How it works
How Oxrion works
Oxrion lets you use and distribute your software while keeping its source code private. Here is the whole picture: the three pieces, the steps, the keys and tokens, and what happens to your code.
The three pieces
An app, an encoder and a loader
-
Your computer
Oxrion Desktop
The free app (Windows, macOS and Linux). You choose what to protect, sign licenses, recover source and keep your keys in the Vault. Everything except protecting runs offline.
Learn more → -
Oxrion
The Encoder
The service that protects your files. It receives only the PHP files you select, protects them in memory and returns them. Nothing is stored.
Learn more → -
The server that runs the code
The Oxrion loader
A free PHP extension, installed once per server. It checks each protected file and runs it. PHP 8.1–8.5, 64-bit, Linux and Windows.
Learn more →
Step by step
From source to a licensed delivery
- 1
Get your Encoder Token
Create an account in the Oxrion Console and generate your Encoder Token — it starts with oxe_. It tells the Encoder which account and plan you protect with, so keep it private like a password. It only grants access; it doesn't encrypt anything. Save it in the Vault and Oxrion Desktop fills it in for you.
Account & Encoder Token → - 2
Choose files and options
Point Oxrion Desktop at a .php file, a folder or a ZIP, and tick the PHP files to protect — usually your own code, not third-party libraries. Then turn on the options this delivery needs: Server lock, License, Recovery, Stamp or Expiry.
The Encoder → - 3
Protect
Only the selected PHP files and your options are sent, over an encrypted connection. They're protected in memory and handed straight back into your output folder — with the rest of the project copied alongside, or as one ZIP.
Data & privacy → - 4
Deploy and run
Upload the protected project. The server needs the free Oxrion loader — on a VPS, one command installs it; on shared hosting, your host adds it. One protected file runs on every supported PHP version (8.1 – 8.5), so customers can upgrade PHP without new files from you.
Install the loader → - 5
License your customers
If you protected with the License option, sign a small .lic file for each customer's host — a domain, localhost or an IP — with an optional expiry. Signing happens offline with your own key. Your customer puts the file in the project's root folder; without a valid license, the code doesn't run.
Licenses →
Keys & tokens
Every key and token, and where it goes
Oxrion Desktop keeps them in the Vault: one encrypted file on your computer, unlocked with one password. Private keys never leave it.
| Name | What it's for | Where it goes |
|---|---|---|
| Encoder Token | Identifies your account when you protect. From the Oxrion Console; starts with oxe_. | Sent to Oxrion with each protection |
| License key pair | The public key binds files to licenses; the private key signs the licenses. | Public key: into the files. Private key: never leaves your computer |
| Recovery key pair | The public key makes files recoverable; the private key restores them. | Public key: into the files. Private key: never leaves your computer |
| External key | For Server lock: a secret the server must hold in its environment. It is part of decryption. | To the Encoder when protecting, then discarded; and to your server |
| Email password & webhook secret | For emailing licenses and signing webhooks. | Your own email provider; nowhere else |
Protection options
Decide how each file may run
Every protected file is encrypted and signed — change a byte and it refuses to run. On top of that:
- Server lock
- Runs only where your external key is set in the server's environment.
- Paid plan or credits
- License
- Runs only on a host with a valid license file from you.
- Paid plan or credits
- Recovery
- Lets you restore the original source later, offline, with your private key.
- Every plan
- Stamp
- Embeds identifying notes — system notes on every plan, your own notes with a paid plan.
- Every plan
- Expiry
- The file stops running after a date you choose.
- Paid plan or credits
Recovery
Getting your source back
Recovery is a safety net for the day you lose your source, or need to change code you only have in protected form. It's free on every plan and works offline.
- 1
Create a recovery key pair
In the Vault. The public key can be shared; the private key stays with you.
- 2
Protect with Recovery on
Give the Encoder the public key. It's embedded in every protected file.
- 3
Restore when you need to
Open Recovery in Oxrion Desktop, give it the protected files and the private key, and choose an output folder. You get the original source back — nothing is sent anywhere.
Only files protected with Recovery can be restored, and only with the matching private key — no one else can, including Oxrion. Keep your original source and back up your Vault.
Recovery →Sent to Oxrion when you protect
- · The PHP files you selected — nothing else from your project
- · Your options, and the public keys and external key they use
- · Your Encoder Token, to identify your account
Files are protected in memory and returned straight away. Oxrion keeps neither your source nor the protected output.
Never leaves your computer
- · Your private keys and the Vault
- · The licenses you sign, and your License History
- · Everything Recovery restores
Frequently asked questions
Can't find what you're looking for? Reach out — we read every message.
-
Will my protected files run on my server?
Yes. Your production server only needs the free Oxrion loader installed as a PHP extension. Once it's in place, protected files run just like normal PHP — no changes to your application required.
-
What PHP versions are supported?
PHP 8.1 through 8.5 (64-bit), on Linux and Windows. You protect once: the same protected file runs on every supported version, so customers can upgrade PHP without new files. The Oxrion Desktop app, where you protect your code, runs on Windows, macOS and Linux.
-
Is my source code safe when I protect it?
Yes. To protect a file, the Desktop app sends it over an encrypted connection, it's processed in memory, and the protected result is returned immediately — then everything is discarded. No source is saved to disk, no copies go into a database, and your licenses are generated locally in the app. There's nothing left on our side to expose.
-
Can I protect a whole project at once?
Yes. In the Oxrion Desktop app, point it at a folder or drop in a ZIP and every PHP file inside is protected in one pass, with your folder structure preserved.
-
Where does encryption happen?
On Oxrion's encoder service. The Desktop app sends only the PHP files you select, over an encrypted connection and with your Encoder Token; they're protected in memory and handed straight back. Nothing is written to permanent storage. Everything else — licensing, recovery and your keys — stays and runs on your machine.
Get started in minutes
No credit card required. Free plan ships with the same crypto as paid plans.