OnionZero v1.0 is out — how we protect your PHP code
The first stable release of OnionZero is here: your PHP source is encrypted with AES-256-GCM, decrypted in memory by the ozguard extension, and licensed fully offline.
After a long development and hardening cycle we are shipping the first stable release of OnionZero. Here is a plain, no-hype walkthrough of what the product does and how it protects your PHP code.
The problem
When you install a commercial PHP product on a customer's server, your source code is effectively handed over. Licensing schemes that require network validation fail on air-gapped networks, field installations and hardened corporate environments.
How OnionZero approaches it
- OZP1 encryption: each PHP file is encrypted with a per-file random key using AES-256-GCM. The encrypted package can be downloaded by anyone but is unreadable without ozguard.
- The ozguard native extension: a small PHP extension written in C hooks into the engine's file compiler, decrypts the file in memory and compiles it. Plaintext never touches the disk. Without the extension the files simply do not run.
- Offline signed license (.ozlic): the license file is bound to the machine fingerprint and signed with your private key. Verification happens fully locally — the license check works even on a network with no internet access.
- Online license server (optional): for internet-facing deployments you can run your own license server; the same product can ship both offline and online licenses.
- Signed auto-updates: update packages (OZU1) are signed by the seller; the client only applies packages you signed.
- Anti-debugging and tamper detection: ozguard ships baseline defences against debuggers and memory dumping attempts, and detects license-file tampering.
What this means
You distribute your product without shipping source code; license term, module limits and machine counts are managed from a single panel; and the license layer keeps working even inside air-gapped customer networks.
Who is it for?
OnionZero is built for independent developers, agencies and software teams shipping closed-source PHP products. It works with Laravel, CodeIgniter and plain PHP alike — the only requirement is that the ozguard extension can be installed on the customer's server.
What's next
Broadening Linux and macOS support alongside Windows, self-service license downloads in the member panel, and richer installation telemetry are on the roadmap. For architecture and setup details, see the documentation.
In short: you write the code — OnionZero handles the encryption, the licensing and the updates.