Frequently Asked Questions¶

General¶

What is PyLocket?¶

PyLocket is a B2B platform that helps Python developers ship protected desktop applications with built-in licensing. It encrypts your Python bytecode at the function level, provides a native runtime for secure decryption, and includes a complete licensing infrastructure.

How is PyLocket different from PyArmor?¶

PyLocket provides function-level encryption (not obfuscation), a hardened native runtime with multiple anti-reverse-engineering layers, built-in licensing and delivery infrastructure, and a developer portal for managing apps and licenses. PyLocket is an all-in-one platform — you do not need to build your own licensing or distribution system.

Does PyLocket modify my source code?¶

No. PyLocket operates on compiled bytecode (.pyc) inside your packaged application. Your source code files are never modified. Only the function bodies in the packaged bytecode are replaced with stubs that call the native runtime.

What packaging tools are supported?¶

PyInstaller (onefile and onedir), cx_Freeze, BeeWare Briefcase, Python wheels, and generic ZIP/tar archives. See Supported Platforms for the full matrix.

What Python versions are supported?¶

Python 3.12, 3.13, and 3.14.

What operating systems are supported?¶

Windows (x64), Linux (x64, ARM64), and macOS (Intel x64, Apple Silicon ARM64).

How do I publish my app for multiple operating systems?¶

Build your app separately for each target OS (e.g., using PyInstaller on each platform or a CI/CD matrix build), then upload each platform's artifact as a separate build under the same app. One license key works across all platforms — each OS activation counts as a separate device toward the device limit. The delivery page automatically shows download buttons for each available platform. See the Multi-OS Publishing Tutorial for a complete walkthrough.

Does PyLocket code-sign my app?¶

No. PyLocket never signs your app with a certificate. You sign your protected app with your own certificates (Authenticode on Windows; an Apple Developer ID signature plus notarization on macOS) and upload the signed copy with Replace with Signed Package. PyLocket stores it byte for byte and delivers that copy to your customers. Lamaute Labs signs PyLocket's own components (the runtime library inside a Windows or macOS app, and the PyLocket Installer and Hub), never your app. An app you have not signed meets Windows SmartScreen and macOS Gatekeeper warnings or blocks, and on Windows and macOS the PyLocket Installer and Hub refuse to install it. Linux builds need no signature. See Code Signing.

Protection¶

What exactly gets encrypted?¶

Every Python function body, method body, class body, and module-level code block in your application, with a small number of documented exceptions. Non-Python files (images, configs, data files, C extensions) are not encrypted by PyLocket.

A scope is left unencrypted only where encrypting it would stop the application running, or where there is nothing in it to conceal: bodies using free variables from an enclosing function, generator and coroutine bodies, bodies too small to carry information, bodies with no names or string constants, and packaging shapes where sealing cannot be applied safely. Each one is listed in the build's coverage summary rather than skipped silently. See Protection for the full list.

Does encryption hide values from my own running app?¶

No, and it is not meant to. Your application has to be able to read its own values, so a class attribute or constant is readable at runtime by anyone holding a valid licence. What encryption removes is the ability to recover those values from the files you ship without one.

That distinction is the whole guarantee: strong against anyone without a licence, and a substantial cost increase for anyone with one. Anything a customer must never learn belongs on your server, not in the binary.

Can someone still decompile my application?¶

A decompiler will see the stub functions (which call the native runtime), not your original code. The original bytecode is encrypted and stored in the protection manifest. Without a valid license key, the bytecode cannot be decrypted.

Is my code ever sent to PyLocket in plaintext?¶

Your application artifact is uploaded over TLS and stored encrypted at rest. During protection, the worker processes your code in an isolated environment. After protection, only the encrypted output is retained.

Does PyLocket protect C extensions?¶

No. C extensions (.pyd, .so files compiled from C/Cython) are not modified by PyLocket. Only Python bytecode is encrypted. If you need to protect C code, use a separate tool.

Can I protect a library (not an application)?¶

Yes. Protect a Python wheel (.whl) and distribute the protected wheel to your customers. They install it with pip and it validates the license on import.

Can I choose which modules to protect?¶

Yes. By default, PyLocket automatically protects only your application code and skips standard library modules, packaging tool internals, and common third-party packages. You do not need to configure anything for most projects. If you need to override the default classification, declare the modules or functions you want protected in a pylocket.toml file, or send force_include / force_exclude when you create the build. See the Module Selection guide for details.

Important: Only protect your own code. Do not force-include third-party libraries — this increases build time, artifact size, and may break dependencies that use reflection or dynamic imports.

What level of protection does PyLocket provide?¶

Every build receives maximum protection automatically, including military-grade encryption, anti-reverse-engineering countermeasures, memory protection, and binary hardening. No configuration is needed.

Licensing¶

How do license keys work?¶

License keys follow the format XXXX-XXXX-XXXX-XXXX (16 alphanumeric characters). Each key is globally unique and works on any platform for the same app.

How does device activation work?¶

When the end-user runs your app and enters their license key, the app generates a unique device identifier, and sends it (as a one-way hash) to PyLocket's API. If the license is valid and the device limit is not exceeded, PyLocket returns a signed runtime token that enables decryption.

Does the app need to be online to run?¶

Only for the first activation. After that, the app works offline for up to 14 days since it last reached PyLocket; every launch or background refresh while online starts the 14 days again. A free trial still stops on its end date, online or not. If you revoke a license, a device picks that up the next time it is online.

What happens if my customer gets a new computer?¶

Their new computer produces a different device identifier, consuming a new activation slot. If all slots are used, you can reset their activations via the CLI (pylocket licenses reset-devices) or the Developer Portal.

Can I set licenses to expire?¶

Yes. Use --expires when creating a license to set an expiration date. After that date, the license status changes to EXPIRED and activation fails.

Can I revoke a license?¶

Yes. Use pylocket licenses revoke --license <KEY>. The revocation takes effect immediately for new activations and at the next token refresh for already-activated devices.

Does PyLocket handle end-user payments?¶

No. PyLocket never processes end-user payments. You handle payments through your own storefront (Stripe, Gumroad, Paddle, etc.) and redirect buyers to PyLocket's delivery page for license key and download.

Billing¶

How much does PyLocket cost?¶

Free tier: 10 build downloads per app, 10 licenses total across all apps (no credit card required)
Base fee (Pro subscription): the current annual rate shown on pylocket.com/pricing, locked for you once you subscribe. It covers your entire developer account, regardless of how many apps.
License fee: $4 per end-user license issued. Sell through a PyLocket-brokered checkout and it comes out of that sale; issue licenses any other way and they are added up on a monthly invoice to your subscription card.
Storage fee: $0.32 per GB per year (metered; ~$0.02/year for a 50 MB app)

Before you download your first protected build, a one-time $0.97 identity verification, paid to our verification partner, confirms you are a real developer. No card is needed to create an account.

See Billing & Pricing for details.

Is there a free tier?¶

Yes. Every developer account gets 10 free build downloads per app and can create up to 10 licenses total across all apps with no credit card required. Free-tier licenses are issued as 30-day trials. This is enough to test the full protection and distribution workflow before upgrading to a paid plan.

When do charges start?¶

After the 10th build download for an app. Until then, everything is free.

How is the license fee charged?¶

Once per license issued. When you sell through a PyLocket-brokered checkout (a Stripe checkout PyLocket sets up on your own connected Stripe account, so the sale is yours), the $4 comes out of that sale. When you issue licenses any other way (marketplace API, redemption codes, direct links), each one records a usage event and they are added up on a monthly invoice to your subscription card. Free trials are never charged, whichever way they were issued: trial download links, license_type: "trial" on the API (the CLI's --type demo), trial redemption batches, Shopify partner trials, and every license issued on the free tier.

What if I cancel my subscription?¶

When you cancel your yearly subscription, it remains active until the end of the current billing period. After that, two separate windows start:

End-user license grace period (30 days). For 30 days after your paid access ends, your customers' existing licenses continue to work normally, so someone travelling or offline is not cut off the day you stop paying. A license that was already set to expire before then still expires on its own date; the grace period never extends one. After the grace period expires, those end-user licenses become invalid and activation will fail. You cannot create new protected builds or issue new licenses after cancellation. If you resubscribe before the grace period ends, all licenses are restored automatically.
Window to resubscribe at your original rate (45 days). You have 45 days from the day your access ended to resubscribe at the rate you originally signed up at. The Billing page shows the exact date while the window is open. After that, resubscribing is billed at the current rate shown on pylocket.com/pricing. This window is about your subscription price only; it does not change how long your customers' licenses keep working.

Can I get a refund?¶

Your first Pro subscription payment is refundable in full within 30 days of the charge, on request and with no conditions. License fees, storage fees and renewal payments are not refundable. Email support@pylocket.com from the address on your account.

Technical¶

What happens if PyLocket's servers go down?¶

Already-activated applications continue to work offline for up to 14 days since they last reached PyLocket
New activations will fail until the servers are back
Build downloads use a CDN with independent availability

What if PyLocket goes out of business?¶

Already-activated applications continue to work offline for up to 14 days since they last reached PyLocket. After that, they require server contact for re-activation. If the servers are permanently offline, applications will stop functioning when those 14 days run out. We recommend maintaining your own backup distribution channel.

Does PyLocket work in Docker containers?¶

Yes. Device fingerprinting works in containers, though the fingerprint may change if the container is recreated with different hardware characteristics. For containerized deployments, consider using longer offline grace periods.

Does protection work with virtual environments?¶

Yes. Virtual environments are a Python-level concept and do not affect PyLocket's runtime protection, which operates at the bytecode level.

Is there a size limit for artifacts?¶

The default upload limit is 500 MB. For larger artifacts, contact support.

How long does protection take?¶

Typical protection times:

Artifact Size	Approximate Time
< 10 MB	30-60 seconds
10-50 MB	1-3 minutes
50-200 MB	3-10 minutes
> 200 MB	10+ minutes

Times depend on the number of Python functions and the current queue load.

What is the performance impact?¶

PyLocket adds minimal runtime overhead. I/O-bound applications see negligible impact. CPU-bound applications see a small, single-digit percentage overhead. See Performance for details and optimization tips.

Troubleshooting¶

My protected app won't start¶

Verify all files from the protected output are present (executable, native runtime, protection manifest)
Check that --python matches the build environment
See Error Messages for specific errors
If Windows shows a SmartScreen warning or macOS says the app cannot be opened or verified, the app is not signed with your certificate. Sign it and upload the signed copy; see Code Signing

Build failed with INVALID_BYTECODE¶

The --python version does not match the Python used to build the artifact. Rebuild the artifact with the correct Python version or adjust the --python flag.

HTTP 402 Payment Required¶

You have exceeded the free tier (10 downloads per app). Add a payment method in the Developer Portal → Billing.

Activation fails for my customer¶

Verify the license key is correct (copy-paste to avoid typos)
Check the license status in the Developer Portal (should be ACTIVE)
Check the device limit — the customer may have used all slots
Ensure the customer has an internet connection

Build is stuck in pending or processing¶

Wait 5-10 minutes; the queue may be under load. If stuck for more than 15 minutes, check the PyLocket status page or contact support.

Still Have Questions?¶

Check the Error Messages reference
Email support@pylocket.com with your App ID and a description of the issue
For sales inquiries, contact sales@pylocket.com