Piracy and DRM
A copy we never sold
Kai searches for Hyper Shards and finds a strange website: "Hyper Shards FULL GAME free download". Someone copied the game's files and posted them.
Piracy means copying and sharing a game, film or song without the owner's permission. It breaks copyright law (the Copyright and licenses lesson in Stage 5). Some pirates would have bought the game, though studios argue about how many. Pirate copies hurt players too: when Microsoft tested counterfeit copies of its own software, more than half carried malware. And confused players then ask us to fix a copy we never made.
True story: pirates who went bankrupt
On 28 April 2013, Greenheart Games, a studio of two people, released Game Dev Tycoon, a game about running a game studio, for US$7.99. Minutes after opening their store, they uploaded a pirated copy themselves. It was the same game, except that after a few hours, the player's studio in the game began losing money to piracy until it went bankrupt.
The game sent anonymous usage data, so they could count. One day after release, 214 players had the bought version and at least 3,104 had the pirated one: 93.6%.
Not every pirate would have paid. But for two people, that gap is real money.
Source: Greenheart Games: what happens when pirates play a game development simulator (2013), greenheartgames.com
What DRM is
DRM (digital rights management) is technology that checks a copy is licensed before or while it runs. It comes in strengths:
- A check at launch, through a store app, that the player owns the game.
- Online activation: the game contacts a server once to unlock.
- Always online: the game keeps checking, and stops if a check fails.
- Tamper protection: scrambled code, so the checks are harder to find.
Removing those checks is called cracking. Any check that runs on the player's device is code on the player's device, so someone skilled can remove it.
Quick check
Once a game uses DRM, nobody can ever make a working pirated copy of it.
- True
- False
Show the answer
False
DRM checks run on the player's own computer or phone, and skilled crackers remove them. DRM can slow piracy down and stop casual copying, but it never makes piracy impossible.
What the stores give us
- Steam's DRM wrapperSteam, the biggest PC store, can wrap a game so Steam starts first and checks the player owns it. Valve itself says the wrapper stops only "extremely casual piracy" and is "easily removed by a motivated attacker".
- Valve's adviceMake the real copy worth more: online play, achievements, leaderboards and trading cards don't work on cracked copies. Using the wrapper is the developer's choice.
- DRM-free storesGOG built its store around DRM-free games: buyers can play offline, make backups and install as often as they like.
- Google Play: Play Integrity APIGarden Defense asks Google: is this our unmodified app, installed from Google Play, on a genuine device? Our server sends the answer to Google's server to decrypt and check, so a cracked app can't just say "yes".
Stores already protect the games they sell, so small studios rarely build their own DRM.
Web games: the code is always visible
Hyper Shards is a web game, so every file it uses is downloaded to the player's browser. In DevTools, the Sources panel shows every script and the Network panel lists every download. Minified code is harder to read, not secret.
So we follow the rule from the Stopping cheaters lesson in Stage 4: never trust the client. Valuable things stay on the server. Worlds 2 to 5 are only sent after a Cloud Function (the Code on the server lesson) confirms a paid purchase for that player's account, and scores are checked there too.
Bolt says: Cloud Storage for Firebase has Security Rules as well, and they can read the player's purchase record in Firestore before allowing a download of a paid world.
Spot the crack
1async function startWorld(n) {2 if (n > 1 && localStorage.paid !== 'yes') {3 return showBuyScreen();4 }5 const res = await fetch(`/worlds/world${n}.json`);6 playWorld(await res.json());7}
A player types localStorage.paid = "yes" in DevTools and plays all five worlds free. What is the real fix?
- Minify worlds.js so nobody can read line 2
- Serve worlds 2 to 5 only after the server confirms a paid purchase for the signed-in account
- Rename paid to a secret word like zq7
Show the answer
Serve worlds 2 to 5 only after the server confirms a paid purchase for the signed-in account
Line 2 trusts a value the player controls, and line 5 fetches files anyone can download. Minifying and renaming slow a cheater down for a minute. The server is the one place the player can't edit.
When DRM hurts paying players
- Always onlineIf our server or the player's internet goes down, honest buyers can't play, even alone. Hyper Shards promises offline play as a PWA.
- Servers switched offIf a check server shuts down years later, a game that needs it may never start again.
- False alarmsValve's own docs note that antivirus programs sometimes flag wrapped game files, blocking a real buyer's game.
- Pirates get the smoother copyA cracked copy has its checks removed. Heavy DRM then only troubles the people who paid.
Heavy DRM has costs, and they land on the wrong people.
Beat piracy by being worth it
Many studios fight piracy mostly by making buying the easy, fair choice:
- A fair price, set against similar games (the Pricing our games lesson in Stage 6).
- Regional pricing: a fair local price in each country, in the local currency (the currencies lesson, also Stage 6).
- A free demo: World 1 of Hyper Shards is free, so nobody needs a pirated copy just to try it.
- Extras for buyers: cloud saves, leaderboards and updates come from our servers, which know who bought the game.
Player message
Hyper Shards looks amazing, but US$4.99 is a lot where I live. A site has it for free. Should I just grab that?
Which studio move does most to turn players like this into buyers?
- A fair local price in Brazilian reais, plus the free World 1 demo to try first
- An always-online check, so the free copy stops working offline
- A higher price everywhere, to make up for pirated copies
Show the answer
A fair local price in Brazilian reais, plus the free World 1 demo to try first
Regional pricing makes the real copy affordable, and the demo answers "is it worth it?" without a pirated copy. Always-online checks hurt honest players and get cracked anyway, and a higher price makes this player's problem worse.
Stolen copies: takedown notices
When our game appears on a website without permission, the usual tool is a DMCA takedown notice, under the US Digital Millennium Copyright Act (the Fan games lesson in Stage 5 has a famous example). It goes to the site's host. To keep its safe harbor, protection from being sued over what users upload, the host must quickly remove the copy.
The notice includes a statement made under penalty of perjury, so a parent sends it for the company. The uploader can reply with a counter-notice if they think it was a mistake. Other countries have similar systems.
Bolt says: Next: Steam, the biggest PC store, and what it would take to sell Hyper Shards there.
Fact-checked 11 October 2026
- Steamworks: DRM partner.steamgames.com
- Android: Play Integrity API overview developer.android.com
- GOG: our commitment to DRM-free gaming gog.com
- Microsoft: the hidden risks of pirated software learn.microsoft.com
- US Copyright Office: Section 512 copyright.gov
- Greenheart Games: what happens when pirates play a game development simulator (2013) greenheartgames.com