Application fingerprinting

DYCRYPT fingerprints bind a licence to one application instance without transmitting raw machine identifiers.

What the SDK reads

The SDK attempts to read five stable signals:

Component	Typical source
machine	Operating-system machine identity.
board	System or motherboard identity.
mac	Primary non-loopback, non-virtual network interface.
osid	Operating-system installation or boot-volume identity.
host	Hostname.

Unavailable components are omitted rather than guessed. IP address, user name, process ID, and container ID are excluded.

What leaves the machine

Each component is normalized and hashed separately. DYCRYPT uses the first 128 bits of SHA-256 with the component name included in the hash input. Raw values never leave the machine.

The default licence requires three matching parts. Your SDK configuration can require more, but cannot lower the signed requirement.

Privacy

Hashes are one-way and truncated, but they are stable enough to recognize the same installation. Mention online fingerprint processing in your application’s privacy notice when you use Full Online or Hybrid.

Print a fingerprint for offline activation

Every SDK exposes a fingerprint helper:

System.out.println(Fingerprint.of());

import { fingerprint } from '@dycrypt/license';
console.log(fingerprint());

from dycrypt_license import fingerprint
print(fingerprint())

The output has this transport-safe shape:

DYC1.<base64url encoded hashed parts>.<checksum>

Expose it through a command such as your-application --fingerprint. The customer runs the command on the target machine and sends the entire output to the licence issuer.

Hardware changes

A 3-of-5 match tolerates common changes such as a host rename or replaced network card. When enough components change:

• for Full Online or online-activated Hybrid, an authorized user releases the machine binding in DYCRYPT and the next check claims it;
• for Full Offline or offline-activated Hybrid, generate a new fingerprint and issue a replacement licence.

Fingerprinting prevents casual licence sharing. It cannot stop a determined attacker from patching enforcement code that runs on a machine they control.