How to stop customers sharing your software after you sell it

You sell a program, and a week later the same key is running on forty PCs. Sharing is the most common way paid software leaks, and it rarely starts with a cracker: it starts with a customer who posts their key, or the ZIP, in a group chat. No single trick stops it. What works is a few layers, each one closing a door the others leave open

1. Lock each key to one PC

The first sign-in binds the key to that PC's hardware ID. On any other PC the key is refused with HWID_MISMATCH. That alone ends the "here's my key, use it too" kind of sharing. If a customer really needs two PCs, allow two on that key, and the third one is refused with DEVICE_LIMIT

Customers do change computers, so give them a fair way to move: a self-service reset with a waiting time between two moves (12 hours by default), or a request you approve. More in What is an HWID lock?

2. Check in while the program runs

A key checked only at start-up can be copied, banned and still used for weeks. With PWF Auth the program checks in every 30 seconds. Ban, pause or delete a key in your panel, and every copy using it closes on its next check-in, with a message that says why

And if someone blocks the server in a firewall to dodge that check? Three check-ins in a row without an answer end the session by themselves. How the heartbeat works

3. Decide who may sign in at all

Shared and resold keys often hide behind VPNs, or run on rented servers. Rules stop them before the key is even looked at:

• block a single address, a range, a whole provider, or a country where you don't sell
• refuse VPNs and proxies, or hosting addresses such as data centres and bot farms
• or allow only a list of known addresses, for software used in one office or shop

A refused sign-in never touches the key: it isn't used up, bound or counted. Sign-in rules in detail

4. Watch for keys that are being passed around

The sign-in watch flags a key used from several countries within an hour, from many addresses in one day, or in a sudden burst. That pattern is what a shared key looks like, and you see it before it spreads. From there one click bans the key, and every copy using it closes within 30 seconds

5. Know who leaked a copy

Sometimes the program itself ends up on a forum. The leak tracer gives every customer their own marked copy of each update, so when a copy turns up, dropping it on the tracer page tells you whose key it came from. Decoy keys planted where leakers look record whoever tries them, and refuse that PC from then on. How the leak tracer works

When it all goes wrong

Revoke App is the emergency switch: it bans every key of one application and ends every session at once, for example after a big leak. You then unban your genuine customers one by one, or hand them new keys

Be fair to paying customers

Every layer above has a gentle side, and it matters. A customer who changed PC can move their key in a minute. A message refused by a rule is your own text, in your own language. A customer whose internet dropped is signed out only after about 90 seconds of silence, and can sign in again straight away. Protection that punishes honest buyers costs more sales than sharing does

PWF Auth gives you all of this for free. Create an account and protect your first app in a few minutes