Software License Key Generator & Verifier (Signed Offline Keys)

About the Software License Key Generator & Verifier (Signed Offline Keys)

Sell or hand out licences for software you own without a licence server: make an Ed25519 key pair in this browser, sign each customer’s licence (product, plan, licensee, e-mail, seats, an optional expiry date and an optional machine id) into a key, and let your app check the key offline with the public key. The private key makes keys and stays with you; the public key, built into your app, can only check them — so nobody can make new keys from your app.

Keys come as easy-to-type groups (7Q2K9-…, Crockford Base32: no I, L, O or U, case and hyphens ignored) or as a shorter LK1. token. The page writes the checking code for JavaScript, TypeScript, Python, Go, Java, C#, Rust and Swift with your public key built in, checks pasted keys and shows what they say, turns a CSV of buyers (a store’s sales export, for example) into one key per row, and writes a revocation list. Your private key can be saved as a password-protected file that OpenSSL and every crypto library can open.

Everything runs on your device; nothing is uploaded. Without a pass the result is a free preview: demo keys signed with a key pair made on this page that cannot be saved, and the first lines of each snippet; your own saved key pairs, the full code, the key files, the buyers’ file and the revocation list unlock with a Pro pass.

Common uses

• Licensing a desktop app, plug-in, game or command-line tool without running a server.
• Selling through a store that sends you a CSV of orders, then e-mailing each buyer a key.
• Trial and subscription keys that end on a date, checked without an internet connection.
• Keys bound to one machine for software that must not be copied to another.
• Revoking leaked or refunded keys in the next release.

The key format

A key is a short payload followed by its 64-byte Ed25519 signature (RFC 8032). The payload, numbers big-endian: the format version (1), flags (bit 0: the key expires; bit 1: it is bound to a machine), the issue date and the expiry date as days since 1970-01-01 (two bytes each, so dates run to 2149-06-06), the number of seats (0 = unlimited), an 8-byte random serial, then the product id, plan, licensee, e-mail and machine id, each a length byte and UTF-8 text. The signature covers the whole payload, so no field can be changed.

The grouped form is Crockford Base32 of those bytes in groups of five; it ignores case and hyphens and reads O as 0 and I or L as 1, so a key read over the phone still works. The token form is LK1. followed by base64url (RFC 4648) of the same bytes. Every snippet reads both.

What the code checks

• The signature, with the Ed25519 public key built into the code.
• The product id: a genuine key for another of your products is refused.
• The revocation list: serials you listed are refused.
• The expiry date: the key works through the whole expiry day (UTC).
• The machine id: a key bound to a machine works only where your app reports the same id.

Each function returns the reason when a key is refused — not-a-key, bad-signature, other-product, revoked, expired or other-machine — and the licence fields of every genuine key, so your app can show the licensee or turn on the plan’s features. Seats are written into the key; counting them is up to your app.

Keeping it secure

• The private key is made by your browser’s Web Crypto and never leaves this tab unless you save it. The saved file is PKCS#8 encrypted with PBES2 (RFC 8018): PBKDF2-HMAC-SHA256 with 600,000 rounds, as OWASP recommends for PBKDF2, and AES-256-CBC. OpenSSL opens it with openssl pkey -in key.pem.
• Offline keys can be shared like any other licence key, and code inside an app can be patched to skip the check. Signed keys stop people from making keys; they cannot stop a cracked copy of the app. Many developers accept that and keep checks light.
• Keep the private key off build servers and out of your app and its repository. If it leaks, make a new key pair and ship code with the new public key.

Sources

• RFC 8032 — Ed25519 signatures
• Crockford’s Base32 — the grouped key alphabet
• RFC 4648 — base64url
• RFC 8018 and RFC 5958 — the encrypted private key file
• OWASP Password Storage Cheat Sheet — PBKDF2 rounds
• SubtleCrypto.sign() — Ed25519 in browsers

Limitations

• Ed25519 in Web Crypto needs a current browser: Chrome or Edge 137 or later, Firefox 129 or later, Safari 17 or later. Older browsers cannot make or check keys here.
• Keys are long: the 64-byte signature alone takes 103 characters in groups (86 in a token), and the fields add to that. Shorter keys would need a weaker signature.
• Text fields are limited to 64–254 bytes each (255 at most in the format); dates run to 2149-06-06.
• The page does not compute machine ids: use whatever stable id your app computes, and enter the same text here.
• A buyers’ file holds at most 10,000 rows at a time, and the table on the page shows the first 200.
• The C# code needs the BouncyCastle.Cryptography package, the Python code the cryptography package and the Rust code the ed25519-dalek crate; the others use their standard libraries.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.