LicenseManagerLicense key generator
Generate random license keys and serial numbers in the format of your choice. Copy them one by one, or generate thousands and export them as CSV. Keys are generated in your browser.
Format
Trying 1,000 keys a second, guessing one of 10 keys takes longer than the age of the universe.
Keys 0
What makes a good license key
Unguessable. A key is a password to your app. It must come from a cryptographically secure random generator, not from Math.random or a formula someone can reverse, with enough characters that trying keys one after the other gets nowhere.
Easy to type. Upper case only, no look-alike characters, and short groups split by dashes. Customers read keys out loud to support, copy them from a PDF or type them from a screenshot.
Unique. Each customer gets their own key, so you know who uses which and can revoke one without touching the others.
Entropy, in bits
Each character drawn from an alphabet of n characters adds log2(n) bits of randomness. The 32 characters of the LicenseManager alphabet give 5 bits each: 25 characters make 125 bits, about 4 × 1037 possible keys.
Every key you sell makes guessing a little easier, as there are more valid keys to hit. The meter above takes into account how many keys you generate.
Generating keys is the easy part
Your app still needs to know which keys were sold, to whom, for which version, and on how many machines they're used. LicenseManager creates a key for every Stripe purchase, emails it to your customer, and validates it from your app with one request, or offline.
Questions
Yes. They come from crypto.getRandomValues, the cryptographically secure generator of your browser, and every character is drawn without bias. Keys are generated on your device and never sent anywhere.
Not within a batch: duplicates are dropped. Across batches, a 25 character key like the LicenseManager format has 125 random bits, so the odds of a collision are negligible. Short formats run out of keys quickly: the generator tells you when a format can't make as many different keys as you asked.
Long enough that nobody can guess a valid one. 64 bits of entropy or more is safe when your validation endpoint is rate limited, 100 bits or more is safe in any case. A 5 by 5 key without look-alike characters has 125 bits.
Customers type keys by hand, from an email or a box. Without letters and digits that look alike, they can't mistake one for another, and support gets fewer "my key doesn't work" emails.
Yes: create licenses with your own keys through the API, or import them when migrating. LicenseManager also generates a key for every license it creates, so you don't have to.
A random key is only half of it: your app must check that the key was actually sold, and that it isn't used on more machines than allowed. That check needs a server holding the list of valid keys, or a signature your app can verify offline.
More free tools
Stop generating keys by hand
Connect Stripe and every purchase creates a license key and emails it to your customer. Your app checks the key with one request.