Turnitin changed the deal. What would an open alternative actually look like?
Turnitin recently told its users they'd need to accept a new EULA, one with fresh terms about processing student submissions with AI tools. The sector pushed back hard enough that the rollout is currently paused, and institutions are working out what it means for their contracts.
For twenty years, "what's our exit from Turnitin?" wasn't a question anyone seriously asked. Now it is. So, as a thought experiment: what would an open source alternative actually take? Because the answer is less about software than people assume.
The hard part isn't the code
The matching algorithms are well-understood computer science. Fingerprinting, winnowing, shingling, and these days embedding-based similarity for catching paraphrase. None of it is secret. A competent team could build a matching engine in months.
What Turnitin actually owns is data. Two decades of past student submissions, agreements for paywalled publisher content, and a very large web crawl. Even the publishers are locked in, Crossref's Similarity Check runs on iThenticate, which is Turnitin. An open project that only replicates the engine will produce thin reports against a thin index, and it will die quickly.
So the design has to start from the data problem. And the EULA row hands the answer on a plate.
Turn the model inside out
Instead of one company holding everyone's essays, each institution, or a national consortium doing it on their behalf, runs its own instance holding its own student submissions. The institution stays the data controller, the essays never leave. What instances exchange is fingerprints, irreversible hashes of document fragments, through a shared index. Cross-institution matching still works: your instance queries the shared index, gets back "87% match with a document held at another university," and an inter-institutional workflow handles disclosure properly.
The point is that no central company ever holds the submissions, so there is nothing to change a EULA about. The thing everyone is currently angry about becomes impossible by design.
The data you already have
Universities aren't starting from zero. Every institution running a VLE has years of student submissions sitting in its own database right now. Assignment tables, repository deposits, dissertation archives. Ten, fifteen years of essays in some cases, already stored, already governed by the institution's own retention policies. Turnitin's supposedly unassailable submission database is, in large part, a copy of documents the universities themselves still hold the originals of.
So day one of your own instance isn't an empty index. It's re-indexing your own back-catalogue, which for collusion and self-plagiarism detection, the cases where the student submission database actually earns its keep, covers most of what matters. The student recycling last year's essay is overwhelmingly recycling one from their own institution.
And it gets better the moment you join the shared index, because you're not just checking against your own archive anymore. Every institution that joined before you brought its back-catalogue too. Ten universities in, and a new joiner's first submission is being checked against a combined century or more of past student work, without a single essay ever changing hands.
The public side fills in the rest, and it's more tractable than it was when Turnitin started. CORE has hundreds of millions of open access papers. Add OpenAlex, arXiv, PubMed Central, Common Crawl, institutional repositories over OAI-PMH. The gap you can't fully close is paywalled publisher content, though a sector consortium negotiating index-only access is a very different conversation from a startup asking for the same thing.
The VLE side is the easy bit
This part is more solved than people expect. LTI 1.3 Advantage gives you one integration that covers Canvas, Blackboard, Brightspace, and Moodle, with grade passback for the similarity score and Deep Linking for assignment setup. Turnitin themselves are busy migrating everyone to LTI 1.3, so the pattern is thoroughly documented.
Moodle is the side I can speak to properly, since it's where I spend my days. It has a native plagiarism plugin framework that gives you deeper hooks than LTI ever will, inline scores in the grading table, forum post checking, the lot, and the events and web services APIs you'd build against are well-trodden ground. Having written a fair few plugins against Moodle's internals, none of this looks exotic to me, it's a known shape of problem. Add that Moodle-heavy institutions are disproportionately the ones already comfortable with open source, and it's the obvious place for something like this to start. A plagiarism plugin plus a single-institution instance matching against open sources and your own back-catalogue is a real MVP, not a toy.
Keep AI out of it
AI writing detection. Turnitin's detector is the most controversial thing they ship, false positives that land disproportionately on non-native English writers, and confidence in it is falling across the sector.
An open project trying to clone it inherits the science problem and the reputational one. The stronger position is to refuse to print a fake-certainty "78% AI" number at all, and instead provide evidence that supports a human conversation: document metadata, optional draft history, process analytics. That refusal is something an academic integrity committee can actually defend.
The trade-off
Let's be honest about the obvious one. On day one, this is not as strong as Turnitin. The reports are thinner, the publisher content is missing, the shared index covers three universities rather than three thousand. Anyone claiming otherwise is selling something.
But the trajectories point in opposite directions. Turnitin's data advantage stops growing the moment an institution leaves, while every institution that joins brings its back-catalogue with it. The open index keeps growing. The proprietary one doesn't. Weaker at first, stronger over time isn't a weakness of the model, it's how most open infrastructure has started.
The other cost is governance, and it's the hard part. A GitHub repo is not an institution anyone can bet a Turnitin cancellation on. The credible model is the ORCID pattern, a membership non-profit with institutional board seats and a charter that rules out training on submissions or reselling data. A charter can't be updated by emailing everyone a new EULA. That's rather the point.
Which brings me to the limits of my own usefulness. The technical side of this, the plugin, the matching engine, the infrastructure, I could sketch on a whiteboard today. But something like this only works with representation from across HEIs, a proper board, membership agreements, all the machinery of a sector body. That's a world I know very little about, and truthfully, one I have no great desire to learn. A project like this needs both kinds of people, and the second kind isn't me.
None of which makes me pessimistic. The technology is maybe a third of the work, and it's the third that's already within reach. The data sits in university databases, the sector bodies exist, and for the first time in twenty years, the motivation does too. What's missing is someone deciding to bring those pieces together, and that person doesn't need to be a developer.