The Honest Ceiling: Protecting Offline Software Without Punishing Honest Users

Last weekend I asked myself an uncomfortable question: could someone post my app and a valid license key on a torrent, and anyone use it for free? The answer is yes. That answer started this research. The question had been sharpened a few days earlier in a public thread, when AleksandraZhd pointed out that any phone-home — even once per machine — makes "forever" depend on my servers. So I spent the weekend mapping every way to protect a one-time purchase offline, and the price each one charges honest users. This is the map.

The threat model, narrowed

Not professional cracking crews. Not commercial resellers of cracked software. The target is casual, non-commercial redistribution: a key shared in a chat, an installer plus key on a torrent, "send me your key" between friends. The kind that feels harmless to the sharer and costs real money to the developer.

And five constraints, because they are the product's public promise: no phone-home of any kind; no activation or revocation server; nothing that can block an honest user on a reinstall, a new laptop, a VM, a wiped disk; the software works forever even if my company disappears; no account required. Every mechanism below was tested against that list.

The honest ceiling

Here is the fact most DRM marketing hides: if an application can locally answer "this token is valid," then anyone holding the same token gets the same answer. Copying the authorization is always possible when verification is local. That is not an implementation flaw. It is the architecture.

Two different things get conflated here.

Authenticity: did LockMargin publish this binary? Code signing answers that.
Authorization: does this person own a license? A signed local token answers that.
Neither prevents someone from handing a valid token to somebody else.

It also helps to separate two threats. Sharing is when a buyer sends a key to a friend — the social and contractual layers deter that. Cloning is when the installer and a valid key travel together — and that is where the honest ceiling lives. If a real installer plus a real key spreads, an offline app cannot tell the new user from the owner. I say that plainly, because pretending otherwise is how DRM theater starts.

Four layers of friction

Cryptographic. Each purchase gets its own signed key — a unique order, never a master key. The buyer's name — the one from the payment record — is embedded in the signed payload, so editing it breaks the signature; the email stays optional metadata, because the app itself never requires it. The key is scoped to the major version: a v1 key opens v1.x forever and simply doesn't grant v2. A leaked key identifies one purchase, not the entire product, and it depreciates when v2 ships. Honest friction: zero. Paste the key on any machine you own.

Contractual. The license says one person, the machines you own and control. A desktop and a laptop. Not a key passed around. A contract, not a checkpoint.

Economic. The free tier removes the biggest piracy motive: "I just want to try it." Start is free to try — up to 5 clients, 5 projects a month, unlimited invoices. No account, no card, same encryption, same offline database. And at $49, the hassle of finding a crack — malware risk, time, guilt — costs more than the product. For a freelancer billing $50 an hour, fifteen minutes of searching is already more expensive. A hardship path covers the rest: if you truly can't pay, you write me. That is a personal decision, not a policy.

Social. The app shows "Licensed to: your name" in Help. Passing an abstract key is easy; passing a key with your name signed into it is a different social operation. And public transparency — this article included — turns the community into a soft enforcer: people who value the no-DRM promise are the least likely to break it.

The snake oil I refused

Hardware binding sounds protective in a demo and punitive in life. New laptop, new motherboard, VM, wiped disk — each one breaks the fingerprint, and the honest buyer lands in support, while a determined pirate can simply remove the check.

Offline lease — "the key is valid 90 days offline" — is a subscription in disguise. It violates "forever" and still clones with the disk.

An activation counter without a server is a local variable. Whoever clones the state clones the count. It is not enforcement. It is theater.

Obfuscation and anti-tamper raise the cost of cracking for hours while adding false positives on antivirus and VMs. For a solo developer, the support bill exceeds the benefit.

Every one of these buys a little piracy resistance and charges it to the honest user.

What others did

Sublime Text ships the closest precedent: a per-user license entered offline, no connectivity prerequisite, an honor system that has survived for years. BBEdit sells perpetual licenses with paid major upgrades and a usable free mode — the version boundary done clearly. Affinity's one-time V2 purchases made version-scoped ownership understandable to a mass market, though their activation leans on accounts, which I won't. Plasticity shows the road not taken: activation limits with a support fallback — seat management, the thing ownership promises to abolish. I chose the harder path: no seat management, no support tickets for new laptops.

None of them satisfies all five constraints. That is fine. LockMargin's combination — perpetual, version-scoped, locally verified, zero activation state, zero account, zero telemetry — is deliberately unusual.

The calculation

The sentence that survived my weekend: the cost of protecting honest buyers from a relatively low-value threat is paid by honest buyers. Piracy exists; I'm not pretending otherwise.

I don't have a useful number for the trade-off. I only know where I draw the line: I won't make every honest customer pay in friction to stop a small number of casual pirates.

The stack I shipped

Five layers, and no sixth. Cryptographic ownership: unique per-order signed tokens with buyer identity and version scope, verified locally. Human friction: "Licensed to" plus the one-person-your-machines contract. A legitimate alternative: the free Start tier. Reputation: no spyware, no activation server, no DRM theater, published signed builds. Economic reality: $49, where leakage is cheaper than the infrastructure to fight it.

And one principle above the stack: a valid license should never depend on the continued existence of the company that issued it. Servers vanish, processors vanish, founders vanish. The copy you bought keeps working. That is not a feature. That is the product.

If you ship offline software, where is your line between protection and punishment — and what did I miss? The raw thread that started all of this is on my Indie Hackers profile — unedited. The mistakes are still there. The ownership model these protections serve is described in the companion piece, How a Public Thread Changed How I Define Ownership.

Vlad Shiyan writes the code, breaks the features, and answers the emails. Own your tools for $49 once, or read the manifesto first.

About the Author

Vlad (Volodymyr) Shiyan — Founder & Developer, Kharkiv, Ukraine. Building LockMargin since December 2025. Offline-first invoicing for freelancers who are tired of subscriptions. Standard is $49 one-time. Read more about Vlad →