Every license key you have ever typed — A1B2C-D3E4F-G5H6J — is the product of a few small, deliberate decisions. Get them right and your keys are secure, easy to read over the phone, and cheap to support. Get them wrong and you will spend your evenings explaining that the character was a zero, not the letter O.
Grouping is for humans
Splitting a key into groups of 4-5 characters is not decoration — it is chunking. People copy, read, and re-type grouped strings far more accurately than one long blob. The dashes cost you nothing and save your support inbox.
Kill the ambiguous characters
The classic offenders: O/0, I/1/l, B/8, S/5. A good alphabet drops them entirely. Fewer characters means slightly less entropy per slot — so you add a slot. A tiny price for zero "is that a one or an L?" tickets.
A checksum catches typos before your server does
Reserve one character as a checksum of the others. Now a mistyped key fails instantly on the client with a friendly "check that key again," instead of a confusing round-trip to your API.
Entropy is your brute-force budget
With a 32-character alphabet, every slot adds 5 bits. A 15-character key is around 75 bits of entropy — astronomically more than anyone can guess before your rate limiter (and your revocation button) end the party. The key is not the security boundary; your server is. The key only has to be unguessable enough that nobody stumbles onto a valid one.
What PWF Auth does
PWF Auth generates grouped, unambiguous keys with sensible entropy out of the box — professional-looking keys that read cleanly and validate server-side, without hand-rolling the format.