Stop Python reverse engineering and protect your desktop app revenue in 2 minutes.
pip install pylocket
Built specifically for Python 3.12+ desktop binaries (Windows, macOS, Linux).
# Recovered source from your_app.pyc # uncompyle6 version 3.9.0 import stripe from licensing import validate def check_license(key): """Your proprietary license logic, fully exposed.""" secret = "sk_live_abc123..." return stripe.Subscription.retrieve(key) def main(): # All your trade secrets, right here api_key = "AIzaSyD..." model = load_proprietary_model() return model.run()
# Attempting decompilation... Error: Unable to decompile. Bytecode format not recognized. SyntaxError: encrypted payload detected File: <encrypted_module_7f3a> Cannot reconstruct source. Anti-tamper signature mismatch. # Functions decrypt one at a time, in memory, # only while they run. Your .py never ships.
Source encryptors decrypt back to your original .py at import time, so a decryptor can recover it. A PyLocket app ships no source and no embedded key: functions are decrypted one at a time in memory, and the keys are issued per device at activation, so there is no static file for a one-click decryptor to work on.
We don't promise "unbreakable" protection. Nothing is. We deliver five layers of real deterrence that make piracy expensive, without killing your build workflow or crashing your users.
Built for independent developers and small ISVs who sell a Python desktop app. Not for web apps or server code: if you don't ship a desktop app to end users, you don't need PyLocket.
uncompyle6 and pycdc recover near-perfect source from your .pyc files instantly.
Auto-py-to-exe crackers strip your PyInstaller packaging in a coffee break.
A simple binary patch bypasses your carefully coded validation logic.
Downloads climb on pirate sites while sales plateau. The average dev loses 30–40%.
Variable renaming and base64 add friction for you, not for crackers.
Ship only a tiny cleartext bootstrap. The real payload stays encrypted on disk. Always.
Functions decrypt in memory only at call time, then re-encrypt or zero out.
Anti-debug, anti-VM, dynamic API resolution, memory protections, obfuscated by default.
Transformed bytecode breaks standard decompilers and unpackers. Structural change, not renaming.
Every component is cryptographically signed. Tamper with any file and the app refuses to run.
They hit an encrypted wall and move on.
Blocked instantlyScript and unpacker tools have nothing to grab.
Rendered uselessWeeks of painful dynamic analysis instead of a quick crack.
Months, not hoursEnough protection to make piracy expensive, without killing your build workflow or crashing your users.
The five protection layers above are the foundation. This is the platform around them: licensing, delivery, updates, and sales.
Device binding, offline grace, revocation, automatic. No decorators, no imports, no SDK.
Windows, Linux (x64 + ARM64), macOS (Intel + Apple Silicon). One command, five targets. Python 3.12+.
Activations, license usage, platform mix, protection status, all in one view.
Integrate your payment provider. When a customer pays, their license is generated and delivered automatically.
Push application updates, patches, and new builds directly to end-user desktop installations from a single dashboard action.
Deliver seamless remote app updates through the loader bootstrap without building custom updater executables, scripts, or manual download workflows.
Your dashboard after your first 50 customers: activations, revenue, and downloads in one view.
Build once, protect everywhere. Multi-OS publishing guide →
Develop normally. No special imports, no SDK, no decorators. Your code stays 100% yours.
Point the CLI at your project. It analyzes, encrypts, transforms, and packages automatically.
Platform-specific builds, each with the hardened runtime loader and encrypted payload.
Ship it. Licenses enforce automatically. Customers get a smooth experience. Pirates get nothing.
Source encryptors turn your .py into an encrypted file that decrypts back to your original source at import time. To do that, the key has to travel inside your app, and the plaintext source has to exist in memory. Public one-click decryptors already exist for this approach.
Decryption runs on the user's machine, so the key must be present. If it can run, it can be recovered.
The whole point is to reproduce your .py, comments and all, the moment it's imported.
Turnkey tools and web services recover the original source from these files in seconds.
You still have to build or buy a license server, a storefront, and an update channel.
An anonymous encrypt-anything tool is what malware authors want, so AV engines distrust the category.
They're issued to each licensed device at activation, never embedded in your app.
Code is decrypted one function at a time, in memory, only while it runs. Your .py never hits disk.
Without the per-device key and native runtime, there's nothing to recover. Architecture, not a patch.
Device-bound keys, branded download pages, and one-click updates ship with the platform.
Every developer is identity-verified and every build is code-signed and scanned, trusted, not quarantined.
| Feature | PyLocket | Source enc. | PyArmor | Cython | DIY |
|---|---|---|---|---|---|
| Whole-app encryption | ✔ | ~ | ~ | ✘ | ✘ |
| JIT decryption | ✔ | ✘ | ~ | ✘ | ✘ |
| Native runtime hardening | ✔ | ✘ | ✘ | ✘ | ✘ |
| Bytecode transformation | ✔ | ✘ | ~ | ~ | ~ |
| Signed manifests | ✔ | ✘ | ✘ | ✘ | ✘ |
| Zero code changes | ✔ | ~ | ~ | ✘ | ✘ |
| Built-in licensing | ✔ | ✘ | ✘ | ✘ | ✘ |
| Cross-platform (5 targets) | ✔ | ~ | ~ | ~ | ~ |
| No percentage fees | ✔ | ✔ | ✔ | ✔ | ✔ |
| Free tier | ✔ | ~ | ✘ | ✔ | ✔ |
Free tier includes up to 10 end-user licenses (valid 30 days) and 10 free downloads per app. A one-time $0.97 identity verification applies.
A flat platform subscription (per account, not per developer seat) plus $4 per license activated. No percentage fees. Early subscribers grandfathered for life.
30-day money-back guarantee on your first payment — if PyLocket isn't right for your app, we'll refund it. See the refund policy.
You control your pricing, your distribution, and your customer relationships. We just make sure your code stays protected.
Keep your revenue. A flat subscription plus $4 per license activated, never a percentage. Sell a license for $50 or $5,000; our cut is the same $4 either way.
Subscribe at today's rate and you're locked in. As our price rises for new customers, early subscribers keep their original price.
One command to protect. No complex configuration, no build system rewrites, no learning curve.
No decorators, no imports, no SDK. Your source remains 100% standard Python. Protection is applied at the build layer.
We don't claim to be unbreakable. We make piracy expensive enough that casual pirates move on and professionals think twice.
Offline grace periods, reasonable device limits, no always-online requirement. Your paying customers never feel punished.
The only risk is continuing to ship unprotected.
We've been in your shoes. That's why PyLocket exists.
Deep expertise in reverse engineering, binary analysis, and anti-tamper. We know what attackers do because we've studied their tools.
PyLocket isn't generic DRM bolted onto Python. It's engineered from the ground up for the Python ecosystem.
Every feature is designed to be simple, predictable, and respectful of your workflow. If it adds friction, we cut it.
"We built PyLocket because we were tired of watching great Python apps get cracked within hours of release. The tools available were either too weak, too complicated, or too expensive. We wanted something that just works."
No. PyLocket works at the build layer. You build your app with PyInstaller, cx_Freeze or Briefcase as usual, then point our CLI at the build output. No decorators, no imports, no SDK. Your code stays 100% standard Python.
PyLocket targets modern Python: 3.12, 3.13, and 3.14. The hardened runtime requires a current CPython, so releases older than 3.12 are not supported.
Five targets: Windows x64, Linux (x64 and ARM64), and macOS (Intel and Apple Silicon). All from a single protect command.
No, and we won't insult your intelligence by claiming otherwise. No software protection is unbreakable. What PyLocket does is make reverse engineering expensive and time-consuming enough that the vast majority of pirates move on. Casual pirates are blocked entirely. Automated tools are rendered useless. Even skilled reversers face weeks or months of work instead of hours.
PyLocket includes built-in license enforcement. When a user launches your protected app, the runtime validates their license automatically. Features include device binding, offline grace periods, and remote revocation. You manage licenses through the dashboard or API. No code changes needed on your end.
Legitimate users get offline grace periods. The app continues to work without an internet connection for a configurable period. We believe protection should stop pirates, not punish your paying customers.
The JIT decryption adds minimal overhead, typically single-digit milliseconds per function call. For most desktop applications the impact is imperceptible. The native runtime loader is compiled and optimized, not interpreted.
Yes. PyLocket works with PyInstaller, cx_Freeze, BeeWare Briefcase, and other packaging tools, it does not replace them. You build your application with your preferred packaging tool first, then upload the output to PyLocket for protection. See the PyInstaller guide for a full walkthrough.
When you cancel, your subscription remains active until the end of the current billing period. After that, a grace period begins during which your customers' existing licenses continue to work normally. Once the grace period expires, end-user licenses become invalid and activation will fail. You cannot create new protected builds or issue new licenses after cancellation. If you resubscribe before the grace period ends, all licenses are restored automatically. Resubscribing forfeits any grandfathered subscription rate; a fresh subscription is billed at the current rate.
Yes. The free tier includes the full protection pipeline, all security layers, and all platform targets. You get up to 10 end-user licenses and 10 free downloads per app to use however you'd like: development, testing, or early distribution. End-user licenses issued on the free tier are valid for 30 days. A one-time $0.97 identity verification applies to all accounts; this keeps PyLocket from being used to protect malware. When you're ready for production, upgrade for unlimited builds and licenses with no expiry.
Strong protection is valuable to the wrong people too: the same tools that protect a legitimate app could, in the wrong hands, hide malware from analysis. A one-time $0.97 identity verification means every developer on the platform is who they say they are, and it lets us code-sign and scan every build. That is why PyLocket-protected apps are trusted by users and antivirus engines instead of flagged. You pay it once, and it covers you for life.
When you subscribe to PyLocket, you lock in your subscription rate for life. As we grow and add features, the subscription price will rise for new sign-ups, but your rate stays exactly where you started. Subscribing today means paying today's price years from now, no matter how much PyLocket has grown.
Sign up for a free account and install the PyLocket CLI with pip install pylocket. Register your app with pylocket apps create --name 'My App', then protect your built artifact with pylocket protect --app <APP_ID> --artifact dist/my-app.exe. That's the whole workflow: no configuration files, no build system changes, no learning curve.
Never. We charge a flat platform subscription plus $4 per license you activate. Your revenue is yours: sell a license for $50 or $5,000 and our cut is the same $4. We don't take a percentage, ever.
That criticism is fair, and it is aimed at tools that ship a static key inside the app. PyLocket doesn't. Keys are issued to each licensed device at activation, and offline grace runs on a signed, time-limited token, not a secret stored in your binary. When the grace window ends, the app revalidates with the server; a revoked license stops working, and a tampered token or a tampered app simply fails validation. None of this makes cracking impossible, but there is no static key sitting in the file for someone to study or patch around.
You do. PyLocket stores what license enforcement needs: license keys, device activations, and the customer email you attach for delivery. You manage and export licenses through the dashboard or the API, you keep the customer relationship, and we never sell your data. If you cancel, a grace period keeps your customers' licenses working while you transition.
No code changes. PyLocket protects the build artifact you already produce: remove the old tool from your pipeline, build with PyInstaller, cx_Freeze, or Briefcase as usual, and run one protect command on the output. Licensing, delivery pages, and updates are included, so you can also retire a separate license server if you run one. See the PyLocket vs PyArmor and PyLocket vs SOURCEdefender comparisons for the details.
Within hours, your .pyc files are decompiled. Source appears on paste sites. Automated tools strip your bundle instantly.
Pirated versions with license checks patched out appear on download sites. Your customers find free alternatives.
Sales flatten despite growing interest. You're competing against free copies of your own software.
The average Python developer loses 30–40% of potential revenue to piracy. For an app generating $1,000/month, that's $3,600–$4,800 per year, lost to a problem that costs less than a coffee per license to address.
Protect once. Sell forever.
Free tier, no time limit. Subscribe to lock in early-adopter pricing, grandfathered for life. No percentage fees. Ever.