# It's too easy to crack paid plugin and IDEs **URL:** \ **Category:** IntelliJ Platform\ **Created:** [January 27, 2026, 3:41pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588 "2026-01-27T15:41:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jonathanlermitage.1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jonathanlermitage.1](https://platform.jetbrains.com/u/jonathanlermitage.1)\ **Post date:** [January 27, 2026, 3:41pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/1 "2026-01-27T15:41:17Z")
I don’t know how to alert JetBrains about this problem. I won’t discuss it publicly, and I already opened an issue for that ([CPRTINF-5521](https://youtrack.jetbrains.com/issue/CPRTINF-5521/Prevent-the-use-of-illegal-license-keys), private to JB and me), but it’s super easy to use paid plugins and IDEs without paid licenses. I opened CPRTINF-5521 two months ago, and still zero feedback. This led me to add additional protections to my plugins, but I wonder why JetBrains seems to remain silent on this issue. I understand that this is certainly a critical issue, but you could at least give your opinion when plugin developers alert you to it. (feel free to delete this thread, I just want to alert you about this issue, and get a minimal feedback) ---
**Author:** ![robert.novotny](https://sea1.discourse-cdn.com/flex001/user_avatar/platform.jetbrains.com/robert.novotny/32/2046_2.png) [@robert.novotny](https://platform.jetbrains.com/u/robert.novotny)\ **Post date:** [January 29, 2026, 9:22am UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/3 "2026-01-29T09:22:28Z")
Notified the corresponding people. ---
**Author:** ![jonathanlermitage.1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jonathanlermitage.1](https://platform.jetbrains.com/u/jonathanlermitage.1)\ **Post date:** [February 3, 2026, 2:49pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/4 "2026-02-03T14:49:52Z")
Still no feedback. Just for info, my latest plugin releases are protected against the given crack, and it had to happen: yesterday (2 weeks after I’ve published my plugin releases), a user email me because he can’t use my plugin. I look at his idea.log: he was clearly using a crack 🤣 Which means at least some people still crack the IDE, and plugins… I really hope you will take is seriously. ---
**Author:** ![momomo.com](https://sea1.discourse-cdn.com/flex001/user_avatar/platform.jetbrains.com/momomo.com/32/3280_2.png) [@momomo.com](https://platform.jetbrains.com/u/momomo.com)\ **Post date:** [July 30, 2026, 9:49am UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/5 "2026-07-30T09:49:52Z")
Seems pretty easy … i just wasted 3 months to now be preparing a release to find out its too easy … and i tried it on a couple of paid plugins … must be deliberate … this is so bad … i mean there are ways to protect that is way better than this … everything is in the shipped plugin.xml ---
**Author:** ![jonathanlermitage.1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jonathanlermitage.1](https://platform.jetbrains.com/u/jonathanlermitage.1)\ **Post date:** [July 30, 2026, 12:26pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/6 "2026-07-30T12:26:49Z")
No, the documentation clearly says the product descriptor `plugin.xml` is not enough. You should at least add license verification calls in your code. See [Add license verification calls to the plugin code | JetBrains Marketplace Documentation](https://plugins.jetbrains.com/docs/marketplace/add-marketplace-license-verification-calls-to-the-plugin-code.html) I think the problem is: - the license facade is easy to crack. That means you can’t just rely on the state of the license facade. - the IDE itself is easy to crack. This is frustrating because there are known ways to detect and block several cracks, but the IDE still allows them, which also allows these cracks to work on our plugins. - 3rd-party plugin developers can’t discuss thus subject with the security team. No help, no advice, no response. Personally, I managed to detect most cracks by myself, and with the help of friendly plugin developers. So, I would recommend you to: - add [license calls](https://plugins.jetbrains.com/docs/marketplace/add-marketplace-license-verification-calls-to-the-plugin-code.html) in your code. This is the first thing to do. - try to detect some cracks (the most commons and less advanced cracks are mostly java agents or dedicated plugins) - obfuscate your plugin. Don’t use ProGuard, as this is not an obfuscator but only a trimmer. Prefer a real obfuscator like [Zelix KlassMaster](https://www.zelix.com/) (I’m working on a guest blog post about Zelix). It’s worth its price (USD 290 for a single developer). [Minimal documentation](https://plugins.jetbrains.com/docs/marketplace/obfuscate-the-plugin.html#zelix-klassmaster) about Zelix integration. - keep in mind that this must be invisible to legitimate users. ---
**Author:** ![dseptimus](https://sea1.discourse-cdn.com/flex001/user_avatar/platform.jetbrains.com/dseptimus/32/2805_2.png) [@dseptimus](https://platform.jetbrains.com/u/dseptimus)\ **Post date:** [July 30, 2026, 8:37pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/7 "2026-07-30T20:37:44Z")
I’m curious to know if anyone taking active anti-piracy measures (beyond obfuscation and license calls) has a sense for how wide-spread/impactful piracy is on their bottom line/paid subscriber base. Is the cat/mouse game of detecting and blocking the various cracks actually worth the effort from a financial perspective? ---
**Author:** ![jonathanlermitage.1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jonathanlermitage.1](https://platform.jetbrains.com/u/jonathanlermitage.1)\ **Post date:** [July 30, 2026, 9:56pm UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/8 "2026-07-30T21:56:37Z")
I’ve started to see things differently since I realized that ~90 % of my users are using a pirated version. I’m not saying that anti-piracy measures will win over paying users, absolutely not.If it has any effect, it will take time to measure. But, if I could convince even just 4 or 5 % of these guys, my business would finally become profitable. Developing anti-cracks doesn’t take much effort, and my income is far from sufficient at the moment. While that, I’m also working on other projects to pay the bills. I just think that when software is too easy to pirate, some people don’t even consider paying. I’m trying to target those few people. ---
**Author:** ![momomo.com](https://sea1.discourse-cdn.com/flex001/user_avatar/platform.jetbrains.com/momomo.com/32/3280_2.png) [@momomo.com](https://platform.jetbrains.com/u/momomo.com)\ **Post date:** [August 20, 2026, 10:16am UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/9 "2026-08-20T10:16:11Z")
@jonathanlermitage.1 How do you notice they are using pirated version? You include some kind of tracker? Making outbound requests? Thanks 🙂 ---
**Author:** ![jonathanlermitage.1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jonathanlermitage.1](https://platform.jetbrains.com/u/jonathanlermitage.1)\ **Post date:** [August 20, 2026, 11:12am UTC](https://platform.jetbrains.com/t/its-too-easy-to-crack-paid-plugin-and-ides/3588/10 "2026-08-20T11:12:48Z")
Yes, I detect some cracks, and I collect my own metrics.