adding password protection to your indicator / expert advisor

Related: hedging martingale - another powerful expert for MetaTrader 4 traders.

several methods of protecting your code have been proposed over the past, but were either too simple (less secure), required re-compilation of your code for each new customer (ok if you only plan on having a dozen or so customers) or far too complicated involving a remote host to validate the client terminal.

Also recommended: vr---se t k a=2=01032026 - similar expert with strong performance on MetaTrader 4.

here i propose a simple password verification scheme which uses mt4's built in security engine providing des/ecb encryption and does not require code re-compilation for each new customer.
having worked on several high profile canadian smart card initiatives, i became quite familiar with the various security schemes used by financial institutions and card issuers. the first question you have to ask yourself is "what's at risk?". a risk assessment is always done when starting a project with these guys. if the answer is "millions and millions of dollars", then this security scheme is not for you.
if, on the other hand, your answer is "a month or two of coding if somebody spends about a year hacking my security scheme", then this solution is for you. the single des key used in this encryption scheme will provide more than adequate security for your code and will not require code re-compilation for new clients.
i have provided two source files for your convenience. the first one "password_check" is what you will add to your indicator or expert advisor. it will verify the password entered by the user in the input parameter "password" and if the password is incorrect (or if the user is offline) it will display a user friendly message, remove the expert (if that's what's running) and return a init_failed status.
the second file, "password_generate", is used to enter the client's name and account number you want to protect. it will display the password generated so you can provide this to your clients. obviously, you don't want to include this code in your final product! :)
so let's get started...
first, we need to define an input string to your indicator or expert advisor:
next, we add code in the init() function to check the password and display a message if the password is incorrect, if the user is offline or the user simply didn't enter a password.
now come the meat... we need to encode the client name and account number with our des key, encode the result into base64 and compare with the password entered. if the result matches, you have a happy customer. if they don't, you have a hacker trying to crack your des key. given that the expert advisor will unload itself each time a wrong password is entered, you'll probably have time to retire in bora bora before they succeed!
that's it! we can now validate the client name (as taken from metatrader 4's client account name) plus the client account number (also taken from metatrader 4).
if your licensing policy is to allow multiple accounts for a single client, then you only need to remove the account number from the 'client' string, as follows:
of course you can do a mix and match with "broker name", "account name" and "account login" the way you see fit. just remember that the longer the 'client' variable is, the longer the encrypted password will be.
next, let's take a look at the "password_generate" code. what we want to do is the same as the "password_check" but instead of entering a password into the ea, we want to enter the client name (or combination of broker name, account name and account login you choose) to be encrypted and then display the generated password. this is what you'll give to your clients when they purchase your kick-ass indicator and/or expert advisor.
again, in your init() function you'll add the following code.
now we do a slight modification to our "password_check()" function to return a string of the encoded password. remember to use the same password in both the password_check() function and password_generate() function. you can image what will happen if you don't!
as stated before, this security scheme does not require you re-compile your code for each new customer or code a server side validation host while providing pretty good security for your hard work creating that kick-ass indicator / expert advisor of yours!
cheers!
-claude.

You may also like: order notify - excellent alternative for expert users on MetaTrader 4.

#property copyright "robotfx"
#property link "https://robotfx.org"
#property version   "1.00"
#property strict
extern string     password;
int init()
{
   string   client = null;
   if(isconnected()) client = accountinfostring(account_name) + " / " + doubletostr(accountinfointeger(account_login), 0);
   if(!password_check(client))

.......

• This tool is provided for educational and testing purposes only.
• Past performance does not guarantee future results.
• Trading involves substantial risk of loss. Use on a demo account first.
• Results may vary depending on market conditions, broker, and settings.
• We recommend thorough backtesting and forward testing before using with real funds.