Using someone else's music in your own game?
What to watch out for

I wanted relaxed background music for geo-finder, something to lift the game a little.

The first question was not which library to pick. The first question was whether I was allowed to do it at all.

Classical music looked like the simplest way to avoid rights problems. Vivaldi died more than 270 years ago, the work is in the public domain, and everybody likes Vivaldi 😉 So I could take any recording of it.

That is a popular wrong turn. Luckily I looked it up first and spared myself what could have become unnecessary legal fees.

This post shows the problems and pitfalls that come with using public domain music, and what actually needs your attention.

A work and a recording are two different rights!

At least two protected rights sit on a piece of music, and they expire independently:

The work is the composition. German copyright law puts it plainly in section 64 UrhG: copyright expires seventy years after the author’s death. For Vivaldi, Bach or Albinoni that deadline passed long ago, so the composition is free.

But careful: the recording is something else. Whoever performs a public domain work gets a right of their own. Under section 82 UrhG the performer’s rights expire 70 years after the phonogram was published, and under section 85(3) UrhG the producer of the phonogram also holds 70 years from publication.

What that means:

A 1998 recording of The Four Seasons stays protected well into the next century, even though Vivaldi died in 1741. You may play the score yourself, because no rights remain on the work itself.

You could not simply rip that CD and drop it in, because two further rights sit on that recording: the orchestra’s as performers and the producer’s. Both run for 70 years from publication, and ignoring them means interfering with someone else’s rights, however long the composer has been in the public domain.

A note on jurisdiction: the sections above are German law. The principle of a separate right in the recording exists across the EU and in most other countries, the exact terms do not. Check your own jurisdiction before you rely on a date.

Four routes remain:

• use a recording that carries an explicit free licence
• use a recording whose related rights have expired
• record it yourself, or have it recorded
• have an AI service generate music for you, see the dedicated section below

Disclaimer: this is my research, not legal advice. When in doubt the licence text counts, not my blog.

Where free music comes from

The following sources were checked on 24 July 2026:

Source	What you get	Typical licence	What to watch
Free Music Archive	broad, curated music archive	CC BY, CC BY-SA, CC0	the licence sits on the track, not on the portal
Internet Archive	recordings of every kind, lots of classical	mixed through public domain	check the licence on the individual work, the details are rough in places
OpenGameArt	made for games	CC0, CC BY, CC BY-SA, OGA-BY, GPL	on GPL see the paragraph below the table
ccMixter	remix community	CC licences, some carrying the NC element	NC stands for non-commercial, those pieces are only allowed in non-commercial projects
Incompetech	Kevin MacLeod, very widely used	CC BY 4.0	attribution rules are strict, see below
Freesound	sound effects more than music	CC0, CC BY	strong for effects, thin for soundtracks

On GPL at OpenGameArt: that licence was written for program code. With a piece of music it is not clear what counts as the source that the licence requires you to hand over on request. The tracker project file? The individual samples? With the CC variants the question does not come up, which is why I reach for those first.

Incompetech is the site of Kevin MacLeod, an American composer whose pieces you know from plenty of YouTube videos and indie games. His fine print is worth reading because it shows what proper attribution looks like.

You need the title of the piece, the words “Kevin MacLeod (incompetech.com)” and a pointer to the licence. Placed so that anyone who wants to know where the music came from finds it without effort. If you cannot fit attribution anywhere, you buy their Standard License instead.

That is not a special case, that is the normal case for CC BY. Attribution does not mean “somewhere in the repository”. It means findable by the person using the result.

CC BY-SA: when ShareAlike actually bites

geo-finder plays a recording of The Four Seasons by John Harrison with the Wichita State University Chamber Players, licensed CC BY-SA 4.0.

The SA part scares people off. The worry behind it: put a ShareAlike file in your project and you have to license the whole repository the same way, so you could no longer ship your code under Apache or MIT.

That worry is unfounded. Under the licence text ShareAlike applies to adapted material, meaning you changed the piece and you pass that version on. Cutting it into a gapless loop would be an adaptation. Playing the file unchanged is not.

One passage deserves a second look anyway. The licence states that adapted material is always produced when licensed material that is a musical work, performance or sound recording is synched with moving images.

For film that is clear. Whether a game counts as moving images in this sense is not.

I found no solid answer, so I am not going to invent one.

If you do not want the question at all, pick CC BY or CC0 instead of CC BY-SA.

The code stays out of it either way. geo-finder is Apache 2.0, the music is CC BY-SA. Two separate works sitting next to each other, with the attributions in a dedicated CREDITS.md.

AI music: the Suno case

The fourth route is the new one. Services like Suno turn a text description into finished tracks, in minutes, in exactly the mood you asked for. For a game that sounds ideal. The terms deserve a close look though, and they are not in the advertising, they are in the terms of service.

• Free and Basic: you get no ownership. Outputs may only be used “for lawful, internal, personal and non-commercial purposes”.
• Pro and Premier: Suno assigns you “all right, title and interest” in what you generate during the paid term.

Then comes a sentence that may matter more than both points together: Suno gives no assurance that copyright subsists in an output at all. That cuts both ways. You may use the track, but you might not be able to stop anyone else from using the very same track. Worth thinking about if you want a game to be recognisable by its music.

A second point, and I am flagging this one explicitly as my reading: “internal, personal” is narrower than “non-commercial”. A game sitting publicly on GitHub Pages would arguably no longer be purely personal, even if nobody pays for it.

For a published project the paid plan would therefore look like the safer route, even where nobody makes money.

geo-finder ended up with Vivaldi anyway. With a public domain work in a freely licensed recording the provenance is easy to prove, and a string orchestra suits a collection of travel destinations better than anything I could describe to an AI.

As an aside: I prefer Bach myself. For a game he is a touch too heavy and too sombre.

Formats: what browsers really support (or why I do not like Safari)

OGG Vorbis was the standard recommendation for browser games for years, and for years Safari was the reason you shipped MP3 alongside it 🙄 That changed, but only recently:

Format	Chrome, Firefox, Edge	Safari
MP3	yes	yes, since Safari 3.1
Vorbis in Ogg	yes	only from Safari 18.4
Opus in Ogg	yes	only from Safari 18.4
FLAC	yes	from Safari 11

Ogg container support arrived with WebKit for Safari 18.4 on macOS Sequoia 15.4, iOS 18.4, iPadOS 18.4 and visionOS 2.4. If you care about older devices, ship a second format. Every serious player takes a list of sources and picks what the browser can handle.

The size maths is quick. The three movements in geo-finder come to 6.8 MB as OGG, or 2.3 MB, 3.2 MB and 1.3 MB on their own. Fine for a static game on GitHub Pages. Not fine for a game that wants to load in a few hundred kilobytes. Part 2 covers how to solve that.

Players: the options, and what I picked

Option	Version	Licence	Last release	Package unpacked	Meant for
<audio> and Web Audio API	HTML5 built-ins	-	-	0 KB	playing one or two files
howler.js	2.2.4	MIT	19 Sep 2023	311 KB	game audio without an engine
Tone.js	15.1.22	MIT	27 Apr 2025	5.3 MB	synthesis and sequencing
@pixi/sound	6.0.1	MIT	27 Jul 2024	1.0 MB	projects already on PixiJS
SoundJS	1.0.1	MIT	19 Sep 2017	-	historical, quiet for years
Phaser	4.2.1	MIT	9 Jul 2026	107 MB	full game engine, audio included

All the information above was pulled from the npm registry on 24 July 2026.

Unpacked package size is not bundle size in the browser.

It became howler.js, for three reasons:

• It hides Web Audio and HTML5 audio behind a single API.
• It accepts a list of source formats and picks the one that fits.
• It is small enough not to feel oversized for a handful of tracks.

The last release is from 2023. That does not count against it here, quite the opposite: the library is mature and past its teething troubles.

If you already run an engine like Phaser you do not need howler, audio is part of the package. If you want to generate sound rather than play files, you end up at Tone.js.

One rule holds regardless of the library, and it caught me out too: music does not start on its own. Browsers block sound that begins without user interaction. Per MDN, playback only runs if at least one of these is true: the audio is muted or its volume is 0, the user has clicked or tapped on the site, the site is allowlisted, or the autoplay permission is granted explicitly.

For background music that means you need a button. A play() on page load is refused, and the failure is easy to miss, because the call merely returns a rejected promise. Miss that and you spend a while hunting for a bug in your own code. The block applies in every current browser, and it is a blessing: a page that pushes music into your ears unasked has driven off plenty of visitors already.

When does the music actually load?

The question follows immediately: does the page pull several megabytes of music on load, even though nobody may want to hear it?

It does not have to. There are three levers.

The moment.

Howler starts downloading as soon as a Howl is created: “Automatically begin downloading the audio file when the Howl is defined.” Create the object inside the click handler and not a byte of music travels before that. With preload: false you separate download from creation and fetch later via load().

On a plain <audio> element the preload attribute does the same, with the values none, metadata and auto. The spec advises metadata, and per MDN the value is only a hint the browser is free to ignore.

The playback mode.

This is where the catch sits, geo-finder included. With Web Audio (html5: false) Howler downloads and decodes the whole file before the first note plays. The docs are clear about it and recommend HTML5 audio for large files, “so that you don’t have to wait for the full file to be downloaded and decoded before playing”.

At 2.3 MB per movement that means nothing happens for a while after the click. With html5: true playback starts while the file is still arriving.

Web Audio earns its keep with gapless loops, precise timing and effects. Background music that plays through once needs none of that.

Preloading the next track.

While track 1 plays, track 2 can be fetched in the background. That is the difference between a gap at the track change and a smooth handover, and it costs one load() call at the right moment.

In short: load when the user asks for music. Then stream instead of downloading in full. And prepare the next track while the current one runs.

Case study: geo-finder

Three decisions from the project I would make again.

The audio files are not in the repository.

Clone the source and you get no music files with it. A small script fetches them at build time, and the deploy workflow calls that script. Three reasons for that: the repository stays small, a later change to the rights hits the source rather than every clone out there, and we have no say in what other people do with our source code. Someone else’s music should not travel with it.

Missing music is not an error.

On startup the player probes with a HEAD request whether the files are really served. If nothing is there, the component renders nothing. No button, no error message, no broken console. Clone the game without music and all you notice is silence.

The attributions live in their own file.

CREDITS.md names the work, the recording, the performer, the licence and where it came from. Ten minutes of work that answers every later question.

One footnote from researching this post: geo-finder ships OGG only.

On Safari before 18.4 nothing plays. The second format belongs right next to it, which is exactly what howler’s source list is for.

What I learned from this

Attribution is not fine print at the end. It is an essential part of the application, and it is your cover towards the people whose work you are using, and towards anyone who later asks where a file came from.

Write it while you build and every detail is still at hand. Add it later and you get to reconstruct the origin of every single file.

If you pull music into your project, be ready to answer where it came from as readily as you answer which licence your dependencies carry.

Part 2 covers the special case where all of this looks different again: tracker music, the kind that was popular on the Amiga in the nineties. A complete soundtrack the size of a single icon.

Sources: section 64 UrhG · section 82 UrhG · section 85 UrhG · CC BY-SA 4.0 legal code · Suno terms of service · MDN audio codecs · MDN autoplay guide · MDN audio element · howler.js docs · WebKit Features in Safari 18.4 · Incompetech FAQ · OpenGameArt FAQ