How to Protect Your MT4/MT5 EA From Piracy (2026)

Every "protect your MT4/MT5 EA from piracy" article says roughly the same three things: use a license key, check the account number, maybe add a device limit. All true. None of it explains why so many EAs with exactly those protections still end up redistributed for free within weeks of release.

The gap isn't the advice — it's that most of it describes what to check without saying anything about where that check actually runs, or what happens once someone gets past it once. That's the part worth being specific about.

How EAs actually get cracked

Not folklore — the same handful of failure modes, over and over.

The check only exists in one place, and that place is local. If your license logic is entirely inside the compiled EA — an account-number comparison, a date check, a hardcoded serial — everything an attacker needs to defeat it ships in the same file you handed your customer. Decompiling and hex-editing .ex4/.ex5 files to patch out or bypass a local check is a well-documented, widely available technique in the MetaTrader piracy scene; it doesn't require sophistication, just patience with a disassembler.

The check is a single conditional. if (account != licensedAccount) return; is one instruction away from if (true). A check that lives in exactly one place, guarded by exactly one comparison, is one patch away from gone. This is the single most common reason a "protected" EA turns out not to be.

Trial and expiry dates check the local clock. TimeCurrent() (or the system clock) is something the person running your software fully controls. A date check with no external source of truth isn't really a check — it's a suggestion.

A cracked copy is a copy forever. Once one working, unlocked build exists, it doesn't stay with one person. It ends up on the same Telegram groups and cracked-EA forums that every MetaTrader seller already knows about, redistributed to anyone who asks — and if your licensing has no server-side revocation, there is nothing you can do about it after the fact except watch.

The license key itself becomes the product. If validation never phones home, then a leaked key isn't a stolen license — it's a keygen. Anyone with the key (or a pattern extracted from a few of them) can produce their own.

None of this means protection is pointless. It means the goalpost is wrong. "Impossible to crack" was never realistic for software running entirely on hardware you don't control. The real goal is a setup where a working bypass requires actual, repeated effort — not a five-minute patch — and where the license behind it can still be revoked and controlled after the fact.

What a setup that holds up looks like

Four properties, and they matter more together than any one of them alone:

Validation happens server-side, on every run. Not "the app pings home once at install." Every time the software starts, it asks a server it doesn't control whether this license is still good. A local patch can silence the result of that check, but it can't make the server say yes to a license that's been revoked.

Licenses are bound, with a real reset path. A device or trading-account identifier tied to the license means a leaked key alone isn't enough to run it somewhere else — but only if legitimate customers can reset that binding themselves when they reformat a PC or switch brokers. Binding without a working reset flow just generates support tickets from real customers, not fewer pirates.

Revocation is real and immediate. If you can't cut off a specific license the moment you find it circulating, you don't have licensing — you have a one-time paywall. The test is simple: revoke a key right now and confirm the software actually stops working. Most DIY setups have never actually run that test.

Outages don't punish paying customers. Server-side validation means your server's uptime becomes your customers' problem too — unless you've decided what happens when it's unreachable. A defined, bounded grace window (software keeps working for some hours after its last successful check, then re-validates once it can reach you again) means a real outage doesn't turn into angry refund requests from people who did nothing wrong. Decide this explicitly; don't let it be whatever the code happens to do by accident.

It's rarely just MetaTrader forever

Most of this article is MT4/MT5-specific because that's where most EA piracy discussion lives. But if you build software long enough, product lines drift — a companion Windows tool, a Python backtester you start selling separately, a browser extension. Licensing infrastructure that only ever spoke MQL becomes a second system to build the day that happens. Worth knowing going in, even if it's not today's problem.

Run the audit

Reading a list of properties is easy to nod along to and hard to actually check yourself against. We put together a short, practical checklist that turns the sections above into pass/fail items you can run against whatever you're using right now — LicenseFort or anything else.

Get the EA Protection Audit Checklist → Free, no strings — a real audit, not a sales pitch. Most DIY setups pass the first section and fail somewhere in the last two; that's normal, and it's exactly where real infrastructure (not just a code snippet) starts to matter.

If you want to see what server-side validation, device binding, real revocation, and a documented grace window look like already built rather than hand-rolled, the MT4/MT5 page walks through it — upload your source, LicenseFort inserts and compiles the check for you, no MetaEditor required on your end.