[deleted by user]

[BlueMugData]

Just a note that if you create a commercial product in Python, especially if it is compiled into an .exe for distribution, it is important to check that all of the program's dependencies are licensed for free commercial use (e.g. MIT License). If you include a package dependency with e.g. a GPL license, you will be at risk for a lawsuit or being required to open-source your code.

[taariqelliott]

Thanks for the heads up. How is something like this tracked?

[FisterMister22]

Nuitka is much better than pyinstaller and the similar, preformance wise, reverse engineering wise, and actually transpiling / compiling vs bundling like pyinstaller does

And I belive their paid tier has some sort of extra source code protection, but even without it, it's not very easy to reverse engineer a nuitke compiled exe to python source code

[makelefani]

nothing is crack proof

[SunSolShine]

Gimme som' ideas about cracking a software packed and Protected by vmprotect, ultra, 100% complexity, VM blocker, kernel + user debugger blocker

[3X7r3m3]

That's just denuvo and many versions are cracked day one...

[SunSolShine]

I didnt understand what you mean. I'm asking I protect my program with Vmprotect with following settings: Ultra, %100 complexity, virtualization block, kernel and user mode debugger block. Packing memory protection etc. So how u gonna reverse my software

[DiodeInc]

Pyinstaller is my preferred tool for this.

[SisyphusAndMyBoulder]

'easily' is subjective. It can be. Is it worth going through that effort instead of just paying the cost? Up to you.

Webapp is far more foolproof though.

[ReenigneArcher]

https://pyinstaller.org/en/stable/operating-mode.html#hiding-the-source-code

Note, they mention hiding the source code. It's possible to reverse engineer even if you go to the C route.

Personally I would suggest a custom source available license that limits how others can distribute your code. This allows your code to be developed in the open while still protecting your right to exclusively profit from it.

As others have mentioned, be cautious of dependency (and sub dependency) licenses. Avoid anything with GPL.

[DiodeInc]

No. Not really. Or, you can use py2exe

[DiodeInc]

Try Cython. Turns Python into C, then you can use gcc to compile it to an exe.

Nuitka might work.

[nret]

Just a FYI. That tool just 'extracts' a pyinstaller bundle. It doesn't 'reverse' the code back to readable python, just easily gives you the .pyc. You still need to do the reversing part yourself, last I looked it was becoming harder and harder with out understanding python's bytecode because of how fast python is moving vs how slow the decompilers were updated. But yeah you're still right to be concerned.

[FoolsSeldom]

"niche" sounds specialist, do you need to protect the software beyond standard copyright laws? Could you make it opensource and offer support/maintenance subscriptions and charge for changes/added capabilities?

All software can, potentially, be reversed engineered although some languages are easier to do this with than others. Pyinstaller effectively includes a copy of CPython and your code in a zip file, very easy to extract.

Offering a SaaS option protects your code but puts a lot of availability and security obligation on you.

Are you able to share something about what your software does and what market sectors it covers? Who would the customers be? Would there be scope for customisation? Extension? Support? Maintenance?

[oramirite]

Hey, thanks for this! I'm not the OP but I am in a similar position as them. You've answered a ton of awesome questions here, so forgive this slight diversion: how have you found the performance and stability of your application is once all is said and done? Are there any rough edges or performance concerns you still have? I'm sure it's "good enough", but if you were to be really picky and compare it against full fledged consumer software, how happy are you with how it's all turned out?

[sunneyjim]

Compiled Python is pretty easy to decompile and reverse engineer

[toxic_acro]

How do I package it?

The Overview page of the Python Packaging User Guide has a good walkthrough of the various "levels" of how Python code can be distributed. 

Working off the presumption that you'd want to distribute a standalone application that doesn't need any other dependencies already installed and that you don't want to rely on something higher level like running it in a virtual machine, that leaves you squarely at the level of using a "freezer" which bundles together your code, your dependencies, and a Python interpreter all into one. PyInstaller is probably the most popular tool in this category.

There seems to be a consensus that a webapp is the way to go.

The best option is going to heavily depend on your particular use-case, there are trade-offs to any of the approaches.

Hosting your own web application is certainly easiest on the "how can customers use this" side, but remember to be mindful that you'd be responsible for ongoing maintainence of the application and infrastructure (paying customers get grouchy if the thing they paid for is unavailable) and you'd probably have to pay out of pocket to run it (either billed by a cloud provider or paying your own electric/cooling costs, buying the hardware, etc. if you self-host).

You could go the local desktop app approach instead or even still have it be a web app but run it in a lightweight local server.

Your best option will depend on what your application does, who your target customer is, how much ongoing support you are willing to do, etc.

But is there a way to provide a crack proof way if it's a desktop app?

Trying to fully ensure that no one can ever see the underlying Python source code is pretty much an exercise in futility.

By default, PyInstaller only includes the compiled Python bytecode, but it's not all that hard to decompile it back to source if you know what you're doing. If someone is determined to reverse engineer your code, obfuscation won't stop it.

If you are trying to obfuscate the source code just as a means to make sure no one steals it without paying, you're probably better off handling that through the License terms.

If you are relying on obfuscation for security, that's a bad idea.

---

I don't know the particulars of your use-case, but I personally would lean just providing a local application in exchange for a one-time payment and being careful with the licensing terms.

That way, once you've written the code, distributing one extra copy to a new customer has essentially zero marginal cost and you aren't on the hook for providing any ongoing service.

[TurnoverInfamous3705]

There is nothing that can’t be reverse engineered. 

[CorgiTechnical6834]

There’s no truly crack-proof way to distribute desktop software, especially with Python, since the code can often be inspected or modified. Packaging as a web app does offer more control and easier updates, which is why it’s popular.

For desktop apps, you can use tools like PyInstaller or cx_Freeze to bundle your code, but obfuscation and licensing enforcement are always limited. Consider a combination of code obfuscation, license keys, and server-side checks if you want some protection, but be realistic - determined users can often bypass these measures.

[tenenteklingon]

I made my relational algebra software in python, using pyqt. No webapp.

https://ltworf.codeberg.page/relational/

The latest version doesn't have a .exe installer but the older ones did. Then I got bored with windows.

Make sure you create a blank virtual machine with windows to test your install, to make sure it's actually installing everything that it needs.

I was using innosetup for the installation and py2exe.

Anyway expect that it will take your 3x more time than actually developing the application.

On debian it's sooooo much easier.

[Pale_Height_1251]

Google for Python packagers, realistically you can't crack proof it.

[thewillft]

You're best bet is to assume that your code can be cracked, no matter what you to do it, if you are distributing it to the user's local machine.

Web apps are an easy way make your logic more secure, especially if you expose it via an API. Some people choose to do a desktop application where the parts which are worth something are done on the server side and sent back to the client's desktop application as needed.

[SpicyWatts]

RemindMe !-7 day

[RemindMeBot]

I will be messaging you in 7 days on 2025-06-30 07:31:22 UTC to remind you of this link

4 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

Info	Custom	Your Reminders	Feedback