Three things that are easy to confuse
Consumer security products bundle three separate ideas under one box or one web page, and most confusion about activation comes from treating them as one thing.
- The program is the software that runs on the device. It is the same installer for everyone; the maker does not ship a different program to each buyer.
- The subscription is a paid term of entitlement, usually one year for a stated number of devices. It exists only in the maker’s records.
- The key is the credential that links a purchase to a subscription record. It proves that a specific retail unit or order was paid for.
Activation is the moment the maker’s servers accept a key, attach a subscription to an account, and then let installed copies of the program confirm that they belong to that account. Once that has happened, the key has done its work.
What the string on the card is
Every maker prints a string of letters and digits and gives it a slightly different name. The shape of the string is a quick way to tell which product a card belongs to, because a retailer shelves several makers’ cards together.
| Maker | Name the maker uses | Shape | Where it is supplied |
|---|---|---|---|
| McAfee | Product key; also “activation code” | 25 characters | Printed on a Retail Card, or sent as an eCard by email after an online order |
| Norton | Product key | 25 characters in five groups of five, hyphenated: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX | On a card or sticker inside the box; in the order confirmation email; in the account after activation |
| Bitdefender | Activation code | 10 characters | Printed on a card inside the box; in the confirmation email under “Want to use your activation code instead?” |
| ESET | License key or activation key | XXXX-XXXX-XXXX-XXXX-XXXX or XXXX-XXXXXXXX | Inside or on the back of the package; in the registration email |
| TrendLife (Trend Micro) | Activation code | 20 characters in five groups of four | In the box or on the receipt; in the purchase email; in the account |
| Webroot | Keycode | 20 characters | On the instruction card in a retail box; in receipt and trial emails |
| Kaspersky | Activation code | 20 characters in four groups of five: XXXXX-XXXXX-XXXXX-XXXXX | On the box, in its documentation or on an activation card; none for online purchases of current plans |
| F-Secure | Subscription code | Four groups of five letters; older codes five groups of four | Retail boxes, receipts and some campaigns; none for store purchases |
| Sophos Home | License key | 20 characters plus three dashes, by Sophos’s description | In the purchase confirmation from the reseller Cleverbridge |
| Avast | Activation code | Not published; typed with its hyphens | Order email from avast.com; card in a retail box; retailer codes exchanged first |
| AVG | Activation code (“License Number” in older emails) | Not published; typed with its hyphens | Order email from no.reply@avg.com; card in a retail box |
| Malwarebytes | License key; older License ID | Not published | Subscription card in retail packaging; the account, for store purchases |
| Avira | License held by the account | No code for shop purchases | The shop forwards the buyer to the account; other codes are redeemed at avira.com/en/activation |
The names overlap. McAfee’s packaging says “activation code” while its redemption page says “product key”; ESET’s newer documentation says “activation key” where older versions said “License Key”. They describe the same string. What differs is the shape, and a 25-character McAfee or Norton key will not be accepted by Bitdefender’s 10-character field, or the other way round.
Redemption happens in an account on the maker’s own domain
None of the major makers activates a subscription on the device alone. The key is exchanged for a subscription record inside an account, and the account lives on the maker’s registered domain.
- McAfee redeems a Retail Card or eCard key at its activation page under mcafee.com. The key is tied to a McAfee account, can be redeemed once, and the installer is then obtained from the account’s My Account area.
- Norton requires a Norton account for a retail purchase; the key is entered at norton.com/setup or inside the program, and the subscription is recorded against the account. If the account already holds a valid subscription, the program can be attached to it without a new key.
- Bitdefender records subscriptions in Bitdefender Central at central.bitdefender.com. A purchase made on Bitdefender’s own store is activated automatically in the account used at checkout, and no code is issued at all; codes are issued for retail cards and third-party resellers and are added under My Subscriptions.
- ESET records subscriptions in ESET HOME at home.eset.com, where an activation key is added to the account. A subscription can be managed by only one ESET HOME account at a time; adding it elsewhere produces the message that it “is currently managed by another ESET HOME account”.
- TrendLife, the name Trend Micro’s consumer business has used since April 2026, activates a 20-character code at account.trendlife.com/setup/landing against a TrendLife account (formerly a Trend Micro account). Older material still shows account.trendmicro.com; the maker says the rename does not change existing subscriptions or sign-in details.
Because the record lives in the account, the same account is where a subscription’s end date, device count and renewal setting are shown. A message received elsewhere, by email or pop-up, is not the record; the account is.
Each maker has a page of its own, describing its key, its account and what it says about impostors: Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky, Malwarebytes, McAfee, Norton, Sophos Home, Trend Micro and Webroot.
What changes after the key is used
After redemption the key becomes largely dormant. Bitdefender states that its codes “only need to be activated once” and that, once the subscription is active, the code “is no longer needed in the (re)installation process”, because installations are managed from the account. Norton says a product key is needed only to set up or renew for the first time; afterwards the key is stored in the account. McAfee directs anyone who has already redeemed a key to the account rather than back to the key.
Two consequences follow. Reinstalling the program on a wiped computer, or adding a second device, is an account operation, not a new activation. And a second key from another retail unit does not simply top up a running term everywhere: Norton states that days remaining on the current subscription are not added when a new key is used, while Bitdefender offers an “Extend” option only when the new code matches the existing subscription and the combined length does not exceed five years.
Automatic renewal is often part of the activation screen
At several makers the activation flow doubles as enrollment in automatic renewal. Norton’s retail documentation describes a prompt for payment details in order to subscribe to the automatic renewal plan; TrendLife’s retail activation asks for card details for automatic renewal; McAfee’s terms state that a subscription renews annually, charged in advance of the term ending, until it is cancelled from the account, with an opt-in rule for Vermont residents.
This is why a genuine activation page may legitimately ask for a payment card. The distinguishing detail is where the request appears: on the maker’s own domain, inside the account, during a session the purchaser started. A demand for card details that arrives by telephone, or on a page reached from a pop-up or an emailed “invoice”, is a different thing entirely and is described on the verification page.
Preinstalled trials on new computers
New Windows computers frequently arrive with a security suite already installed under a time-limited entitlement rather than a purchased one. HP describes McAfee software as preinstalled on each new HP notebook or desktop with a 30-day trial; Acer’s 2023 agreement with McAfee placed a 30-day trial of McAfee LiveSafe on its consumer laptops and desktops; Dell has shipped McAfee software with either a 30-day or a one-year term depending on the country of purchase.
A trial follows the same model as a paid subscription: it is an entitlement held in an account, and continuing past the trial means a paid subscription recorded in that account. It does not require a different program. When the trial is left to lapse and the suite is removed, the operating system’s own scanner resumes, as described on the components page.
A vocabulary for the account screens
- Subscription — the paid term. Shown with an end date and a device allowance.
- Device or seat — one installation counted against the allowance. Removing a device in the account frees the seat.
- Auto-renew — the billing setting. Off means the subscription simply ends on its date.
- Order or receipt — the purchase record, distinct from the subscription it produced.