Game Development Stack Exchange is a question and answer site for professional and independent game developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting near the point where I'm going to be ready to release an alpha of my game. I'm curious as to how to implement a system where the game is un-launchable if a user name and password haven't been entered and verified. I plan on having an authentication server setup for verifying user credentials. I'm not concerned about making the game pirate proof, because that'll happen. I just want to make it more difficult for the casual user to share. What needs to be in place for such a system to work? My thoughts are to implement a system similar to this:

The first time the user logs in, have the users computer generate unique value based on their system attributes (not the actual attributes, I'm not collecting that). Logging in to the server sends username/pass and unique value, the server then attributes that username with that unique value and those are checked when the user logs in.

I don't plan on limiting the amount of computers a user can install on, but I want to be able to disallow obvious abuse of an account, i.e. it's being used on dozens of computers.

Is this system reasonable for a free-time sole developer? Or what kind of system would make sense for my requirements?


Let me elaborate a little on why I want to use the system unique ID. I think that having a key like that is what would enable me to have an offline mode. I guess I wouldn't need to send the key to the server. But once a user name and password have been authenticated by the server, I can instruct the game to generate that unique ID and pair it with the user name. Then when the user tries to launch the game in offline mode, I can check to see if that computer has been authenticated online before. This would disallow people copying a verified copy of the game to a different computer to use offline mode.

share|improve this question
Oh, just noticed, this is the 7000th question. Congrats gamedev! – Byte56 Mar 14 '12 at 18:47
up vote 1 down vote accepted

Machine specific keys are a backwards step, they always raise customer service costs and only punish legitimate users with lockouts. It's better to suffer 10 pirates for one customer than have 9 pirates and one lost customer, in my opinion.

How about this scenario: your game ships with one missing component; when the customer authenticates his purchase your server encrypts the missing component using the hashed password and installs it. Afterwards, every time the customer plays locally he still has to enter the password and it is used to decrypt the module into memory.

Even better, non-authenticated future customers get a phony module that serves up advertisements for your other titles and/or limits their play and recommends that they register.

Your job is to create sales, not punish pirates =)

share|improve this answer
Oh, I like that idea. It reminds me of Command and Conquer, where if you didn't have a valid key, all your buildings/units would self destruct after 30 seconds of play. I guess I could make all the players units become pirates and run away :) – Byte56 Mar 14 '12 at 19:03
I still don't know how I'll do this, but I like this idea the most. Thanks. – Byte56 Mar 21 '12 at 23:46

Why not take the Mojang approach? Once a user has registered either through the game or through your website, have a log-in screen that asks for their username and password. They your game checks the given username/pass with what is registered on your authentication server, and as long as they match then the game starts up. Why do you need to include their system specs as a key? Especially if you aren't going to limit the number of computers it can be installed on?

Of course, you would need an offline mode too. Nothing kills a game's reputation faster than not being able to play it unless you are online.

share|improve this answer
Doesn't Mojang require you to authenticate online at least once? I imagine that would be per-computer too. They must keep some kind of system ID for that right? – Byte56 Mar 14 '12 at 18:46
Yes, but it is not per-computer. The game that you download off their website is just the launcher. The game itself does not fully download and install until after at least one registered user authenticates. From that point on, you can play online / offline at will from any computer. – BerickCook Mar 14 '12 at 18:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.