To install Maven you download the binary archive from the official Apache site, unpack it, point MAVEN_HOME at the folder, and add its bin directory to your PATH, with a working JDK already in place. That is the whole job on every operating system; the differences are just in how each OS sets environment variables. This guide walks through the Maven install on Windows, macOS, and Linux, then shows how to verify it and one security habit worth adopting from day one.
At the time of writing, the current recommended release is Apache Maven 3.9.16, which requires JDK 8 or newer to run. A 4.0.0 release is in preview but is not yet considered safe for production, so stick with the 3.9.x line unless you are deliberately testing 4.x.
Prerequisite: a working JDK
Maven runs on Java, so before anything else confirm you have a JDK, not just a JRE, and that it is on your path:
java -version
javac -version
If both print a version of 8 or higher, you are set. If javac is missing, install a JDK first, such as Temurin, Oracle JDK, or the one bundled with your distribution. Note where it lands, because you will need that path for JAVA_HOME.
Maven install on Windows
The Maven install on Windows is where most people stumble, almost always on environment variables. Here is the reliable path.
First, download the binary zip (for example apache-maven-3.9.16-bin.zip) from the Apache Maven download page and extract it to a stable location such as C:\Program Files\Apache\maven. Avoid a path with spaces if you can, and avoid your Downloads folder, since you do not want the tool moving later.
Next, set the environment variables. Open "Edit the system environment variables," then "Environment Variables." Add a new system variable:
Variable name: MAVEN_HOME
Variable value: C:\Program Files\Apache\maven\apache-maven-3.9.16
Confirm JAVA_HOME exists and points at your JDK folder (the directory that contains bin\javac.exe), not the bin folder itself:
Variable name: JAVA_HOME
Variable value: C:\Program Files\Java\jdk-17
Then edit the Path variable and add a new entry:
%MAVEN_HOME%\bin
Close every open terminal, open a fresh one, and verify (see below). The most common "how to install Maven in Windows" failure is editing Path but reusing an old terminal that never picked up the change. Always open a new shell.
If you prefer a package manager, Windows makes this a one-liner and handles the paths for you:
choco install maven
# or
winget install Apache.Maven
Maven install on macOS
The clean route on macOS is Homebrew:
brew install maven
mvn -version
Homebrew wires up the paths automatically, so there is usually nothing else to do. For a manual install, extract the archive to /opt/apache-maven-3.9.16, then add to your shell profile (~/.zshrc on modern macOS):
export MAVEN_HOME=/opt/apache-maven-3.9.16
export PATH=$MAVEN_HOME/bin:$PATH
Run source ~/.zshrc or open a new terminal.
Maven install on Linux
Many distributions ship Maven in their package repositories, which is the fastest option:
# Debian / Ubuntu
sudo apt update && sudo apt install maven
# Fedora / RHEL
sudo dnf install maven
The trade-off is that distro packages sometimes lag a version or two behind. For the latest release, install manually:
cd /opt
sudo tar -xzf ~/Downloads/apache-maven-3.9.16-bin.tar.gz
echo 'export MAVEN_HOME=/opt/apache-maven-3.9.16' >> ~/.bashrc
echo 'export PATH=$MAVEN_HOME/bin:$PATH' >> ~/.bashrc
source ~/.bashrc
Verify the installation
On every OS the check is the same:
mvn -version
A healthy result prints the Maven version, the Java version it is using, and the resolved JAVA_HOME:
Apache Maven 3.9.16
Maven home: /opt/apache-maven-3.9.16
Java version: 17.0.10, vendor: Eclipse Adoptium
If you get "command not found," your PATH entry is wrong or the terminal is stale. If Maven runs but reports the wrong or missing Java, fix JAVA_HOME. Those two cover nearly every install problem.
One security habit to adopt immediately
The moment Maven works, it will start pulling dependencies from Maven Central into your local ~/.m2/repository. That convenience is also an attack surface: a single vulnerable transitive dependency can carry a serious CVE into your build without any change to your own code. The Log4Shell incident (CVE-2021-44228 in Log4j 2) is the canonical reminder that a deeply-buried library can become an urgent problem overnight.
Two cheap habits pay off. First, pin your plugin and dependency versions explicitly rather than letting ranges float, so builds are reproducible. Second, run a dependency scan as part of your build. A software composition analysis pass will flag a transitive dependency with a known vulnerability that you would never spot by reading your pom.xml. If you work heavily with the Jackson data-binding library, our Jackson security guide goes into the specific deserialization risks worth watching. Adding the scan on day one is far easier than retrofitting it after your first advisory.
FAQ
What do I need before I install Maven?
A working JDK, version 8 or newer, since Maven runs on Java. Verify with java -version and javac -version; if javac is missing you have only a JRE and need to install a full JDK first.
How do I install Maven on Windows?
Download the binary zip from the Apache Maven site, extract it to a stable folder, set MAVEN_HOME and JAVA_HOME system variables, and add %MAVEN_HOME%\bin to your Path. Then open a new terminal and run mvn -version. Alternatively, choco install maven or winget install Apache.Maven handles the paths automatically.
Why does mvn -version say "command not found" after install?
Almost always because your PATH change has not taken effect. Close every open terminal and open a new one, since existing shells keep the old environment. If it still fails, recheck that the bin directory of your Maven folder is actually on the PATH.
Which Maven version should I install?
The current recommended release, Maven 3.9.16, which needs JDK 8 or newer. Maven 4.x exists only in preview and is not yet considered production-safe, so use the 3.9.x line for real work.