To protect an MT4 or MT5 Expert Advisor from piracy, you need server-side license verification — not hardcoded account numbers, text file checks, or time-limited compiles. This guide covers why DIY approaches fail, what real protection requires, and how to add it to an EA with one file and a few lines of code.
You spent months building your Expert Advisor. The backtests look great. Customers are buying. Then you find your EA on a pirate forum — uploaded the same week you released it. Every download there is a lost sale. And there’s nothing you can do about it. Or is there?
The Real Cost of EA Piracy
Most EA developers underestimate piracy losses. Conservative estimates suggest:
30-50%
of potential sales lost to pirated copies
Zero Support
of burden for pirates — they don’t contact you for refunds or fixes
Reputation Damage
when pirated versions carry bugs you’ve already fixed in current releases
An EA can appear on piracy forums within days of launch, wherever it is sold — direct website, Gumroad, or client invoice.
The MQL5 Market provides some protection for products sold there, but if you sell through your own website, Gumroad, or directly to clients — you’re on your own.
Why DIY Protection Fails
Many developers try homegrown solutions. These approaches either don’t scale or are trivially bypassed.
Hardcoded account numbers
Account numbers are stored in the compiled .ex4/.ex5 binary. Any trader with basic hex editing skills can locate and replace the hardcoded value in minutes — no MQL knowledge required. There’s no obfuscation in MQL compilation that meaningfully prevents this.
Text file licenses
Text file licenses travel with the EA. If the EA reads a local file for activation, that file gets copied alongside every pirated distribution. The “license” becomes useless the moment someone shares both files in a forum post.
Time-limited compiles
Distributing a new binary every 30 days creates an operational burden without deterring determined pirates. A cracked copy from month one remains a cracked copy in month six — the expiry is simply patched out of the binary.
Check broker name only
Broker name strings are trivially editable in the compiled binary. Checking “only allow Broker X” takes a motivated user roughly 90 seconds to bypass with a hex editor.
What Effective Protection Looks Like
Professional license protection requires:
- Server-side verification — License state stored externally, not in the EA
- Account binding — License tied to specific account number + broker
- Remote control — Ability to disable licenses instantly
- Automatic trials — Time-limited access for prospects
Building this yourself requires backend development skills, server hosting, database management, and ongoing maintenance. Estimated cost: $400-$1,500+ and weeks of development time.
For developers who need a fully managed version of this architecture, our MetaTrader license management service handles the infrastructure side end to end.
The Hosted Alternative
LicenseShield provides all of this as a self-service platform. No servers. No backend. No DevOps experience required.
If you want a broader walkthrough before diving into the integration, the companion guide on how to protect MT4 programs the simple way covers the full decision framework.
Integration is one file and a few lines of code. You copy LicenseShield.mqh into your Include folder, add an #include and your API key, and call two guard functions from OnInit() and OnTick(). The check is compiled into your EA, so your customers install nothing. An account the server has not seen before is registered automatically, on a trial by default; from then on the license follows that account and broker, and you enable or disable it from your dashboard. The step-by-step tutorial has the code for MT4 and MT5.
From your dashboard, you can:
- See all active licenses
- Enable or disable any license (a running program picks the change up at its next check)
- Track when each license was last used
- Monitor trial expirations
Getting Started
- Register at licenses.barmenteros.com (free)
- Generate your API key on the dashboard and copy it
- Download
LicenseShield.mqhfrom the dashboard’s Quick Start Guide (MetaTrader 4 or MetaTrader 5 tab) - Place the file in your
Includefolder (nothing goes inLibraries) - Add the include and the two guard calls to your EA — the step-by-step tutorial on adding license verification to an EA has the full walkthrough, including the WebRequest setting MetaTrader needs
- Done — Manage licenses from your dashboard
The Free tier includes 10 verifications per day and 1 license — enough to test with a real customer before upgrading.
Frequently Asked Questions
Can someone decompile my .ex4 or .ex5 file and steal my EA code?
Partial decompilation is possible. Tools exist that convert .ex4 files back to readable MQL4 source — recovering variable names, function logic, and parameter values, though not always a perfect reconstruction. MT5’s .ex5 format is harder to decompile but not immune to reverse engineering.
This is a separate problem from piracy distribution, and license verification does not prevent decompilation. What it controls is the license state, which lives on the server, not in the binary: a copy running on an account you have not licensed gets at most a trial, and you can disable any account from your dashboard.
Does selling on the MQL5 Market protect my EA from piracy?
Partially — and only for copies sold through the Market itself. The MQL5 Market binds purchased products to the buyer’s MetaQuotes ID, so files can’t be directly redistributed and activated on another account.
If you also sell directly — through your own website, Gumroad, or direct client invoices — those copies have no equivalent protection unless you add it yourself. Developers who use both channels need a separate solution for their non-Market distribution. The two systems don’t interact.
What is account binding in EA license protection?
Account binding ties a license to a specific MetaTrader account number and broker combination. When the EA initializes, it sends the account number and broker name to a verification server. The server checks whether that combination holds an active license and returns allow or deny.
The key difference from local checks: the binding state is stored server-side, under your control. If a customer disputes a chargeback, you revoke the license remotely. There is no key for a customer to share: each account is licensed on its own, so a copy passed to someone else shows up as a new account, which you can leave to its trial or disable. Account binding enforced locally — such as hardcoded account numbers — provides none of these controls because the state lives in the binary, where you can’t touch it after distribution.
Can I add piracy protection to an EA I’ve already released without breaking existing customers?
Yes. A migration that keeps existing customers running:
- Tell current customers, before you ship the update, that it will check their account when it starts
- Ship the updated EA with verification enabled
- With a trial period set, each account is registered automatically on a trial the first time it runs, so nobody is locked out on day one
- Enable your paying customers’ accounts in the dashboard as they appear; an account you do not enable stops when its trial ends
Announcing the change before the update ships keeps support questions down.
Conclusion
EA piracy is a solved problem. You don’t need to build your own license server or accept lost sales as inevitable.
Protect your EA with one file and a few lines of code. Focus on building great trading software —let LicenseShield handle the rest.
Ready to stop piracy?
Protect your EA without running your own license server. Focus on building great trading software — let LicenseShield handle the rest.
Leave a Reply