Full Offline

Full Offline binds a signed licence to one machine before you issue it. After delivery, the application never contacts DYCRYPT.

Issuance flow

1. Add a fingerprint command to your application with the SDK.
2. The customer runs it on the target machine and sends you the DYC1.… output.
3. Paste the fingerprint into DYCRYPT when issuing the licence.
4. Deliver the signed .lic file.
5. On every start, the SDK recomputes the local fingerprint and compares it with the signed claim.

The licence continues working within its signed dates even when the machine is permanently air-gapped.

Application integration

Use verify() at startup and periodically for long-running processes. A fingerprint mismatch is returned as INVALID; do not implement a second, weaker machine check around the SDK.

Expose a fingerprint command for customer setup:

your-application --fingerprint
DYC1.<encoded hashed parts>.<checksum>

See the language-specific SDK page for the exact function.

Trade-offs

• You cannot deliver revocation or see check-in activity from an application that never connects.
• Issuance requires a fingerprint round trip with the customer.
• For replacement hardware, generate a new fingerprint and issue a replacement licence. The original signed binding cannot be edited.

Choose Full Offline for genuinely air-gapped or tightly firewalled customer environments.