Skip to main content
Orilami

Generate a signing key in the sidebar to begin. It is created in your browser and never leaves it — download it to reuse the same key for every buyer.

Fill the licence details, then issue.

Digital License & Watermark: before and after

An illustration with sample files; your own files show their own results.

BeforeSelling software with nothing to check

  • Just details from an order

  • Plain-text key anyone can edit

  • Unmarked manual

AfterSigned licences you can verify offline

  • Signed .license file

  • Verified with the public key

  • Stamped for its buyer

Digital License & Watermark

A local-first licensing kit for people who sell digital products: templates, e-books, courses, plugins, source bundles. Generate a signing key in your browser, issue a signed licence for each buyer, stamp a per-buyer watermark into a PDF and pack the licence into a ZIP. A zero-dependency verifier you embed in your product checks every licence offline. The signing key and every file stay on your device.

What is cryptographically strong, and what is a deterrent

The signed licence is the strong part: it is signed with a private key only you hold, so no one can forge a licence or change a single field (a feature flag, an expiry, a buyer) without breaking the signature. The PDF watermark is a deterrent: it marks a leaked copy with the buyer's name and order id, but a determined re-sharer can remove it. The tool says so plainly instead of selling the stamp as an unbreakable lock.

Offline verification, no licence server

The generated snippet embeds your public key and verifies a licence with only WebCrypto, in a browser, Node, Deno, Bun or a Cloudflare Worker. It pins your key and ignores the key inside the file, so a forger cannot pass a licence signed with their own. There is no server to run and nothing phones home.

Zero-recompression ZIP packing

Packing a licence into a ZIP copies every original entry's compressed bytes through unchanged (same CRC, same compression) and appends one small stored licence file. Large archives are rewritten at copy speed and stay bit-for-bit identical. ZIP64 archives are declined rather than altered.

What it does not do

It does not modify Windows, macOS or Linux executables: changing a signed binary's bytes is what code-signing exists to detect, so that belongs in your own signed build pipeline. It issues and verifies licences and marks documents; it does not enforce them, which only your product can do by checking them with the embedded key.

Frequently asked questions

What exactly can a buyer not forge?
A licence is signed with a private key only you hold, so no one can produce one that passes verification without it. Changing any field (a feature flag, an expiry, a buyer id) breaks the signature and the verifier reports the licence as tampered. The private key is generated in your browser and never leaves it unless you download it.
Does my product need an internet connection to check a licence?
No. The verifier snippet embeds your public key and checks the signature and expiry offline, using WebCrypto in browsers, Node, Deno, Bun and Cloudflare Workers. There is no licence server and nothing phones home.
Why does the verifier ignore the public key inside the licence file?
A forger could sign a fake licence with their own key and it would look consistent. The snippet pins your public key and trusts only that one, so a licence signed by any other key is rejected. The file carries the key for humans to read; your product should never trust it.
How is the buyer's e-mail handled?
Only a SHA-256 hash of the lower-cased e-mail is written into the licence; the raw address is never signed or stored. Your product can confirm a licence belongs to an e-mail by hashing it the same way and comparing.
Does packing a licence into a ZIP re-compress my files?
No. Every original entry's compressed bytes are copied through unchanged, keeping its CRC and compression, and only a small licence file is appended, so files stay bit-for-bit identical. ZIP64 archives are declined rather than altered.
Can the PDF watermark be removed?
The visible stamp can be removed by someone determined, and the embedded licence in the PDF metadata can be stripped; the tool never claims otherwise. The stamp works as a deterrent, since a leaked copy carries the buyer's name and order id. The signed licence is the cryptographically strong part.
Does this inject licences into .exe or other program files?
No. It works with licence files, PDFs and ZIP archives. It deliberately does not modify Windows, macOS or Linux executables: changing a signed binary's bytes is what code-signing exists to detect, so that stays with your own signed build pipeline.
Where does my signing key live?
The key is generated in your browser and stays there. Download the private key to reuse and back it up: it cannot be recovered if lost, and anyone who has it can issue licences in your name.
Do I need an account?
Only to spend tokens on a download. Generating a key, filling in a licence and verifying a file are free; the 120-token charge is for issuing a licence and covers its token file, stamped PDF and packed ZIP together.
Can one licence protect a whole ZIP and a PDF at once?
Yes. A licence is issued and charged once; the stamped PDF and the packed ZIP both carry it, so creating and re-downloading them is part of the single charge.
Which signature algorithm is used?
Ed25519 where the platform's WebCrypto supports it, otherwise ECDSA P-256 with SHA-256. The algorithm is recorded in the signature block and the verifier snippet matches it automatically.
More questions about Orilami →

Digital License & Watermark at a glance

Key facts about Digital License & Watermark: where it runs, what it costs, what it accepts and produces, and its limits.
Where it runsEntirely in your browser. Files are never uploaded.
Cost120 tokens per license (about $1.20 at the base rate)
AcceptsBuyer and order details for the licence. Optionally a PDF to stamp per buyer, or a ZIP to pack the licence into.
ProducesA signed .license JSON file, your public key, and a zero-dependency TypeScript verifier snippet to embed in your product. Optionally a per-buyer stamped PDF and a licence-packed ZIP.
BatchOne licence per charge; the ZIP and stamped PDF for that licence are included.
Account neededOnly to spend tokens. Browsing and previewing are free.
What it does not doIt issues and verifies signed licences and marks documents; it does not enforce them. A licence stops working only if your product checks it with the embedded public key, and the visible PDF stamp is a deterrent, not an unremovable lock. It does not modify executables.

Local processing vs. cloud tools

How Orilami compares with the typical online tool that uploads your file to its servers.

Orilami local processing compared with typical cloud tools on file privacy, edit and delete safety, speed, and pricing model.
CriterionOrilami (runs locally)Typical cloud tools
File privacy0 bytes leave your device. Files are processed in your browser's memory.Files are uploaded to external servers, where they may be logged or retained.
Edit & delete safetyYour original is never modified. The stamped copy is a new file built in memory.Your original and the result often stay on their servers after you leave.
Speed & performanceInstant: runs on your device, with no queue and no upload or download wait.Depends on your connection and on server load.
Pricing modelPay per use with tokens. No mandatory monthly subscription.Typically a recurring monthly subscription that adds up.

The cloud column describes upload-based online tools in general. Individual services differ.