The most secure way to get a Java runtime on Mac is to install a maintained OpenJDK distribution such as Eclipse Temurin through Homebrew, which gives you the correct native build for your chip, avoids Oracle's licensing traps, and makes staying patched trivial. The old habit of grabbing a standalone "JRE" installer from a web page is where most Mac Java security problems begin, because that runtime then sits unmanaged and unpatched for years.
If you searched for how to install a java runtime mac setup, you probably found a dozen conflicting answers. Let us cut to the version that is both correct and secure in 2025, including the Apple Silicon specifics.
Temurin via Homebrew is the recommended path
Homebrew detects your Mac's architecture automatically and installs the matching native build, whether you are on Apple Silicon or Intel. Eclipse Temurin is a free, certified OpenJDK distribution that is functionally equivalent to Oracle's JDK but is not encumbered by Oracle's commercial licensing.
# Install a current LTS Temurin build
brew install --cask temurin
# Or pin a specific major version
brew install --cask temurin@21
Homebrew places the JDK under /Library/Java/JavaVirtualMachines/, the standard macOS location. Apple's launcher at /usr/bin/java searches that directory, so you generally do not need to edit your PATH by hand. Confirm the install:
java -version
/usr/libexec/java_home -V
The java_home command lists every JDK macOS knows about, which matters when you have more than one installed and need to know which one actually runs.
To install Java on Mac M1, verify the native ARM64 build
The single most common mistake when you install Java on Mac M1 hardware is ending up with an x86_64 build running under Rosetta translation. It works, but it is slower and it is not the artifact you intended to run, which complicates both performance and provenance. When you install a Java runtime on Mac Apple Silicon, confirm you got the native aarch64 build:
java -XshowSettings:properties -version 2>&1 | grep os.arch
A value of aarch64 confirms a native ARM64 runtime. If you see x86_64, you installed an Intel build — reinstall the ARM64 variant. Homebrew normally gets this right on its own; the check matters most when someone hands you a manually downloaded archive.
The Oracle licensing trap
You can install a Java runtime on Mac by downloading Oracle's JDK directly — browse to oracle.com, pull the ARM64 compressed archive, and unpack it into /Library/Java/JavaVirtualMachines/. The technical steps are fine. The licensing is the trap. Oracle changed its Java licensing in January 2023 to a model that charges per employee across the entire organization, not per install. A developer casually installing Oracle JDK on a work Mac can create a commercial licensing obligation the company never intended. For most teams, a maintained OpenJDK build like Temurin, Azul Zulu, or Amazon Corretto sidesteps that entirely while giving you the same runtime.
JRE versus JDK, and why it matters for updates
The classic "Java Runtime Environment" as a separate, publicly distributed installer is largely a thing of the past. Modern distributions ship the JDK, and you either run applications directly or build a trimmed runtime with jlink. The security consequence is positive: a JDK installed and updated through Homebrew stays current, whereas the old standalone JRE was notorious for lingering unpatched on machines long after critical fixes shipped. If your app genuinely needs only a runtime, produce a minimal one from a current JDK rather than installing a stale legacy JRE:
jlink --add-modules java.base,java.logging \
--output ./runtime --strip-debug --no-header-files
Keeping the runtime patched
A Java runtime is a large native attack surface, and old versions accumulate known vulnerabilities. The reason to install through a package manager is that patching becomes one command:
brew update && brew upgrade --cask temurin
Set a cadence for this, or wire it into your machine provisioning. On the server side, the same discipline applies to the base images your Java services ship in — a java runtime mac install on a laptop is only half the story if your production containers carry an outdated JDK. An SCA scan of your images will flag an outdated or vulnerable JDK layer, and a platform such as Safeguard can catch that alongside your application dependencies. Our Academy has more on keeping runtime layers current in CI.
FAQ
What is the best way to install a Java runtime on Mac?
Install a maintained OpenJDK distribution such as Eclipse Temurin through Homebrew with brew install --cask temurin. Homebrew selects the right native build for your chip and makes patching a single command.
How do I install Java on Mac M1 correctly?
Use Homebrew, which installs the native aarch64 build automatically on Apple Silicon. Verify it with java -XshowSettings:properties -version 2>&1 | grep os.arch and confirm the value is aarch64 rather than x86_64.
Should I use Oracle JDK or OpenJDK on Mac?
For most teams, a free OpenJDK build like Temurin, Zulu, or Corretto is safer. Oracle's January 2023 licensing change charges per employee, so a casual Oracle JDK install can create an unintended commercial obligation. OpenJDK builds avoid that.
Do I still need a separate JRE?
Generally no. Modern distributions ship the JDK, and you can build a minimal runtime with jlink if needed. Installing and updating a JDK through a package manager keeps it patched, unlike the old standalone JRE that often lingered unpatched.