I have a software product I am going to release soon. It is built with Java/Spring/Tomcat and will be installed on the customer's local network.

I plan to sell this to corporate customers and I want them to buy an annual renewing license to run it.

I am imagining something like the customer provides me with their company and contact name and they will receive a code in email. They enter the three piece of info ...

Company Name: Vance Refrigeration Inc.
Contact Name: Bob Vance
License Code: A2B2-A3B3-A4B4-A5B5

... and the application is licensed and works for them. Either by "phoning home" or by decrypting the code and activating itself locally.

The license will permit the application to run on X number of servers, for X number of users, with X number of features activated, and it will have an expiry date.


Should I encapsulate all of the license feature details (# servers, # users, expiry date) in that license code and decrypt it locally without having to "phone home" to a verification server?

Is there a way to link the three piece of info so all three have to be entered correctly for it to work? My thinking is, that way the name of the licensed owner is always accurately displayed.

If I require the software to hit a verification server, how often should I have it "phone home" ... and how would you handle deployments that are on internal networks with no outside internet access (I've worked in environments like this).

Is there a good product out there already does of this for me? Don't necessary want to re-invent the wheel.

  • 1
    This is what I would look at first, if I were doing this myself. Commented May 26, 2020 at 0:47
  • @RobertHarvey Thanks, I'll take a look. I also spotted License4J but I know nothing about it. Commented May 26, 2020 at 1:35
  • Your software "phoning home" (contacting whatever server somewhere on the Internet) will be a reason why security-conscious users will not want to use it. Also, you're not going to find a 100% hacker-proof solution. Any software can be cracked so that it will still work despite your license enforcing measures.
    – Jesper
    Commented May 26, 2020 at 13:15

1 Answer 1


A good friend of mine once kept an expensive 12-string guitar in a cardboard case locked with the flimsiest padlock imaginable. It was there, he quipped, "to keep the honest people out."

For more than twenty-four years – believe it or not I still sell a copy now and then – I sold an internationally-successful software system (at >$150(USD) a pop ...) which was protected by a scheme just as simple as my friend's padlock. I never lost any sleep over the notion that anyone was stealing copies: yes, I found codes on the Internet sometimes. But the sales kept coming, and so I just kept focused on my customers. (I even freely answered support-questions from people who I knew had not yet bought it ... and, more often than not, they did.)

I never tried to implement a license-server, a "dongle" or anything else of that sort because I did not want to stand in the way of my customers. ("My product puts out fires. If you, dear customer, have a fire, the only thing I want to do is to let you put it out. Thank you for your business. I trust you.")

I did learn one thing: that governments in many parts of the world (and I did sell to "governments in many parts of the world" as well as many other parties ...) by law cannot spend public money on anything that can be obtained "for free." There must be something that they can "buy." And, if the terms of the license call for annual renewal, or anything else, the software must "enforce it." (They don't care how.) They must buy "something" that confers to them the exact thing that they bought. There must be some kind of code, and it must be "unique to them." To satisfy their government auditors ...

Therefore, find a simple and well-accepted scheme that you don't have to write from scratch, and which satisfies the requirements that I just spoke of. But please don't think that "your revenues depend on its 'security.'" If your product is worth paying for, people will do it. Focus your attention on keeping them so happy that they tell their friends. (In all these years, I never "advertised.")

(Of course it goes without saying that you must register your copyright as is appropriate for your country, and include properly visible copyright notices as required by your law. "As always, Mind your P's and Q's.")

  • Thanks for sharing, that's all great advice. My thinking was similar, the idea is the licensing system has to compel honest corporations to pay for the license. I'm thinking, since I want to automatically re-bill them annually, the app needs to "phone home" to check if the subscription fee was paid, but I would be very reluctant to turn them off. The licensing system doesn't need to be "rock solid" but I think it should be tricky enough to dissuade people who'll get bored quickly. Commented May 26, 2020 at 2:34
  • 1
    Quick followup on your "register your copyright" comment. Can you elaborate? Are you talking about registering the product name as a trademark/wordmark, or something else? Commented May 26, 2020 at 2:40
  • Well, given that copyright and trademarks are totally different things, he probably means to... register the copyright. Consult a local lawyer for frustratingly vague answers about your specific jurisdiction.
    – Sean Reid
    Commented May 26, 2020 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.