# A Cryptolens alternative for software licensing


Yes — if you're weighing [Cryptolens](https://cryptolens.io) for licensing a .NET product, [Keyright](https://delta1labs.com/keyright) is a credible alternative worth a look. Both are .NET-friendly licensing services that issue keys, activate machines and gate features. Keyright's angle is an offline-first signed-license model, per-tenant signing keys, entitlements and self-service trials built in, and a free tier to evaluate on — from the team behind [Nebula.NET](https://delta1labs.com/products/nebula). Here's an honest side-by-side.

## Where Cryptolens is strong

Cryptolens is an established, well-regarded product, and a fair comparison starts by saying so:

- **A long .NET track record.** It's been licensing .NET software for years, with client libraries and a documented Web API.
- **Offline activation and node-locking.** It supports activating machines and validating licenses without a constant connection.
- **Feature-based licensing.** You can gate functionality by what a given license includes, plus time-limited and floating-license models.
- **A mature feature set.** Reporting, key management and integrations refined over many releases.

If you already rely on a specific Cryptolens capability, or an on-premise arrangement that's serving you well, that existing fit counts for a lot.

## Where Keyright differs

Keyright solves the same problem — issue licenses, let software verify them, manage seats and features — with a few deliberate choices aimed at modern .NET teams.

- **Offline-first signed licenses.** Keyright issues a signed license file carrying the entitlements and expiry; your app verifies the signature *locally* against a public key embedded at build time. No network call is required, so it works fully air-gapped. Add online activation when you want seat enforcement and revocation, with an optional grace window for re-checks.
- **Per-tenant RSA signing keys.** Every account gets its own isolated RSA key pair — your signatures never share a key with another vendor. The private key stays server-side, AES-256-GCM–encrypted under the service KEK; your app only ever embeds the public key.
- **Entitlements and tiers, read locally.** Define tiers with seat counts and entitlement templates, and ship one binary that unlocks features per plan from signed entitlements the SDK reads on the device.
- **A drop-in `Keyright.NET` SDK — plus Node, Python and Java.** Configure the SDK with your product slug and public key; a few lines validate an offline license, activate a node-locked seat, and read entitlements. It **fails closed** to the unlicensed state if verification fails or a key is revoked. The license/activation format is a documented HTTP + signature scheme, so you can verify from any language.
- **Self-service trials in one call.** A single `POST /v1/trial` from your own site issues a time-limited key that auto-expires, is fully revocable, and converts to paid without re-keying — no manual license emails.
- **A hosted customer portal.** Customers view keys, manage seats and download offline files themselves, which cuts support load.
- **Instant revocation.** Kill a leaked or refunded key in one click; SDKs honor the revocation list on their next check-in.
- **A genuine free tier.** $0 forever, up to 50 active licenses across one product, no card — so you can ship real licensing before paying.
- **Nebula.NET compatibility.** Keyright's licensing is wire-compatible with Nebula.NET's checks, so obfuscation and licensing come from one place.

## Side by side

| | Cryptolens | Keyright |
|---|---|---|
| Focus | Established .NET licensing service | .NET-first platform, offline-first design |
| Offline signed licenses | Yes | Yes (verify locally against embedded key) |
| Online activation / node-locking | Yes | Yes |
| Seats & transfer | Yes | Yes (self-service deactivation) |
| Feature / entitlement gating | Yes | Yes (signed, read locally by the SDK) |
| Per-tenant isolated signing keys | Varies by setup | Yes, RSA key pair per account |
| Self-service trials | Build on the API | Built in (one API call) |
| Customer self-service portal | — / varies | Built in |
| SDKs | .NET + others | .NET, Node, Python, Java |
| Self-hosting | Options exist | Hosted SaaS; self-host on the roadmap |
| Free tier | Check current plans | Yes — $0 forever, up to 50 active licenses |

*(Competitor capabilities and plans change over time — confirm current details on Cryptolens's own site before deciding.)*

## Where Cryptolens may still be the better fit

An honest comparison names the cases where the incumbent wins. **If you're already invested in Cryptolens** and depend on a specific feature or an on-premise deployment that's working, the cost of migrating may not be worth a marginal gain. And **if you need to run the licensing service inside your own infrastructure today**, weigh that carefully: Keyright is currently fully hosted SaaS, with a self-hosted option on the roadmap rather than shipping now. Choose the tool that fits your constraints, not just the longer feature list.

## How to decide

Test it against your own product, not a spec sheet. Issue a license on each, embed the SDK, and run the paths that matter: verify a signed license file with the network disconnected, activate a node-locked seat, hit the seat limit, then revoke a key and confirm your app drops to the free state on the next refresh. For a .NET codebase, notice how much of the surrounding machinery — entitlements, trials, a customer portal — you get without building it.

Keyright's [Free plan](https://delta1labs.com/pricing?product=keyright) lets you prove all of that out before spending a cent. Start with the [Keyright overview](https://delta1labs.com/keyright) and the [getting-started guide](https://delta1labs.com/docs/keyright/getting-started), and run it head-to-head with your shortlist.