How do 25-character product keys work?

Question

Microsoft products and other products often have a product key that is 5 groups of 5 characters, like this:

ABCDE-12345-ABCDE-12345-VWXYZ

How does the product know if the key is valid? Some sort of cryptography? Is there a library if I want to use this kind of product key in my code?

Answer 1

You might want to have a look at this article on how to implement a serial number validation function. It also goes into some advanced techniques such as how to keep on top of keygens, leaked keys, etc.

In short, there are typically three underlying fields in such a key:

• the actual serial number, which the article calls a "seed"
• some verification data; only part of the verification data is actually checked by the code
• a checksum, CRC or other simple typo-proofing mechanism

By only implementing part of the verification data checking in your code, you can do things like "genuine validation" (in which case the rest of the verification happens on your server) or trip up keygens by checking different subsets of the validation data in new releases.