What is a software license key?
A software license key is a string of characters that proves a specific installation of your software is authorized to run — typically tied to a purchase, an account, or a specific machine. It's the mechanism that turns "anyone with the installer can run this forever" into "only people who paid can run this." The key itself is usually meaningless on its own — a random-looking string like SLK-7X9K-2MPQ-R4WT-BH3N — its power comes from what checks it: a server that can confirm it's valid, unused (or under its activation limit), and tied to the right product. A key with nothing checking it is just a password nobody's guarding the door for.
How does a license key actually work?
There are two moments where a license key matters: activation and verification. Activation happens once — a customer enters their key, your app calls a license server, the server confirms the key is valid and not over its device limit, then records that this specific machine (usually via a hardware fingerprint) is now activated. Verification happens on every subsequent launch — your app checks that the activation is still valid, either by calling the server again or, better, by checking a signed lease it saved locally from the last successful verification, so the app still works offline for a set window (commonly 3-7 days) without a live internet connection. The signing matters: a plain local flag saved to a file can be edited by anyone with a text editor, while a cryptographically signed lease (Ed25519 is the modern standard for this) can be verified as authentic without a network call, but can't be forged without the private key, which never leaves your server.
License key vs product key vs serial key: what's the actual difference?
In casual use these get swapped constantly, but they do have distinct origins and, sometimes, distinct meanings depending on who's using the word:
License key
The modern, general term — usually tied to an account or purchase, checked against a live server, and often revocable. This is what most SaaS and indie software licensing actually means today.
Product key
Historically used for boxed/retail software (Windows, Office) — a key entered once during install, often validated once and rarely checked again after that.
Serial number / serial key
The oldest of the three terms — originally just a unique identifier per copy sold, frequently with zero server-side validation at all, which is why serials became so easy to leak and share.
Activation key
Not really a separate category — usually just another name for whichever of the above is used specifically to unlock/activate a copy on first run.
Types of license keys
Which type you need depends entirely on how you sell and who's using your software:
| Type | How it works | Best for |
|---|---|---|
| Single-machine (node-locked) | One key, one device. Activating on a second machine either fails or deactivates the first. | Desktop apps sold to individuals — the most common model for indie software. |
| Floating / seat-based | A pool of N simultaneous activations shared across a team; a seat frees up when someone deactivates or goes offline. | B2B tools sold per-team rather than per-person. |
| Subscription / time-limited | The key (or the account behind it) stops verifying successfully once a billing period lapses, independent of the device. | SaaS and recurring-revenue products — pairs naturally with Stripe or similar. |
| Trial key | Verifies successfully for a fixed window (7/14/30 days) from first activation, then stops — separate logic from a paid key, not just a paid key with a timer nobody enforces. | Letting people try before buying without giving away the paid product. |
Should you build your own licensing system, or use a service?
Building it yourself
Doable, and plenty of developers do it — but "just check a key" quietly turns into a database of keys and activations, an API your app can call from anywhere, a way to revoke a key (chargebacks, fraud, refunds happen), and trial logic that can't just be reset by reinstalling. None of that can safely live only inside the app itself, since a determined user can patch out anything checked purely offline. Once it's all listed out, it's a small backend service you now own forever — hosting, uptime, and maintenance — for a feature that isn't your actual product.
Using a licensing service
A hosted licensing API (SublimeKeys being one example) gives you activate/verify/deactivate endpoints, a dashboard to issue keys manually or automatically on every sale, offline verification via signed leases, and revocation, without you hosting anything. The trade-off is straightforward: a small recurring cost (often with a free tier to start) in exchange for never touching a licensing codebase again. For most indie developers, the actual product is worth more of their time than reinventing this specific wheel.
Common licensing mistakes indie developers make
Checking the key only once, at install
Without ongoing verification, one shared key + one leaked installer means unlimited free copies forever.
No offline story
Verify-only-online systems lock out paying customers the moment their wifi drops, which generates support tickets, not security.
Unsigned local license files
A JSON file on disk saying {"licensed": true} is not a license check — it's a suggestion, editable in Notepad.
No revocation path
Without a way to invalidate a specific key, a single chargeback or leaked key can't be cleanly undone.
Treating trials as a timer, not a state
A trial that just checks "days since install" resets on reinstall; real trial logic needs to live server-side.
Frequently asked questions
Do I need a license key system for a free app?
No — license keys exist specifically to gate paid access. A free app has nothing to check.
Can a license key be cracked?
Any check running entirely on the user's own machine can eventually be patched out by someone determined enough — the realistic goal isn't making that impossible, it's raising the effort past what casual sharing requires, while giving paying customers a smooth, unbothered experience.
What's the difference between activation and verification?
Activation happens once, when a key is first used on a device. Verification happens on every subsequent launch, confirming that activation is still valid.
Can license keys work without an internet connection?
Yes, if the system supports offline verification — typically via a cryptographically signed lease saved locally after the last successful online check, valid for a set window (days, not indefinitely).
Is a license key the same as DRM?
Related but not identical — DRM usually implies deeper technical restriction (encryption, hardware locks). A license key system can be lightweight (a check on launch) without the rest of what DRM typically implies.
About
Patrick Chen — indie developer behind Sublimearts.io. Built SublimeKeys after writing this exact license-check code for ReelNox Studio and realizing every other indie dev shipping paid software was solving the same problem from scratch.