Video encryption for online courses, explained simply

Video encryption scrambles your course videos so that only an authorised player with the right key can turn them back into pictures. It protects videos in three places: on the way to the student, in storage, and in downloaded files on the student's phone. It can't protect a video once it has been decrypted for viewing, so encryption alone doesn't stop screen recording, a phone camera or a shared login.

Tools that claim to get past DRM are sold openly, and they have reached phones too. From late 2022 until a September 2024 update, StreamFab's Android app offered downloads from Netflix and Amazon Prime Video. Its "DRM MPD Downloader" for Windows and Mac says it saves DRM-protected streams from any site as MP4 or MKV files "without requiring technical configuration", and its home page lists downloaders for Netflix, Prime Video, Disney+, JioHotstar and online-course marketplaces. KeepStreams advertises downloads from "3,000+ sites", up to 4K.

What video encryption does, in plain words

Think of an encrypted video as a locked box. Anyone can carry the box, and anyone who intercepts it sees only scrambled data. Only a player holding the key can open it and show the lecture.

The lock itself is rarely the problem. Video encryption today uses AES, a standard with no practical attack against it, and even 128-bit keys are far beyond guessing. What decides your real security is who gets the key, when, and on which device. Our guide to whether AES-128 is still secure explains why key handling matters more than key size.

That is why two platforms can both say "our videos are encrypted" and offer very different protection. The words describe the lock. They say nothing about where the keys are kept or who is handed one.

The three places encryption protects your videos

In transit

HTTPS encrypts the connection between your servers and the student's device, so nobody on the same network can read what passes. Every course site should use it. But it protects the journey, not the video: anyone who can fetch the file over HTTPS gets an ordinary file at the other end.

At rest

Storage services often encrypt files on their disks automatically. That protects against stolen drives, but the service decrypts files for anyone with a valid link, so it does little against course piracy. What matters is content encryption: the video itself is encrypted, segment by segment, before it is stored and delivered. A pirate who finds a direct link then gets scrambled data unless they also have the key.

On the device

Offline downloads should stay encrypted on the phone, play only inside your app, and stop working when access ends. A plain video file saved to storage can be sent anywhere in seconds. Our explainer on encryption at rest and in transit covers the first two layers in more depth.

Where the key lives decides how strong it is

Every encrypted video needs a key, and every player that shows it needs that key. So the real questions are about the key.

• Who can fetch it? If anyone with the link can download the key, encryption only slows a pirate down. Keys should go only to a signed-in student with access to that course, for a short time.
  
  
• Where does it go? In basic HLS encryption, the player fetches a key and decrypts in ordinary software, where a determined person can look for it. Our guide to HLS AES-128 encryption explains how that works.
  
  
• Is it protected on the device? DRM systems such as Widevine, FairPlay and PlayReady deliver keys inside licences that only a trusted part of the device can use. On many phones that trusted part is in hardware. In many desktop browsers it is software only, which is weaker.
  
  

This is the main difference between plain encryption and DRM: not the lock, but how carefully the key is handled. Our explainer on DRM versus encryption goes further.

Why encryption doesn't stop recording

To show a lecture, the player must decrypt it. Whatever the screen displays and the speakers play is, by then, ordinary pictures and sound. Security engineers call this gap the analogue hole, and no encryption can close it.

• Screen recording. On many phones, hardware-backed DRM makes recordings come out black, and Android apps can block captures of their own screens. iPhone apps can detect recording but have fewer ways to block it, and desktops vary widely.
  
  
• A second phone. A camera pointed at the screen never touches your app, so nothing on the device can see it.
  
  
• A shared login. Encryption checks that a player has the key, not that the right person is watching. Five friends on one login all get valid keys.
  
  
• Insiders. Editors and staff often handle the original files before they are encrypted.
  
  
• PDFs and notes. Video encryption doesn't touch them at all.
  
  

The law helps after the fact. Circumventing encryption to copy a course can be an offence under section 65A of the Copyright Act, 1957. This is general information, not legal advice.

Does encryption slow playback or cost more?

Decrypting video is light work for modern phones and laptops, so well-built encrypted playback shouldn't buffer more than unencrypted video. What can add a delay is fetching a key or licence before the first frame. Ask how quickly a lecture starts on a budget Android phone over mobile data, and test it yourself.

Live classes can be encrypted too, and the same key questions apply: who gets a key, for how long, and on which device. The extra costs come from licence services, if you use DRM, and from the engineering needed to deliver keys safely to every app and browser. For most institutes, that work sits with the platform rather than in-house.

What to check in your own setup

Ask your platform, or your developers, to confirm each point in writing:

1. Every video is encrypted, including every quality level and older uploads.
   
   
2. No direct, permanent links to video files exist in your app, website or APIs.
   
   
3. Keys go only to signed-in students with access to that course, and expire.
   
   
4. Old app versions that play unencrypted video are blocked from signing in.
   
   
5. Downloads stay encrypted, play only in your app, and stop when access ends.
   
   
6. Protection on desktops is as strong as on phones, or desktop quality is limited.
   
   
7. Original recordings are stored safely, and only named staff can download them.
   
   
8. PDFs and notes have their own protection.
   
   

If any answer is "we're not sure", treat that point as open. Pirates only need one.

What to add on top of encryption

Encryption is the foundation, but most coaching leaks happen after decryption. Think of a lecture filmed for a Telegram channel, or one login shared across a hostel floor. The layers that deal with those are:

• Watermarks that identify the student: visible to deter, and invisible to trace a leaked copy back to the account.
  
  
• Screen- and camera-recording detection, with recording blocked where the device allows it.
  
  
• Account-sharing limits on devices and streams at the same time.
  
  
• App protection against rooted phones, emulators and modified apps.
  
  

Our guide on protecting coaching videos from piracy shows how these layers fit together.

Upclass protects course videos with VidSafe proprietary encryption, in branded apps in your institute's own name on Android, iOS, Windows and Mac. VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. It also brings screen- and camera-recording detection, account-sharing prevention, PDF watermarking and RASP. Book a demo to see it with your own lectures.

Frequently asked questions

Is encrypted video safe from piracy?

It is safe from casual downloading, and from anyone who intercepts the stream or finds a file without the key. It isn't safe from screen recording on weaker devices, a phone filming the screen or a shared login, because those happen after decryption. Add watermarks and sharing limits to cover them.

What is the difference between video encryption and DRM?

Encryption scrambles the video. DRM is a system around encryption that controls who gets the key, on which device and under what rules, often keeping the key inside protected hardware. Plain encryption with a key any player can fetch is much easier to defeat, but neither stops a camera.

Does HTTPS encrypt my course videos?

Only on the way to the student. HTTPS stops others on the network from reading the stream, but anyone who can fetch the video over HTTPS gets an ordinary file. The video itself needs its own encryption, with keys issued only to authorised students.

Which encryption is used for video streaming?

Most streaming uses AES. HLS streams can be encrypted with AES-128, and DRM systems such as Widevine, FairPlay and PlayReady also use AES, often under the Common Encryption standard. The algorithm is rarely the weak point; key delivery and what happens after decryption are.