Comparison · Verified 16 August 2026

DYCRYPT vs Keygen

Keygen is a broad licensing API with a free self-hosted edition. DYCRYPT is a narrower enforcement product with three signed modes and an on-premises path designed around customer-held keys.

This comparison uses public documentation available on 16 August 2026. If we have something wrong, tell us and we’ll fix it.

Capability	DYCRYPT	Keygen
Published entry pricing	$0 for 250 production licences; $29/month for 1,000; $99/month for 4,000.	Cloud Dev is free for 100 active licensed users. Paid cloud pricing uses an interactive volume calculator. Community Edition is free to self-host.
Licence models	Offline, Online, and Hybrid on every plan.	Perpetual, timed, trial, node-locked, user-locked, floating, metered, feature, and offline models.
Application integration	Published SDKs for Java, Node.js, Python, and C++.	Examples for Electron, Node, Python, C#, PHP, Rust, Go, C++, and shell, plus a general API.
Offline operation	Offline and signed Hybrid windows.	Signed or encrypted licence files, air-gapped examples, and Keygen Relay.
Signing algorithms	Ed25519, RSA 2048/3072/4096, and EC P-256/P-384.	Ed25519, ECDSA P-256, RSA-PSS, and RSA-SHA256 schemes are documented.
Key custody	Sovereign can sign through your HSM or PKCS#11 token.	Keygen Cloud keeps private keys server-side and does not share them. CE and EE can be self-hosted.
Deployment	Hosted SaaS or on-premises.	Keygen Cloud, free self-hosted CE, or paid self-hosted EE.
Data residency	Defined by your environment for Sovereign. SaaS residency is not yet published.	Keygen Cloud states its primary servers and backups are in the United States. Self-hosting defines your own boundary.

Where the approaches differ

Keygen CE is genuinely free to self-host.

That is a real contribution to the ecosystem and DYCRYPT does not match it. If operating the licensing API yourself is the main requirement, Keygen CE deserves to be first on the shortlist.

DYCRYPT Sovereign is a paid, supported path aimed at customer-controlled deployment and HSM-backed signing. It solves a different procurement problem.

The enforcement model starts at a different level.

DYCRYPT gives you three modes with signed timing rules and application states. Hybrid already defines what happens during a short outage and when the signed offline window expires.

Keygen exposes a broad licensing API and documented cryptographic formats. That gives you more models, but your integration owns more of the enforcement flow and user experience.

Self-hosting and HSM custody are not the same claim.

A self-hosted API moves the service into your infrastructure. An HSM boundary also constrains where the private signing key can exist and which process may ask it to sign.

DYCRYPT Sovereign is built around that second requirement. Keygen Cloud documentation says private keys stay on its servers; evaluate the CE or EE key boundary separately for a self-hosted deployment.

Where they’re stronger

A real choice has trade-offs.

Keygen offers a free self-hosted Community Edition, broader licensing models, and documented audit logs on paid cloud tiers.

Its public examples cover more languages and frameworks, and its cryptographic licence-file format is documented in enough detail to build your own verifier.

Start with the requirement that cannot move

That usually makes the decision clearer than a long feature checklist.

Choose Keygen if…

Free self-hosting is the deciding requirement.
You need floating, metered, user-locked, or distribution features now.
You want to assemble a custom enforcement flow directly on a broad API.

Choose DYCRYPT if…

You want a smaller set of enforcement modes with signed state transitions already defined.
You want 250 production licences free or a flat $99 plan for 4,000.
Your on-premises requirement includes signing through your own HSM or PKCS#11 token.

Sources checked 16 August 2026

Read the public claims yourself.

Planning a move?

Start with the binaries already in the field.

Tell us what is shipped, how often customers update, and which licence states must survive the move. We’ll scope the cutover without pretending it happens in a weekend.

Talk through the migration →