Features
Each pass is independent and battle-tested. Stack them for defence in depth — from casual crackers to serious reversers.
Strip every meaningful name out of your binary.
PasGuard walks the VMTs and form resources (DFM for Delphi, LFM for Lazarus) and renames published classes, properties, fields, methods, method parameters and component names to random identifiers. Package-info and version-info strings are scrambled too. A pre-flight check warns you when a name is also used via reflection (FindComponent / RTTI) so nothing breaks.
Keep secrets out of a hex editor.
String literals are encrypted in place and a compact decrypt stub is injected into a fresh PE section — or an ELF segment on Linux — wired to run before your entry point. Every literal gets its own keystream, and the seed is not stored: the stub derives it from a checksum over its own code, so patching the stub turns your strings into noise rather than exposing them. At rest your URLs, SQL and messages are unreadable; at runtime they decrypt transparently. Win32, Win64 and Linux x86-64.
What this is not: a determined reverser with a debugger can still recover strings, because the stub has to decrypt them without help and therefore carries everything it needs. String encryption raises the cost of casual inspection and automated extraction — it is not a vault.
Make license cracking cost something.
The bundled RSA-2048 + SHA-256 licensing toolkit lets you issue signed, per-customer licenses. Signatures cannot be forged without your private key, so the practical attack is swapping the public key embedded in your binary. PasGuard encrypts that key blob, and when string encryption is enabled too it ties the two together: a substituted key changes the seed your strings decrypt with, so the application stops working instead of accepting a forged license. Compile-time revocation lists are supported out of the box.
The binding needs both passes enabled. On its own, key encryption raises the effort of a key swap; it does not prevent one. Making a check genuinely hard to remove also depends on how your application uses the result — verify in more than one place, and fail later rather than at the check.
Ship signed, in one pass.
Point PasGuard at your signing tool and it runs as the final step of every protected build — so the executable your customers download is Authenticode-signed and SmartScreen-friendly, with no extra manual step.
Compare plans or talk to us about an Enterprise site license.
View pricing Contact sales