What is the best practice for detecting piracy in a SaaS or Web based app where the user can share their login? User is licensed to use the login on multiple devices. So how do you differentiate between that and sharing that login?

Approaches and issues

  1. Detect simultaneous login on 2+ devices. Can be challenging to catch if it's not a heavy use app. (I.e., if a typical user uses it only 1 h per day then the chance of a random "collision" is fairly small. Also, what if they just log into Device1 and forget to log out and log into Device2? So you might want active simultaneous usage. Perhaps some combination like :

    a. Login.Device1... login on Device2.... usage on Device1 (within same login)

  2. Detect logins on multiple devices (but not simultaneous). They are licensed for this. Also multiple browsers on the same devices are indistinguishable (AFAIK) from multiple device logins.

Caveat: I realize that the best solution would be to add useful features that tailor the app to a specific user. We are adding such features but they are not yet required of the user.

  • 3
    This is really difficult/impossible to do. If your app has a resource like “video playback” or “convert document”, you can restrict or rate limit use of the resource (e.g. Netflix accepts account sharing, but limits the number of simultaneous video streams). Points to consider: Does detecting piracy have any business value? If you prevent pirates from sharing accounts, would they actually start paying? Or would they stop using your service? Can you adjust your pricing structure to influence this? Will your anti-piracy measures annoy valuable users, perhaps causing the to cancel your service?
    – amon
    Dec 14, 2016 at 17:31
  • 1
    I think Steam handles this well - it allows multiple simultaneous logins, but only one instance may play games at a time. (Playing games is the reason to use Steam. Its other features - shopping, chat, profile management - can be done from all logins, because why not?) Other logins will see that the user's game collection is in use.
    – WolfeFan
    Dec 14, 2016 at 23:32

2 Answers 2


So my first piece of advice as a consumer of web services is use a light touch with this kind of thing. Without knowing what kind of service you are providing it is hard to say what is too much or too little.

For example a service licensed to established enterprise customers (B2B) may need very little in the way of enforcement as those clients have internal compliance departments and are used to being audited. While a service licensed to the general public is on the other end of the spectrum.

If it is normal consumer facing web service (video, chat, ..etc.). I would expect that allowing a certain number of simultaneous logins (1+) and invalidating the oldest login first could work.

Alternatively you could restrict things at the content layer instead. For example Amazon will allow me to login from tons of different devices (fire tv, iphone, 2-computers, kindle) simultaneously but it only allows me to stream video from one at a time. If I go over that then it tells me that I forgot to stop streaming on one of my other devices. But it does allow me to stream video, shop, download an ebook, ..etc simultaneously across all my devices if I need to.

Without knowing more about your service, potential customers, ..etc it is hard to say what would be effective while staying out of the way.

I would focus more on the product. If you build something that provides value people generally will pay you for it. If you make it hard for them to use it because there are some bad actors then they will just get frustrated and leave.


People share products because the sharer is a fan an the recipient uses it because they find value in it. Both parties can be valuable customers and it is important to remember the goal is to have both as customers.

This is a two part problem, detection and action.

For detecting people account sharing there are a few different signals you can look at using:

  • Devices (both type and count)
  • Usage patterns (simultaneous usage, very different patterns of behaviour)
  • Location (are they using it in multiple different locations)

With these signals and potentially some other signals you can detect account sharing, but now you have choices of how to deal with it.

Some options to consider are:

  • Nudging when the non-account holder / recipient signs in for the first time
  • Alerting both parties that the account might be compromised or shared and what to do (if shared get own account, if compromised change password)
  • Logging one party out when a limit is reached
  • Alerting the account manager in the case of a b2b product
  • Giving guidance on how to share within the product (eg. how to invite a teammate, how to share content with another user etc.)
  • Having sales or support talk about how to help them get more seats setup

Remember that some actions may hamper the user experience and risk frustrating the original paying customer who has been telling others how great your product is.

Targeting the non account holder and nudging them before they build up a habit is the most effective as they are the one you want to pay. Outside of B2B the account holder is less likely to pay for an additional user (would you pay for your friends brother to use your Netflix account?).

For detecting account sharing, you could build it all yourself, but it might be worth using something like upollo.ai which does this for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.