FAQ
One of the best ways that you can support the JASP project is by citing it. Citations are an important measure of how widely software is used, and an important indicator to funding bodies of JASP’s relevance.
To cite JASP in publications use:
JASP Team (2026). JASP (Version 0.98.0)[Computer software].
And the BibTeX entry :
@MISC{JASP2026,
AUTHOR = {{JASP Team}},
TITLE = {{JASP (Version 0.98.1)[Computer software]}},
YEAR = {2026},
URL = {https://jasp-stats.org/}
}
No, JASP will never collect any user-identifiable information.
First, download JASP from our download page.
If you’re on Windows, you can go ahead and install JASP without having to do anything else.
If you’re on Mac OS X, take a look at our installation guide.
If you’re on Linux, please follow the steps described on the download page.
JASP can open the following file types:
- .csv, .tsv, and .txt (any text files with comma/semicolon/colon/tab separated columns)
- .sav, .zsav and .por (SPSS files)
- .sas7bda, .sas7bcatt and .xpt (SAS files)
- .ods (Open Document Spreadsheet format, used by software such as OpenOffice, LibreOffice, and Excel)
- .xls/.xlsx (Microsoft Excel)
- .dta (Stata files)
- .rdata, .rds (R Data File)
- .mwx, .mpx (Minitab files)
In recognition of Bayesian pioneer Sir Harold Jeffreys, JASP stands for Jeffreys’s Amazing Statistics Program.
JASP itself consists of two different executables which are licensed under slightly different terms.
The JASP-Engine, where our R code runs, is distributed under GNU GPLv2
The JASP-Desktop, the user interface, is distributed under GNU Affero GPL v3
Both licenses are available here as a single pdf document.
JASP uses R and several third-party R-packages from CRAN for its analyses, and it is impossible to check all of this code thoroughly. Although CRAN does a good job at keeping malicious packages out of their repositories there is a always a chance such infiltration may happen. The same possibility exists for R-packages developed by third parties as part of JASP modules. To try and avoid any compromised package from wreaking havoc on the user’s system, JASP has implemented a Windows sandbox around R. The Windows sandbox limits what can be accessed by any analysis or R-code running in JASP:
1. File system restrictions
The Windows sandbox uses an allow-list approach: the engine process can only interact with a small number of explicitly approved locations. In particular:
User workspace directory
Used for:
Reading user-selected data files.
Writing analysis results and exported models/outputs.
Confined to this dedicated path; no ambient access to arbitrary folders such as Documents, Desktop, network drives, or other application data.
Application data directory (engine infrastructure)
A dedicated folder under the application’s data area.
Used for:
Inter-process communication (IPC) between the GUI and the engine.
Logs and temporary engine files.
Not a general-purpose scratch space for user data.
All other file system locations are blocked for the sandboxed engine. This means that R code (including any code from R packages shipped with or used by JASP) cannot read or modify arbitrary files on the machine.
2. Network restrictions
By default, the sandboxed engine has no network access:
No outbound connections (e.g., cannot send data to external servers).
No inbound connections.
No implicit access to proxies, mapped endpoints, or internal services.
This design directly mitigates the classic “malicious package phones home” scenario: even if an R package or script attempted to exfiltrate data, the call would be blocked at the sandbox boundary.
3. Execution control
Key properties of the sandboxed engine:
It runs only the JASP-managed R environment and packages shipped or configured with JASP.
It is invoked and controlled solely by the trusted GUI application.
Communication between GUI and engine is limited to:
Structured messages (analysis requests, results) via controlled IPC.
Files in the dedicated application data directory.
The engine cannot spawn arbitrary unsandboxed helper processes with broader privileges (by design and by sandbox policy).
4. Main application trust boundary
The main JASP executable:
Contains only JASP’s own source code plus well-known libraries such as Qt.
Is built from an open-source codebase publicly available for review on GitHub.
Is distributed as a digitally signed binary so organizations can validate authenticity during deployment.
Because the GUI does not execute untrusted plugin binaries or interpret arbitrary R code outside the engine, the main application forms a relatively narrow and auditable trusted computing base.
Yes — More importantly, it is released under a Free and Open Source license, which means that even if we turn evil, we will not be able to take JASP away or prevent others from contributing to it, working on it, or distributing it freely. This excerpt from our license sums it up nicely:
The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program — to make sure it remains free software for all its users.
Our HECVAT is available here.
If you are interested in learning more about our accessibility statement, click here (VPAT 2.5R).
JASP is currently supported by long-term, multi-million euro grants that help fund a team of motivated software developers, academics, and students. Our three main software developers and several core team members have tenured positions. The Psychological Methods Group at the University of Amsterdam is dedicated to long-term support for JASP.
Also we are developing a JASP educational community between several institutions of higher learning, see Community and visions.
Finally, the JASP code is open-source and will always remain freely available online. In sum, JASP is here to stay.