Skip to main content
HLS Engineering

A Beginner's Guide to DRM in HLS: Widevine vs FairPlay

Implementing Digital Rights Management (DRM) in HTTP Live Streaming (HLS) can be highly complex, bridging cryptography, manifest parsing, browser APIs (Encrypted Media Extensions), and strict vendor specifications. This guide covers how Google Widevine and Apple FairPlay work within the HLS ecosystem, how to identify them in an M3U8 manifest, and common troubleshooting techniques.

Updated September 8, 2026 Maintained by M3U8 Free Player Online 10 minute read

Digital Rights Management (DRM) ensures that premium video content cannot be simply downloaded, decrypted, and pirated. Standard AES-128 encryption (often called clear-key encryption) protects the transport but places the decryption key directly in the manifest or at a freely accessible URL. True DRM systems, however, rely on the hardware or OS-level Secure Media Path (SMP) and require the client to prove they are authorized via a License Server before playback begins.

How DRM Works at a High Level

Regardless of whether you use Widevine, FairPlay, or PlayReady, the fundamental DRM workflow follows these core steps:

  1. Packaging: The raw video is compressed, fragmented into segments (typically fragmented MP4 for modern HLS), and encrypted using a Content Encryption Key (CEK).
  2. Manifest Delivery: The player downloads the M3U8 manifest. The manifest contains signaling tags (like #EXT-X-KEY or #EXT-X-SESSION-KEY) indicating the content is encrypted and specifying the required DRM system.
  3. Key Request: The player's Encrypted Media Extensions (EME) API generates a license request payload.
  4. License Server: The player sends this payload to a third-party DRM License Server (e.g., EZDRM, BuyDRM, Axinom). If authorized, the server returns the CEK securely wrapped.
  5. Decryption: The Content Decryption Module (CDM) built into the browser or OS decrypts the video frames directly in secure memory, outputting them to the screen.

Apple FairPlay Streaming (FPS)

Apple FairPlay is the native DRM system for the Apple ecosystem. It is the only DRM system supported by Safari on macOS and iOS, and it is deeply integrated into the AVFoundation framework.

How FairPlay is Signaled in M3U8

In HLS manifests, FairPlay is typically signaled using the #EXT-X-KEY tag with the METHOD=SAMPLE-AES and a specific KEYFORMAT.

#EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://license.server.com/content123",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1"

Notice the skd:// scheme (Secure Key Delivery) in the URI. When AVFoundation sees this, it intercepts the request and allows the application layer to fetch the actual license.

The FairPlay License Workflow

FairPlay has a unique handshake process compared to other DRM systems:

  • SPC (Server Playback Context): The Apple device generates an SPC payload based on the initialization data and an Application Certificate.
  • CKC (Content Key Context): The player sends the SPC to the License Server. The server responds with a CKC, which contains the decryption keys. The player passes the CKC back into the CDM for playback.

Important Restriction

FairPlay strictly requires you to host a FairPlay Application Certificate (.der or .cer file). Your web player must fetch this certificate before it can generate the SPC request.

Google Widevine

Widevine is Google's DRM system, predominantly used in Chrome, Firefox, Edge, Android, and many smart TVs (Android TV, Tizen, WebOS). Unlike FairPlay, which uses skd:// in the M3U8, Widevine relies on standardized signaling defined by Common Media Application Format (CMAF) and MPEG-DASH, though it has been adapted heavily for HLS via fragmented MP4s (fMP4).

How Widevine is Signaled in HLS

For Widevine in HLS, the manifest often includes an #EXT-X-SESSION-KEY tag in the master playlist or an #EXT-X-KEY tag in the media playlist with the Widevine System ID UUID: edef8ba9-79d6-4ace-a3c8-27dcd51d21ed.

#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="data:text/plain;base64,AAA...",KEYFORMAT="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"

Often, the initialization data (the PSSH box—Protection System Specific Header) is embedded directly within the init.mp4 segment (signaled by #EXT-X-MAP), rather than in the manifest itself.

Multi-DRM: Serving Both from One Manifest

Modern streaming architectures use CMAF (Common Media Application Format) to encrypt the video segments once using Common Encryption (CENC - AES-CTR or AES-CBC), and then serve multiple DRM headers alongside it. This allows a single set of video segments to be played on both Apple (FairPlay) and Google/Microsoft (Widevine/PlayReady) devices.

In a Multi-DRM HLS master playlist, you will often see multiple #EXT-X-SESSION-KEY tags:

#EXTM3U
#EXT-X-VERSION:7
# FairPlay Key
#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="skd://...",KEYFORMAT="com.apple.streamingkeydelivery"
# Widevine Key
#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="data:text/plain;...",KEYFORMAT="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
# PlayReady Key
#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="data:text/plain;...",KEYFORMAT="urn:uuid:9a04f079-9840-4286-ab92-e65be0885f95"

#EXT-X-STREAM-INF:BANDWIDTH=2000000,CODECS="avc1.64001f,mp4a.40.2"
media_720p.m3u8

The player's CDM will scan these tags and select the DRM system it natively supports.

Practical Troubleshooting for DRM Failures

DRM integration is notoriously brittle. If your video player spins infinitely or throws a generic error (like `MEDIA_ERR_DECODE` or `MEDIA_ERR_ENCRYPTED`), check these common pitfalls:

  • CORS on the License Server: The video segments might be hosted on your CDN, but the DRM license request goes to a third-party server (e.g., https://widevine-proxy.appspot.com). If that server does not return the correct Access-Control-Allow-Origin headers for your player's domain, the browser will block the license request.
  • Mixed Content (HTTP/HTTPS): EME (Encrypted Media Extensions) requires a secure context. You cannot request a DRM license on an http:// page. Both the page and the manifest must be served over HTTPS.
  • Missing App Certificate (FairPlay): If testing FairPlay in Safari, ensure your player configuration specifies a valid URL to fetch the Apple Application Certificate, and that the server returns the raw binary data (not a JSON-wrapped string).
  • Incorrect Key System UUIDs: If packaging manually, ensure you are using the correct UUIDs. A typo in the UUID will cause the browser to silently ignore the DRM tag.
  • Security Level Restrictions: Widevine has levels (L1, L2, L3). Hardware-based L1 is required for HD/4K playback on many platforms. If you attempt to play a 1080p stream on a device that only supports software-based L3, the CDM may refuse to decrypt the higher resolution variants.
When debugging DRM in a web player like video.js or shaka-player, always open the Chrome/Safari Network tab. Filter for XHR/Fetch requests. You should see a POST request going to your license server. If that request fails, check the HTTP status and response payload. If the request never fires, the manifest's signaling or the init segment's PSSH box is likely malformed.

Conclusion

Mastering DRM in HLS requires understanding the interplay between the manifest metadata (#EXT-X-KEY), the media container (fMP4 and PSSH boxes), and the browser's EME implementation. By leveraging Multi-DRM through CMAF, you can efficiently deliver secure content across all major platforms—using FairPlay for Apple devices and Widevine for the rest of the web.

Related Next Steps