I am developing software in Window 10 and Visual Studio in C++. I would like to restrict the use of the software to a set of computers, by implementing a license control.

My thought is to query a few key parameters from the system such CPU Type, Harddrive Serial Number, MAC address, and create a hash. I would then take the hash on my own computer and encrypt it using a private key and then when the software is used regenerate the hash and compare it to the decrypted value using a public key distributed with the system.

What would a valid (and easy to access) set of values to uniquely identify the system? Ideally, I'd like it to be flexible enough to allow a reformat of the OS but not allow copying the code to another system without permission.

  • 4
    A lot of commercial software licensing checks (e.g. using the popular "flexlm" license management system) just use MAC address. Unless you need something particularly secure against attempts to subvert it, this should be good enough for most cases, IMO.
    – Jules
    Oct 1, 2017 at 7:07

3 Answers 3


Realistically, there are none. If you make a hash based on the user's hardware, then when they upgrade a hard drive or CPU or network card, or heaven forbid buy a new computer, the software stops working. Users will get pretty angry about that. If I were a business and ran into software like this, I'd stop buying from that developer. If I were a home user and ran into software like this, I'd return it to wherever I bought it from and never buy from them again.

Depending on the type of software, a dongle might be a better solution. Then the user can move it to whatever system they want, but can only run it on the system that has the dongle installed. However, if this is software intended for mobile users, many will not like having to carry the dongle around with them. You'll also have to deal with users losing their dongle.

Another solution is to have a license server that users can connect to. If a license for a particular user is in use, no other user can use the software with that same license. This allows the user to move it to a new computer without worrying about it continuing to work. You could even recognize that it's a new computer and disallow its use from the old one when this happens and have some reasonable policy about how often it can be moved. This suffers from the problem of needing a running server, and the possibility that users will be left in the lurch if the server goes down or your company goes out of business.

  • In this case the code is prototype code to be run on the hardware provided for them to run it on. They should not and will not be modifying the system as I own the system it will run on.
    – Steve
    Oct 1, 2017 at 2:08
  • 7
    If you are selling software with hardware your approach looks good - but you have to think how to protect yourself against virtualization hack - I mean it is rather easy to clone the existing system into the VM and start cloning this VM. Oct 1, 2017 at 5:24
  • 5
    How sophisticated is the user of this software? If you own the hardware, would something as simple as checking for a particular registry key that only exists on that machine suffice? It seems like if you control the hardware, then you could check whatever aspects of it you want. Oct 1, 2017 at 5:31
  • except this is exactly what windows does
    – Ewan
    Oct 1, 2017 at 9:01
  • @user1118321 I don't think the user will be willing to do hardcore cracking in order to subvert the system.
    – Steve
    Oct 1, 2017 at 16:13

For cloud-based licensing (e.g. online license activation), I built Keygen, a software licensing and distribution API, exactly for this purpose. You can set up a license policy which allows a single machine to be associated with a license i.e. a "node-locked" policy, and you can associate a machine with the current user's license by making a request that goes something like this:

curl -X POST 'https://api.keygen.sh/v1/accounts/example/machines' \
  -H 'Content-Type: application/vnd.api+json' \
  -H 'Accept: application/vnd.api+json' \
  -H 'Authorization: Bearer {TOKEN}' \
  -d '{
        "data": {
          "type": "machines",
          "attributes": {
            "fingerprint": "{MAC_ADDRESS_FINGERPRINT}",
            "platform": "Windows",
            "name": "Office Laptop"
          "relationships": {
            "license": {
              "data": {
                "type": "licenses",
                "id": "4097d726-6cc5-4156-8575-3a96387e19b4"

The easiest way to "fingerprint" a machine would be to use the MAC address, and if that value ever changes (e.g. they bought a new PC), it's easy to prompt the user to remove their old machine association and replace it with their new machine.

Now you can validate their license key within the scope of the current machine's fingerprint; the validation will return invalid if the machine fingerprint doesn't match.


Like user1118321 mentioned, it's difficult to uniquely identify a device, since not all operating systems give access to the same hardware variables. As this user mentioned, there is also a challenge to move a license to a new device or allow multiple devices to share a license, and if you take a license server approach, server uptime is critical.

My company built a licensing server that works with C/C++ applications by using our SDKs. There is a C++ SDK for Windows / Mac and several Linux distributions that can uniquely identify a device with a device fingerprint, used when activating or performing license checks. You can also transfer licenses to new devices or allow multiple uniquely identified devices to use the same license, depending on how you configure the entitlements. Concerning service availability, we are hosted on AWS and have over 99.9% uptime, and our SDK also generates a local license file once activated to fall back on in case there is no internet connection or a service outage, for example. There are free and paid tiers available for our licensing enforcement mechanism.

Dislaimer: I am a co-founder of LicenseSpring

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.