters because the three-month grace period in § 412 runs from first publication, so an unpublished work has no grace period at all, and because misstating the status or the date is one of the more common inaccuracies on software applications. For a hybrid product with an installed client and a hosted back end, deciding what was published takes a close look at the distribution model.

Step 4: Prepare the source code deposit without exposing trade secrets

The deposit is an identifying portion of the source code. The default rule under Circular 61 and 37 C.F.R. § 202.20(c)(2)(vii) is the first 25 and last 25 pages of source code, plus the page with the copyright notice if there is one. If the code contains trade secrets, the regulation gives you four alternatives:

• First and last 25 pages with the trade secret portions blocked out, provided the blocked-out portions are less than half and an appreciable amount of original code remains visible.
• First and last 10 pages of source code with nothing blocked out.
• First and last 25 pages of object code plus any 10 consecutive pages of source code with nothing blocked out.
• For programs of 50 pages or less, the entire source code with the trade secret portions blocked out, under the same limit.

The Office applies these rules strictly and refuses deposits that over-redact, and object code alone is accepted only under the “rule of doubt,” which produces a weaker registration.

In a working software practice the deposit usually gets built one of two ways: the first ten and last ten pages with nothing blocked out, whenever those pages are free of trade secrets, or the first and last twenty-five pages with the sensitive material blocked out and checked against the fifty percent limit. A modern repository needs a working definition of “first” and “last”; the practical one starts with the first file alphabetically in the root of the source directory and ends with the last, rolling into the next file when either is under ten pages. The deposit itself should be PDFs with line numbers and file names. Direct read access to the repository is the fastest route, since counsel can pull the version and select pages instead of trading calls with the engineering team; a first registration typically takes a few hours of attorney time. Keep an exact archived copy of the deposit with the commit reference, because in litigation the deposit is what gets compared to the accused code.

In Sysco Machinery Corp. v. DCS USA Corp., the Fourth Circuit held that a trade secret is extinguished when the material is deposited unredacted with the Copyright Office, because deposits are open to public inspection. Counsel’s job is to pick pages that satisfy the Office’s rules while keeping the sensitive parts of the code out of the file, and to write down why those pages were chosen.

Step 5: File the application with the Copyright Office

Applications are filed online, and company-owned or multi-developer code uses the Standard Application, since the Single Application is limited to one work by one individual author who is also the claimant (37 C.F.R. § 202.3). The form asks for the title and version, the year that version was completed, the publication status and date, the authors and their work-made-for-hire status, the claimant and any transfer statement, and the Limitation of the Claim entries, and the deposit PDFs are uploaded with it.

The Office’s filing fee for the Standard Application is currently $65, and special handling adds $800 per claim; fees change, so check the Office’s current schedule before you file. The effective date of registration is the day the Office receives the complete application, fee, and acceptable deposit (17 U.S.C. § 410(d)), and it does not wait for the certificate.

Step 6: Timing, special handling, and the public records after you file

As of the Office’s most recent reporting period, electronic claims average about 3.6 months to process, or about five months when an examiner writes back with questions. When you cannot wait, special handling is the expedited track for pending or prospective litigation, and the Office aims to act within five working days without guaranteeing it; the standard quote when a suit is imminent is the $65 filing fee plus the $800 special handling fee. Once the claim registers, you receive a registration certificate and a registration number, the claim appears in the Office’s online public records, and recording assignments against it under 17 U.S.C. § 205 puts the chain of title on the public record too.

Common mistakes software companies make with copyright registration

• Registering version 1.0 and stopping, so the current code has no § 412 protection of its own.
• Waiting until infringement is discovered, when the statutory damages window has usually closed.
• A deposit that reveals trade secrets, or one so redacted that the Office refuses it.
• Misstating the publication status, the date, or the completion year, so the application describes a different version from the deposit.

How copyright registration fits with your other software intellectual property

Registration protects the expression in your code, trade secret law protects what the deposit leaves out, and licenses control what customers may do with the copies they receive; the deposit strategy in Step 4 is how the first two coexist. This page explains how the registration process generally works and is not legal advice for any particular program (the site’s Disclaimer page has the details). When you are ready to talk to counsel, this is what will move the conversation fastest:

• Repository access for the version to be registered, with the commit identified
• The release history, how the software is delivered, and the date of first publication, if any
• Everyone who wrote code, with their employment agreements or contractor assignments
• An inventory of open source and third-party components, and how AI coding tools were used
• Any known infringement, demand letter, or deadline that would justify special handling

If a release is going out, a deal is in diligence, or someone has already copied your code, registration is worth a conversation with experienced software counsel while the timing still works in your favor.

Frequently asked questions