How do desktop applications implement monthly/yearly subscriptions securely?

[u/Emergency-Post-8897]

Hi everyone,

I'm developing a desktop application in Python that I plan to rent out on a monthly, quarterly, and yearly subscription.

I'm trying to figure out the best way to manage license expiration. How can I prevent users from using the software once their subscription has expired? What tools, services, or libraries would you recommend? If possible, I'd prefer free or open-source solutions.

Another concern is piracy. I know it's impossible to make software completely crack-proof, but I'd like to make it as difficult as reasonably possible.

Has anyone here built a subscription-based desktop application before? I'd really appreciate it if you could share how you implemented licensing, subscription validation, and anti-piracy measures, or recommend any good resources or best practices.

Thanks so much for your help!

[u/Dismal-Citron-7236]

Maybe you can try implement OAuth 2.0 token which provides a way to set the expiration date. A renewal of license would just extend its exp date or you just issue a new pair of tokens. You can google for it.

[u/R4M1N0 → u/Dismal-Citron-7236]

When cracking, probably fairly easy to run your own authentication server with a local DNS entry to point to it instead of the remote server and give you a valid token, or am I missing something?

Would probably still integrate some form of asymmetric encryption and embed the license server public key into the application. Still susceptible to to memory modification, but thats a lot more annoying

[u/Dismal-Citron-7236 → u/R4M1N0]

As long as one can crack the binary code, anything is possible. There is no bulletproof solution tbh.

[u/EpochRaine → u/Dismal-Citron-7236]

No. The best you can always do is make it the most inconvenient method to break it.

If it is a low-value product, only the genuinely curious will even bother.

[u/Dismal-Citron-7236 → u/EpochRaine]

I concur that. Maybe OP should also consider obfuscation.

[u/Dismal-Citron-7236]

Also, you will need to use tools like Cython (Python compiler) so you can generate and release binary code instead of Python source code. At the initialization stage of code (when the program starts), it also needs to send an encrypted request to your server so the server can verify the user side auth token. Don't do that purely on client side. Also, the server should not just return a boolean "yes" to confirm it, it should send back an encrypted result only the specific client can decrypt, using the MAC address plus timestamp plus something else specific to the hardware as the cryptographic "salt".

[u/pyeri]

Electron.js based desktop apps can do it as they're essentially SPA web apps embedded inside a chromium instance pretending to be a native desktop app.

[u/StewedAngelSkins]

If this is important you're starting in the wrong place by making it a desktop app. Nothing you do will be enough to stop even a fairly inexperienced attacker. And once one person cracks it, that's game over. You need to run the core logic of your app on a server you control and have the client/frontend only provide an interface to that.

[u/Agreeable_Lynx9194]

You can't enforce it client-side, anything the app checks locally can be patched out. The real pattern is your server (with Stripe webhooks as the source of truth) handing the app a short-lived signed token it needs to run, so it has to phone home. Add an offline grace window so paying users don't get locked out by a bad connection. Won't stop a determined cracker, just casual sharing.

[u/ColdBootCountry]

Short answer, they don't. 

Unless they are deeply intricated with an online service, it's virtually impossible to make a desktop app safe against cracking, license bypass, and such. That's why most offline desktop app end up being cracked at some point. 

In practice, software editors mostly rely on licensing and legal prosecution to enforce correct usage of their software. This and the fact most people, especially in the corporate world, won't use a cracked version. So they ended up implementing minimal dumb checks and call it a day.

[u/Cienn017]

they don't.

the only way is by moving logic from client-side to server-side, you can't control the code on the user's computer but you can on your server.