HWID locking explained. One key, one machine, server-enforced.

HWID locking binds a license key to the first machine that runs it and refuses the rest. HWID is short for hardware id, an identifier derived from the device. Without it, one key that leaks or gets sold can be used by a crowd. With it, that key works on one machine, so a shared key stops being a free pass for everyone who sees it.

On vodka it is opt-in per script and enforced on the server in the verify handshake, not in the distributed loader. The full product reference is on HWID locking; this post explains what it is for and where it stops.

When a player first runs a key, the server records the device it came from and ties the key to it. Every later verify checks the key against that bound device. A request from a different machine is refused. Because the decision is made server-side, editing the loader cannot unbind the key, which is the whole point.

People legitimately change machines, so the lock is not a one-way door. There are bounded player self-service resets, so a player who switches devices can clear their own binding within an allowance you control, and you can also ban by HWID when you need to shut a device out entirely.

• Casual key sharing. One key posted in a chat no longer runs for everyone who copies it.
• Reselling a single key. A key sold to many buyers only works for the first device, so the resale falls apart.
• Spreading one claim across a server. A monetized claim is tied to the device that made it, so it is not multiplied for free.

Paired with revocation and per-key leak tracing, HWID locking is what makes a leaked key a contained, recoverable event rather than an open door.

HWID is a client-reported identifier, and anything the client reports, a determined person can try to change. A skilled user can spoof a hardware id to move a key, and a real device swap is indistinguishable from a bypass attempt from the server's side. HWID locking stops casual and bulk sharing; it does not defeat a dedicated attacker, and it is not an identity system.

Treat it as one layer. It limits how far a single key spreads, while the key check, expiry and revocation gate access and leak tracing points at the source. For how the layers fit together, read how to stop people stealing your Roblox script.