What is a software license key, and how does software check it?

Definition

A license key is a hard-to-guess string, usually split into groups like 7K2M9-QX3R8-2VBN5-8JH4C-T, that a seller gives a buyer. The software asks for it, checks it, and unlocks itself only if the key is genuine and still valid.

License key vs product key vs activation code

The three names are used almost interchangeably. “Product key” is common for operating systems and office suites; “license key” for independent software and tools; “activation code” for one-time codes that turn into a stored licence. What matters is not the name but how the key is checked.

How software checks a key

There are two broad approaches. Offline keys carry their own proof — a checksum or a digital signature — so the program can check them without the internet, but a leaked key works for everyone forever. Online checks ask a licensing server whether the key is valid right now, which makes revocation, expiry and device binding possible. Foliox License keys are 20 random characters from a 32-character alphabet (about 100 bits) plus a check character, and are always checked online, with every answer signed so it cannot be faked.

Why keys get shared, and what stops it

A key that works on any computer tends to end up on many. The usual defences are device binding (a key works on the first computer that activates it — see what an HWID is), expiry dates, revocation the moment a key leaks, and signed answers so a fake server cannot say “valid”. When sharing is what you want — a free tier or a beta — a public key deliberately skips the device lock.

Generating keys safely

Good keys come from a cryptographically secure random generator, avoid look-alike characters so people can type them, include a check character to catch typos before anything reaches the server, and are looked up through a rate-limited API so they cannot be guessed. A license key generator built into a licensing system does all of that for you.

Honest limits

Any program running on a computer its user fully controls can, in theory, be patched to skip its check. The realistic goal of licensing is to make casual sharing and key resale pointless — and to say so plainly.