"We don't register our code because it's a trade secret." I hear this often, and it rests on a wrong assumption. You can register a program and keep nearly all of its source code out of the Copyright Office's files.

The short answer: the Copyright Office asks for the first 25 and last 25 pages of source code, not the whole program. If the code contains trade secrets, you can block out the secret portions or use one of several smaller deposits. The registration still covers the entire program.

Why register code you keep secret

Copyright and trade secret law protect different things, and source code can have both.

  • Trade secret law protects the code's confidentiality, for as long as you take reasonable measures to keep it secret. 18 U.S.C. § 1839(3).
  • Copyright protects the code's expression against copying, whether or not it stays secret.

If the code leaks, is taken by a departing engineer, or is decompiled and reused, a copyright registration made before the copying gives you access to statutory damages and attorney's fees. 17 U.S.C. § 412. You also need a registration to file an infringement suit at all. 17 U.S.C. § 411(a). The two protections work well together, and the deposit rules were written so you can have both.

The deposit options

The rules are in 37 C.F.R. § 202.20(c)(2)(vii), and the Office summarizes them in Circular 61, Copyright Registration of Computer Programs.

If the code has no trade secrets:

  • the first 25 and last 25 pages of source code for the version being registered
  • or the entire source code, if the program is 50 pages or fewer

If the code contains trade secrets, any one of these:

Option What you deposit
A First 25 and last 25 pages of source code, with the trade secret portions blocked out. The blocked-out portions must be less than half of the deposit.
B First 10 and last 10 pages of source code, with nothing blocked out
C First 25 and last 25 pages of object code, plus 10 or more consecutive pages of source code with nothing blocked out
D For a program of 50 pages or fewer: the entire source code, with the trade secret portions blocked out (again, less than half)

In every case, include the page that carries the copyright notice, if there is one.

Object code alone is also accepted, but the Office then registers under its "rule of doubt," because it can't examine object code for copyrightable authorship. That weakens the registration. Use a source code option if you can.

What "first" and "last" mean for a real codebase

The rule was written when a program was one long listing. A modern application is hundreds of files across several directories, with no natural first or last page. The Office's guidance for that case is to submit 50 pages that reasonably represent the first and last portions of the code.

Some practical points from doing this:

  • You assemble the listing, so choose the order sensibly. Concatenate source files into one document in a defensible order, such as the build order or alphabetical by path. Then look at what lands in the first and last 25 pages.
  • Lead with code that's yours and not sensitive. Entry points, configuration scaffolding, interface definitions, and utility modules usually reveal little. Don't arrange the listing so that third-party or generated code fills the deposit. The deposit should show your original authorship.
  • Strip secrets that aren't code. API keys, credentials, internal hostnames, and customer names shouldn't be in a deposit, or in the repository for that matter.
  • Redact with opaque blocks, not highlighting, and flatten the PDF so the text underneath is removed.
  • Keep the exact deposit and the full source snapshot it came from. Tag the commit. In litigation you'll have to show what the registered version contained, and a hash of the archived snapshot is the cleanest proof.

Is the deposit public?

Deposits are part of the Copyright Office's records and can be inspected by the public at the Office. Copies are released only in limited circumstances, such as to the owner or for litigation. That's why the choice of pages and the redactions matter: assume someone can read the 20 to 50 pages you submit.

Depositing redacted portions under these rules is consistent with treating the code as a trade secret. The secret lives in what you didn't disclose.

What the registration covers

  • The whole program, not only the pages deposited.
  • The screen displays the program generates, if the same claimant owns them. A separate registration for the screens isn't required.
  • One version. Each version with new copyrightable authorship is a separate work. A registration of version 3 covers what's new in version 3, and earlier versions need to be registered themselves or identified as preexisting material.

What it doesn't cover, and what the application should exclude:

  • Open-source and third-party components. Identify them as preexisting material.
  • Earlier published or registered versions.
  • Code generated by an AI tool with no human authorship. The Office's guidance asks applicants to disclose and exclude AI-generated material that is more than minimal.
  • HTML. The Office doesn't register HTML as a computer program. Website text and graphics are registered as what they are.

How often to register

Registering every commit is pointless. A workable schedule:

  • At first public release.
  • At each major version, or yearly for continuously deployed products.
  • Before a known risk: a financing, a key departure, a partner integration, or a dispute.
  • Before release, in groups, if you have several unpublished versions. Up to ten can go on one application. See Group registration of unpublished works.

Keep the trade secret side intact

Registration doesn't replace secrecy. To keep trade secret protection you still need reasonable measures: access controls on the repository, confidentiality and assignment agreements with everyone who touches the code, offboarding that removes access, and care about what's sent to outside tools and vendors.

Ownership also has to be right before you file. See Who owns the code your developer wrote?

Practical takeaways

  • Registering software discloses at most 50 pages, and you can block out the sensitive parts.
  • Choose and prepare the deposit deliberately. It's the only part anyone outside can read.
  • Register at release and at major versions, before anything goes wrong.
  • Keep the snapshot. You'll need to prove what you registered.

I've written software and I register it. If you'd like help preparing a deposit that protects the code and reveals as little as possible, get in touch.

Primary authority

Related resources

This article provides general information and is not legal advice. Copyright Office practices and fees change, and the law varies by circuit; confirm current requirements at copyright.gov and consult qualified counsel about your situation.