The situation
Licence enforcement is the single most common thing people want to protect, and the place where obfuscation is most often oversold. So this page is blunter than the others.
If your licence check runs on a machine the user controls, it can be defeated. That is not a limitation of this tool; it is the situation. What obfuscation changes is how much effort it takes.
What you are exposed to
- Someone searching decompiled output for "license", "trial" or "activation" and finding your check in seconds.
- A patched build circulating with the check removed.
- Your validation algorithm being extracted and turned into a key generator.
What obfuscation does here
- Renaming removes the signposts. Your ValidateLicense method is no longer discoverable by name.
- Automated tools and casual searchers lose their footholds; this stops opportunists rather than professionals.
- Combined with server-side validation, it meaningfully raises the effort required.
What it does not do
Worth being clear about the limits before you rely on this.
- Your user-facing strings are untouched, so searching for the expiry message still leads to the code near your check.
- No client-side obfuscation stops someone patching a branch instruction once they find it.
- There is no anti-tamper or anti-debug here. If you need those, a commercial protector is the honest recommendation — see the comparisons.
Suggested setup
| Plan | Either tier; this is about how you design the check, not the file size. |
| Public names | Enable it for applications — the fewer named entry points around your licensing code, the better. |
| Workflow | Validate against your server wherever the product allows it. Treat client-side checks as a deterrent layer, not the enforcement mechanism. |
Test this before you ship
Obfuscation only breaks things that resolve a name at runtime, so a short checklist catches nearly everything:
- Valid licences still activate after obfuscation.
- Expired and invalid licences are still rejected.
- Offline or grace-period behaviour is unchanged.
- Any licence file or registry serialization still round-trips.
If something does break, obfuscation and reflection lists each cause with its fix.