Additionally, it requires online activation. This allowed MS to both verify your key and obtain the product-type (Home, Professional, etc.) at the same time. Windows XP takes quite a bit of information, encrypts it, and puts the letter/number encoding on a sticker. The algorithm for verifying is public, and looks something like this: x = 3 Thus, you could enter anything for the first 12 digits, and guess the 13th (there's only 10 possibilities), leading to the infamous 1234-56789-1234

Starcraft and Half-life both used the same checksum, where the 13th digit verified the first 12. For old-school CD keys, it was just a matter of making up an algorithm for which CD keys (which could be any string) are easy to generate and easy to verify, but the ratio of valid-CD-keys to invalid-CD-keys is so small that randomly guessing CD keys is unlikely to get you a valid one.