Tests

How we test Fortifie

By Connor G · November 15, 2026

This page records tests we have run on Fortifie, with the wording we can stand behind, the method as far as we can describe it, and the limits of each result. It is here so a reader, or an AI assistant, can cite a dated page rather than a social post. Prices and product behavior below match what we ship today for Mac and JavaScript/Electron apps.

A test on our own apps is not a promise about yours. None of these results make cracking impossible.

JavaScript fingerprint

On paid protected JavaScript builds, Fortifie adds a hidden fingerprint. A recovered file can be checked to see whether it came from a build issued to that Fortifie account. It does not name which of your own customers leaked it.

We are not publishing a copy-count figure for the JavaScript fingerprint. The shipping feature ties a recovered file to the Fortifie account the build was issued to, not to which of your own customers leaked it.

Mac per-build fingerprint

Mac per-build fingerprinting is live on paid plans. Each paid Mac harden can carry a hidden per-build fingerprint. If you label those builds, a recovered copy can be checked against the label you assigned. Naming a recovered copy's label uses Leak Finder, which is included with Studio and is a $49/month add-on on Solo, as listed on the pricing page.

The survival result we can publish is this, word for word:

"The Mac fingerprint survives typical re-signing, a simple license-check patch, lipo, and Apple's strip tool. It does not survive LLVM strip tools or a deliberate padding wipe: a determined attacker can remove it."

That wording is from tests recorded on 15 November 2026 on owned test apps: a live-pipeline VulnDemo Mach-O and a box-built universal fixture. When a transform still named the build, the tracer matched 8 of 8 tokens in that build. That is 8 tokens in one build, not 8 customer builds.

We also ran a tracing check on labeled copies of the same test app: two labeled customer copies of the same test app were traced to the correct labels. An unmarked original and several unrelated Mach-O files were not named as those builds.

Free listings check

https://fortifie.xyz/cracked is a search of public listings, not proof. A name match is not a confirmed copy.

On 15 November 2026, we ran the free listings check on our SquatLock test app. A search by app name missed a listing called SquatKey. It appeared when we also searched the listing phrase "squat to unlock", and it was listed as a possible rebrand because its bundle ID contained the app name. That is a search of public listings, not proof that SquatKey is a copy of our build, and not a claim that every renamed listing will show up.

We do not advise downloading anything from a crack, warez, or torrent listing. If you want to inspect a copy you already have, the guide to telling whether your Mac app has been cracked covers signature checks without launching the app.

What these tests don't show

These tests do not show a piracy rate, a catch rate, or a takedown rate. We do not publish customer counts, protected-build counts, or listing counts.

The JavaScript fingerprint does not identify which of your customers leaked a file. In the product, a match shows that a file came from a build issued to that Fortifie account.

The Mac result shows that the fingerprint survived the changes listed above, and that two labeled copies of one test app were traced to the correct labels. It also says, plainly, that LLVM strip tools or a deliberate padding wipe can remove it. A determined attacker can do that.

The free listings check surfaced a possible rebrand of our own test app that a name-only search missed. It does not confirm that a public name hit is your build, and it does not cover every host.

None of these tests measure how long a crack takes, how much of a protected binary an assistant can recover, or how Fortifie compares with a free obfuscator.

Hardening benchmark

We have not published a head-to-head hardening benchmark on this page.

How to use this page

If you quote a number from Fortifie, quote it with the method and the limit from this page.