You guys were talking about it being sniffed with fiddler - Im pretty sure this is really easy to prevent, your webservice needs to expect certain parameters from the program and return certain params. Dont just pass the license key, pass other useless information, a good one is the current date/time encrypted. As long as only your program and the webservice know the key, it seems pretty much impossible to spoof? One would have to break the encryption to realize its a timestamp. To prevent harming actual users, just use the minute portion and allow for a factor of +- a few minutes. repeat it as a string x # of times, and encrypt, then pass to the webservice with your lic key for validation. Get creative!