PHP encryption & licensing
Encrypt your PHP. Keep your source.
Oxrion is a PHP encoder with licensing built in. Protect your code in your browser or in the free Oxrion Desktop app, license it to each customer, and run it on their servers with the free loader. Your code runs — its source stays yours.
Free plan with 20 files a month · Web, Windows, macOS and Linux
<?php
final class PricingEngine
{
private const MARGIN = 0.18;
public function quote(int $seats, string $plan): float
{
$base = ['team' => 39, 'agency' => 89][$plan];
$tier = $seats > 10 ? 0.9 : 1.0;
$net = $seats * $base * $tier;
return round($net * (1 + self::MARGIN), 2);
}
}
$total = (new PricingEngine)->quote(12, 'team');
echo 'Total: $' . number_format($total, 2), PHP_EOL;The same file, before and after. It runs exactly as before with the free Oxrion Loader — but its source can't be read, and a changed file refuses to run.
- Tamper-proof
- Modified files refuse to run
- Licensed
- Per customer host, with expiry
- One file
- Runs on PHP 8.1–8.5
- Linux + Windows
- NTS and TS loader builds
How it works
Encrypt PHP code in one pass
-
01
Get an Encoder Token
Create an account at console.oxrion.com. The free plan includes 20 files a month; paid plans add more files and every option.
-
02
Protect your files
Drop a file, folder or ZIP into the Web Encoder or Oxrion Desktop and pick the PHP files to protect. Only those are sent, protected in memory and returned.
-
03
Deploy & run
Ship the protected files. Any server with the free Oxrion loader runs them like normal PHP — no changes to your application.
More than encryption
Sell it, license it, deliver it
Protecting the code is half the job. Oxrion Desktop also runs the business side — licenses, records and delivery — on your own machine, free and unlimited.
- Licenses bound to a host
- Sign a small .lic file for each customer's domain, localhost or IP, with an optional expiry. Signed offline with your own key — as many as you need.
- License History
- Every license you issue, in one searchable list: customer, host, expiry, when it was sent. Start a renewal from any record.
- Email & webhooks
- Email the license to your customer from your own SMTP account, or notify your own system with a webhook — signed, if you choose — the moment it's created.
- Keys in a Vault
- Your license, recovery and server keys live in one encrypted file on your machine, unlocked with a single password.
Protection
Choose how each file may run
Every file is encrypted and signed. On top of that, pick the options a delivery needs — each one is explained in the docs.
Strong encryption
Your source is sealed with strong, industry-standard cryptography. The original code never ships — only a protected file that runs but cannot be read.
Tamper-proof files
Every protected file is signed and verified before it runs. Change a single byte and it's rejected — no silently modified code ever executes in production.
Server lock
Lock a file to an external key that only you and your server hold. The key is part of decryption itself: without it in the server's environment, the file can't be opened at all.
Public or licensed files
Choose how each file is allowed to run. Public files run anywhere; licensed files run only where you permit. The rule travels sealed inside the file itself.
Recoverable by design
Turn on Recovery when you protect, and the Oxrion Desktop app can restore the original source later — offline, on your own machine, with your recovery key. No account, no upload, no lock-in.
Free, minimal runtime
You protect code in the Oxrion Desktop app; the server you deploy to needs only the free Oxrion loader — small, fast, and identical everywhere. Nothing that does the protecting ever ships to production.
Your code stays yours
We never keep your code
Only the PHP files you select leave your machine. They're protected in memory and handed straight back — nothing is written to our disks or databases. Licenses, recovery and your keys never leave your machine at all.
Your machine
Selected .php files
Oxrion Encoder
Protected in memory
Nothing stored
Your machine
Protected files
-
No source stored
Processed in memory and discarded — never written to permanent storage.
-
No copies of the output
We don't keep the protected files either. We count usage, not code.
-
Licenses on your side
Signed on your machine with your key. We never see or hold them.
-
Encrypted in transit
Every request to the encoder is encrypted, start to finish.
Who it's for
For anyone who ships PHP they'd rather not give away
- Plugin & theme authors
- Sell your work without sending readable source, and license each copy to the customer's site.
- Agencies & freelancers
- Deliver client projects on their servers, bound to the domain they were built for.
- Self-hosted software vendors
- Ship to customers' own servers without exposing your codebase or your licensing logic.
Why Oxrion
One file for every PHP version
Protect once. The same file runs on PHP 8.1–8.5, so your customers can upgrade PHP without waiting for new files.
Licensing through to delivery
Sign per-host licenses, keep a record of every one, email them and notify your own system — in the same free app.
Your source is never a hostage
Protect with Recovery, and you can restore the original source offline with your own key. No account, no ticket.
Start free, pay per file
20 files a month on the free plan; paid plans from $5 a month, down to 6¢ a file.
Looking for an ionCube alternative? See how Oxrion compares →
Questions
Frequently asked questions
Can't find what you're looking for? Reach out — we read every message.
-
What does Oxrion do?
Oxrion lets you use and distribute your software while keeping its source code private. Today it protects PHP: you protect your files in the Web Encoder or the free Oxrion Desktop app, then ship the protected versions to your customers or servers. The code runs exactly as before, but the original source can't be read, copied, or modified.
-
Do I have to install anything to protect my code?
No. The Web Encoder at encoder.oxrion.com protects your PHP in the browser: paste your Encoder Token, drop a folder, a ZIP or a PHP file, and download the protected project as a ZIP. It uses the same Encoder, options and quota as Oxrion Desktop. Licensing, Recovery and the Vault work offline in the free Desktop app.
-
Is my source code safe when I protect it?
Yes. To protect a file, the Desktop app or the Web Encoder sends it over an encrypted connection, it's processed in memory, and the protected result is returned immediately — then everything is discarded. No source is saved to disk, no copies go into a database, and your licenses are generated locally in the Desktop app. There's nothing left on our side to expose.
-
Will my protected files run on my server?
Yes. Your production server only needs the free Oxrion loader installed as a PHP extension. Once it's in place, protected files run just like normal PHP — no changes to your application required.
-
Can I protect a whole project at once?
Yes. Point the Oxrion Desktop app or the Web Encoder at a folder or drop in a ZIP and every PHP file inside is protected in one pass, with your folder structure preserved.
-
Where are my licenses stored?
On your machine, not ours. Licenses are generated locally in the Oxrion Desktop app and never uploaded to us. Your ability to license and recover your own code never depends on us — and there's no license database on our servers to be breached.
-
Can I get my source code back?
Yes — if you turn on Recovery when you protect. Recovery embeds your recovery public key in the files; with the matching private key, the Oxrion Desktop app restores the original source offline, on your own machine. No account and no connection needed. Files protected without Recovery can't be restored, so keep your original source as well.
Get started in minutes
No credit card required. Free plan ships with the same crypto as paid plans.