How DYCRYPT binds a licence to one machine

Full Offline, Full Online, and Hybrid licences can all enforce one licence on one machine. They differ in when the binding is created and whether the application must keep checking in.

Five signals, matched with tolerance

The SDK can read a machine identity, board identity, primary network-card address, operating-system installation identity, and hostname. Each available value is normalized and hashed separately. Raw values never leave the machine.

Three of the five parts must match by default. That allows routine changes such as a renamed host or replaced network card without turning the licence into a transferable file.

IP address is deliberately excluded because networks, VPNs, and DHCP leases make it too unstable for machine identity.

Binding at issue or first check

Full Offline licences are pre-bound: the customer prints a DYC1.… fingerprint and sends it before issue. Full Online licences bind to the first machine that checks in. Hybrid supports either activation method per licence.

Moving to replacement hardware

For online activation, an authorized DYCRYPT user can release the current binding. The next installation to check in claims it, and the move count remains visible. A pre-bound offline licence cannot rewrite its signed fingerprint, so issue a replacement for the new machine.

Fingerprinting raises the cost of casual copying; it cannot prevent a determined attacker from modifying code that runs on a machine they control. Keep valuable server-side capabilities behind server-side authorization as well.