Under the hood

How Vanity keeps your code yours.

The technical version, for you or the developer you work with. Every layer below is something you can switch on per product.

Four layers between your code and a cracker.

Each layer covers what the one before it cannot. Turn them on per product, from light obfuscation to native code behind activation.

Before it ships

Your jar is rewritten until a decompiler has nothing useful to show.

Renaming
Classes, methods and fields lose every meaningful name.
String and constant encryption
URLs, messages and numbers are decrypted only at runtime.
Control-flow obfuscation
Logic is flattened into state machines decompilers cannot rebuild.
Reference hiding
Calls and field access go through indirection, reflection included.
Native compilation
Chosen methods become C++ in a JNI library for Windows, Linux and macOS, x64 and arm64.
Custom VM
Protected code runs inside a bespoke virtual machine with mixed boolean arithmetic.

On the way to the buyer

No two customers download the same file.

Per-download watermark
License, owner, time and signature are baked in several redundant ways.
Bound decryption key
Each download carries its own key, patched into the VM for that loader only.
In-memory loader
Protected code streams over an encrypted channel and never touches disk.
Regional nodes
A signed node directory routes customers to the fastest region, in Europe, Singapore and Australia.

While it runs

The code checks its surroundings and its license, continuously.

Server activation
The VM keeps its keys locked until the server signs a grant for this license.
Device identity
A stable hardware ID with clone, replay and container detection.
Debugger and agent detection
Attached debuggers, Java agents and suspicious JVM flags stop the program.
Integrity checks
Bytecode dumpers, deobfuscators and edited hosts files are caught at runtime.

When something leaks

A leaked copy points straight back to the buyer who shared it.

Leak tracing
Every delivery is logged, so any jar maps to one download and one customer.
Sharing detection
IP caps, server limits and HWID slots flag a key used in too many places.
Blacklists
Block by IP, license key or owner, for your team or the whole platform.
Audit trail
Validations, resets and bans are logged and rate-limited per license.

No grant, no run.

Patching out a license check does nothing when the code itself is locked. Activation happens in four moves, every time the software starts.

  1. Handshake

    The loader and server agree on fresh keys over ECDH. Every message after that is encrypted.

  2. Verify

    Key, expiry, IP and server limits, hardware ID and blacklists are checked against a single-use challenge.

  3. Grant

    The server answers with a signed, short-lived grant. Replays and forged replies are rejected.

  4. Run

    Only a valid grant releases the VM keys. Without one, the protected code cannot run at all.

Built to plug into what you already run.

REST API

Create, look up and manage licenses from your own tools with a per-account key.

Sign in with your store

A full OAuth 2.0 and OpenID Connect provider, with PKCE, consent and app revocation.

Source over Git

Sell source code: each buyer gets an encrypted, watermarked copy plus incremental patches.

Leak lookup

Upload a leaked jar or paste a download key and get the buyer back.

GET /.well-known/openid-configuration
{
  "issuer": "https://your.store",
  "authorization_endpoint": "https://your.store/oauth/authorize",
  "token_endpoint": "https://your.store/oauth/token",
  "userinfo_endpoint": "https://your.store/oauth/userinfo",
  "jwks_uri": "https://your.store/oauth/jwks",
  "revocation_endpoint": "https://your.store/oauth/revoke",
  "grant_types_supported": ["authorization_code", "client_credentials", "refresh_token"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "code_challenge_methods_supported": ["plain", "S256"]
}

Standard OpenID discovery, so existing OAuth libraries work without custom code.

Ship your next release protected.

Vanity is opening to its first sellers. Tell us what you sell and we will set you up.

Request access