Zero network dependency
Verification happens entirely on the machine that runs your software. The customer network may be fully offline or physically air-gapped — licensing keeps working.
SECURITY ARCHITECTURE
Air-Gapped Verification
OnionZero licenses are verified with pure mathematics against a pre-shared public key. No license server, no internet, no phone-home — 0.0 KB of network traffic on the customer side.
Why verification without a network matters
Industrial control systems, defense contractors, hospital infrastructure and financial back-offices often run in networks that are deliberately disconnected. A licensing system that must "call home" simply does not work there — or worse, becomes the weakest link in an otherwise sealed perimeter.
Nothing to intercept
Because no request ever leaves the machine, there is no endpoint to block, spoof or fingerprint. The attack surface of the licensing channel is reduced to the local signature check itself.
No vendor-side outage risk
Your customer's production line never depends on the uptime of a licensing server. There is no "license server is down" scenario in the offline model.
How offline verification works
The trust anchor is asymmetric cryptography: the vendor signs, the software verifies — and only mathematics sits in between.
Ed25519 signatures
Every license envelope is signed with the vendor's Ed25519 private key at issue time. The matching public key ships inside the protected product.
Local signature check
On every load, the runtime verifies the license signature against the embedded public key. Forgery would require breaking the Ed25519 signature scheme.
Machine binding check
The verified license is matched against the hardware/OS fingerprint of the machine it runs on. A license copied to another machine does not match and is rejected.
Fail closed
Any mismatch — altered payload, wrong machine, invalid signature — ends in a clean refusal. The software never executes under an unverified license.
Where air-gapped licensing fits
If your customers operate in regulated or disconnected environments, offline-first licensing is not a feature — it is a requirement.
- SCADA, OT and industrial automation networks without internet access
- Defense and public-sector deployments behind sealed perimeters
- Hospital and laboratory systems with strict egress policies
- Financial back-office and on-premise banking infrastructure
- Any environment where an outbound licensing call is a compliance incident
BEYOND PHP
The same guarantee beyond PHP
OnionZero PE/Binary and Android protection seal ready-made .exe/.dll binaries and Android APKs under the same security architecture:
- Offline license mode verifies with a local signature check — sealed binaries and APKs run in fully air-gapped networks with zero network traffic.
- Sealing keys are cryptographically bound to the device anchor, so a copied artifact cannot be opened off its machine — with no online check required.
Licensing that survives without the internet
Tell us about your deployment environment — we will show you how an offline OnionZero flow fits into it.