How hardware-locked licensing works, and why RSA matters

A licence tied to one machine, signed with a private key you never ship. The signature is what stops a text editor being a licence generator.

Software licensing has a simple failure mode: if the check can be satisfied by editing a file, it will be.

Identifying the machine

Activation begins with a hardware ID derived from the specific machine. That ID is what a licence is issued against, so a licence file copied to another computer does not validate there.

For a station this is usually the right model. The licence belongs to the studio machine, not to a person who might leave.

Why the signature is the whole thing

The licence is a JSON structure carrying its fields plus an RSA signature. The application ships only the public key; the private key stays with the licence generator and is never distributed.

That asymmetry is the point. Verification proves the licence was signed by the holder of the private key. Anyone can read the file, and anyone can edit it — but an edited file no longer matches its signature, and verification fails.

Contrast a licence checked by comparing a string, or a hash the application could also compute. Both can be forged by anyone who reads the code. A signature cannot be forged without the private key.

What a licence carries

The hardware ID it was issued for, an optional expiry date, and the signature over those fields. Expiry supports annual terms; the absence of one supports perpetual licences.

Verification checks the signature first, then that the hardware ID matches the current machine, then expiry. Order matters: there is no reason to consider the contents of a licence that has not been proven authentic.

Activation in practice

  1. Install and launch. The activation window shows your hardware ID.
  2. Send that ID to your licence provider.
  3. Paste the returned licence into the dialog.

Two pieces of information, one round trip.

Where it shows up later

Licence validity and expiry proximity feed the system health indicator, so an approaching expiry surfaces as a status change rather than as a surprise on the morning it lapses.

A licence that expires silently at 05:00 is a self-inflicted outage. A countdown visible for weeks is an appointment.

Related reading

Ready to hear it on your own station?

Tell us about your setup and we'll send you a personalised quote.

Request a Quote