The Software Licensing Glossary and FAQ Hub
Plain definitions for the terms you will meet when issuing, validating, and managing license keys, plus straight answers to the questions small software teams ask most.
- Activation
- The first successful validation of a license key on a particular device, which typically consumes one of the activation slots allowed by the license. Activation usually records a device identifier so the same machine can validate again without using another slot.
- Activation limit
- The maximum number of devices or installations a single license may be active on at the same time. It is the main tool for discouraging casual key sharing while still allowing one customer to use several of their own machines.
- Air-gapped validation
- Verifying a license on a machine that has no network connection at all. It relies on a signed key or signed license file that the application can check locally with a public key, since no server can be contacted.
- Checksum
- A short value computed from the rest of a license key and embedded in it, so the application can detect typos before sending the key anywhere. A checksum catches mistakes; it does not prove a key is genuine.
- Concurrent activations
- The number of devices using a license at once, as opposed to the total number that have ever activated. Systems that count concurrent activations let customers deactivate old machines to make room for new ones.
- Deactivation
- Releasing an activation slot so it can be used on another device. Self-service deactivation, from within the app or a customer portal, is one of the most effective ways to reduce licensing support tickets.
- Device fingerprint
- An identifier derived from characteristics of a machine, such as hardware serials or operating system identifiers, used to recognize the same device across validations. Fragile fingerprints that change after hardware or driver updates are a common source of false activation failures.
- Entitlement
- What a license actually grants: the product, edition, features, seat count, and validity period. Entitlements are best stored as data on the license record and returned in a signed validation response so the application can unlock the right capabilities.
- Feature gating
- Enabling or disabling specific functionality based on the entitlements attached to a license, so one build of the application can serve basic, pro, and enterprise tiers. The gate should be checked against a signed entitlement rather than a locally stored flag.
- Floating license
- A license shared by a pool of users where only a set number can be active at any one time, commonly used in organizations. A license server hands out and reclaims seats as people start and stop using the software.
- Grace period
- A window during which an application keeps running on a previously cached validation even though it cannot reach the license server. Grace periods measured in days let customers work through outages, travel, and offline stretches without interruption.
- Hardware ID
- A specific kind of device fingerprint built from hardware components such as the motherboard, disk, or network adapter. Often abbreviated HWID, it should be treated as a hint for recognizing a device, not as an unchangeable identity.
- Heartbeat
- A periodic, lightweight check-in from the application to the license server confirming that a license is still in use. Heartbeats are how floating and concurrent licensing systems know when a seat has been released.
- Key format
- The structure of a license key: its length, character alphabet, grouping, product prefix, and checksum. A good format is easy for humans to read and type, hard for anyone to guess, and recognizable to support staff at a glance.
- License file
- A file, usually cryptographically signed, that carries the full entitlement for a product rather than pointing to a server record. License files suit offline and enterprise deployments, but changing or revoking them requires issuing a new file.
- License key
- A string of characters issued to a customer that identifies their license and lets the application look up or verify their entitlement. The key is a credential and an identifier; the protection comes from how it is validated.
- License server
- The service that stores license records and answers validation requests, whether self-hosted or provided as a hosted API. It is the source of truth for which keys exist, what they grant, and whether they are still valid.
- Node-locked license
- A license bound to one specific machine, identified by a device fingerprint, and not usable elsewhere without deactivation or reissue. It is the strictest common activation model and works best for servers and workstations rather than personal laptops.
- Offline activation
- A process for activating on a machine without internet access, typically by generating a request code on the offline machine, submitting it from a connected device, and bringing back a signed response. It preserves activation counting without requiring the machine itself to be online.
- Perpetual license
- A license that grants the right to use a specific version of a product indefinitely after a one-time payment. It is often paired with a maintenance or update window that must be renewed to receive new versions.
- Public-key signature
- A cryptographic signature created with a private key held by the vendor and verifiable with a public key embedded in the application. It lets the app confirm that a key, license file, or validation response is genuine without contacting a server.
- Rate limiting
- Restricting how many validation requests a client or address can make in a given period. On a license server it prevents brute-force guessing of keys and protects the service from misbehaving clients.
- Revocation
- Marking a license as no longer valid so future validations fail, typically after a refund, chargeback, or confirmed abuse. Revocation takes effect at the next validation check, so cached entitlements may continue working until their cache expires.
- Seat
- One unit of allowed use under a license, usually representing one user or one device depending on the model. Seat-based licensing lets a business buy a single license with a count rather than managing many separate keys.
- Subscription license
- A license that remains valid only while recurring payments continue, with an expiry date that moves forward on each successful renewal. Failed payments typically move the license into a grace or suspended state before it stops working.
- Trial license
- A time-limited or feature-limited license issued without payment so a prospect can evaluate the product. Trials are usually tracked server-side so the same person or device cannot restart the trial indefinitely.
- Validation
- The check that determines whether a license key is genuine, current, and permitted to run on the requesting device. Validation can happen online against a server, offline against a signature, or as a mix of both with caching.
- Webhook
- An automated HTTP notification sent from one system to another when an event occurs, such as a payment processor telling a license server about a successful renewal or a refund. Webhooks are how license state stays in sync with billing without manual work.
Questions people ask
What is the difference between a license key and a license file?
A license key is a short string that identifies a license and is usually checked against a server record, or verified by its signature, to find out what it grants. A license file carries the full entitlement itself, signed by the vendor, so the application can read it with no server at all. Keys are easier to deliver and change; files are better for offline and enterprise environments.
Can license keys be validated without an internet connection?
Yes. If keys or license files are signed with a private key, the application can verify them locally using the embedded public key. The trade-off is that purely offline validation cannot count activations or notice a revocation. Many products use online validation with a cached result and a grace period so normal use survives being offline for days.
How long should a license key be?
Long enough that guessing is hopeless and short enough that a person can type it from a card or read it over the phone. For most products that lands somewhere in the twenty to thirty character range, grouped into blocks, using an alphabet that drops confusable characters. What matters more than exact length is that the key comes from a secure random source rather than a counter or customer data.
What happens to my customers if the licensing server goes down?
That depends entirely on how the client is built. An application that caches its last signed validation and honors a grace period keeps working normally through an outage, and re-checks quietly once the server returns. An application that requires a live response on every launch locks out every customer at once. Design for the first behavior regardless of whether you host the server yourself or use a hosted API.
How do I stop one license key from being shared with everyone?
Server-side validation with an activation limit is the standard answer. A key that has been posted publicly quickly exhausts its allowed activations, which makes sharing pointless, and the original key can be revoked and reissued to the legitimate buyer. Pair the limit with self-service deactivation so honest customers who replace a machine are never caught by it.
Should I sell a subscription or a perpetual license?
Match the payment rhythm to the value rhythm. A tool that delivers ongoing value through updates, hosted features, or regular data suits a subscription. A tool people buy once and use as-is suits a perpetual license, often with a paid upgrade for major versions. Many products offer both, and storing the model as data on the license record makes it easy to support either.
How do I handle a customer who lost their license key?
Make recovery self-service wherever possible: a lookup form that emails the key to the purchase address, or a customer portal that lists licenses after a simple verification. Lost keys are among the most common support requests, and every one you can answer automatically is one fewer ticket. Never resend keys to an address other than the one on the purchase without a manual identity check.
What should my app do when a license expires?
Tell the user plainly that the license has expired, explain what still works, and link directly to renewal. A soft landing such as a read-only mode, a watermark, or disabled premium features is usually better than a hard lockout, because it keeps the door open for a renewal instead of provoking a refund request or a search for a crack.
Do I need to obfuscate my application in addition to licensing it?
Obfuscation raises the effort required to patch a binary, but it does not stop a determined person and can make your own debugging harder. For most small products, server-side validation, signed responses, and entitlement checks provide better return than heavy obfuscation. Consider light protection of the license-checking code itself, and spend the remaining effort on making the honest path effortless.
How do refunds and chargebacks interact with licensing?
A refund should automatically revoke the associated license, usually through a webhook from the payment processor to the license server. A chargeback is often handled the same way, sometimes with a suspended state while the dispute is investigated. Because cached validations can last days, the product may keep working briefly after revocation, which most teams accept in exchange for a smoother experience for everyone else.
Is it safe to store the license key on the customer's machine?
Storing the key locally is normal and necessary so the application can re-validate without asking for it again. The key alone should not be enough to unlock the product, though; the application should rely on a signed validation response or a signed license file for its entitlement. Treat the stored key as a convenience, not a secret that protects anything by itself.
When should a small team stop building licensing themselves?
Usually at the point where licensing needs more than a signed key: activation limits, subscriptions, refund automation, customer self-service, or reporting. Each of those is manageable alone, but together they form a service that needs a database, monitoring, and someone on call. If that service is starting to compete with your product for engineering time, it is time to evaluate a hosted option.