PRODUCTS
OnionZero is a set of layers that protect your PHP-based software end to end: source code encryption, hardware-bound licensing and signed update distribution — all in one ecosystem.
SYSTEM ARCHITECTURE
Each layer is an independent defense line; together they form a vault around your PHP product — from the source tree to the customer’s server.
The OnionZero encryption engine seals each PHP source file under its own randomly generated AES-256-GCM key. What ships is a high-entropy OZP1 bytecode stream; plain source never touches the customer’s disk.
A C-core PHP extension embeds directly into the Zend Engine and feeds opcodes in memory. It watches for debuggers, file tampering and clock rollback while your application runs at native speed.
Licenses are Ed25519-signed artifacts carrying expiry, device and domain bindings in one file. Verification is pure mathematics — it completes with zero network, inside air-gapped facilities.
Your self-hosted command deck for the license fleet: issue, suspend and renew licenses, watch per-machine activation quotas and review installation telemetry from one console.
BEYOND PHP
OnionZero protection is no longer PHP-only: ready-made Windows executables and Android apps are sealed with the same device-bound licensing model.
OnionZero encrypts your ready-made .exe / .dll files — language-independent, whether written in .NET, native code or Python. At runtime the program is decrypted in memory only: no plain copy is ever written to disk, and the decryption key is cryptographically bound to the device anchor. Self-integrity checks and anti-debug guards are built in.
How it works, in one line — Encrypt once, then ship the sealed binary with a license that matches your distribution model — the protected program starts only on the device it was sealed for, without leaving a readable copy on disk.
OnionZero encrypts the compiled code of your Android app inside the APK; at runtime the code is decrypted in memory only — no readable copy is written to the device storage. The companion native library ships for three ARM ABIs, detects hooking toolkits such as Frida, and the same device-bound licensing model applies.
How it works, in one line — Seal the APK once and distribute it as usual — on the device, protected classes come alive in memory only, and the same offline or online license options govern where the app may run.
Both layers run on the PHP 8.0–8.5 support line of the OnionZero core, and the vendor public key is embedded in the runtime at build time — customers have no key file or php.ini key setting to manage (ionCube-style).
FIELD COMPARISON
ionCube and Zend Guard defined the previous era of PHP protection. Here is what changes when the vault is rebuilt for the PHP 8 era.
| Capability | OnionZero | ionCube | Zend Guard |
|---|---|---|---|
| PHP 8.3 / 8.4 / 8.5 builds | Included | Partial / add-on | Not available |
| Native C-core decryption layer | Included | Included | Included |
| Air-gapped offline verification | Included | Not available | Not available |
| Anti-tamper / anti-debug runtime | Included | Not available | Not available |
| Hardware fingerprint binding | Included | Partial / add-on | Not available |
| Monotonic anti-rollback counter | Included | Not available | Not available |
| Signed automatic update channel | Included | Not available | Not available |
| Actively maintained (2026 builds) | Included | Included | Not available |
Compiled from public vendor documentation, September 2026. Customer-facing summary; not legal advice.
Read the setup docs to see the vault in operation, or talk to us about the licensing model that fits your product.