Widevine DRM explained: how it works, L1 and L3, and its limits
Widevine is Google's DRM: it encrypts video and gives the key only to approved devices. How it works for a course seller, where it runs, what L1 and L3 mean, and what it can't stop.
On this page 8 sections
Widevine is Google's DRM system, built into Android, Chrome, Firefox, Edge and many smart TVs. It encrypts a video and hands the key, inside a licence, only to approved players on approved devices. Its strength depends on the device: L1 keeps keys and decrypted video in protected hardware, while software-only L3 was publicly broken in 2019. For a course seller, Widevine is a useful layer for Android and browser viewers, not a complete answer to piracy.
Tools that claim to get past DRM are sold openly, and they have reached phones too. From late 2022 until a September 2024 update, StreamFab's Android app offered downloads from Netflix and Amazon Prime Video. Its "DRM MPD Downloader" for Windows and Mac says it saves DRM-protected streams from any site as MP4 or MKV files "without requiring technical configuration", and its home page lists downloaders for Netflix, Prime Video, Disney+, JioHotstar and online-course marketplaces. KeepStreams advertises downloads from "3,000+ sites", up to 4K.
What Widevine is
Widevine is one of the three main DRM systems, alongside Apple's FairPlay and Microsoft's PlayReady. Google calls it its content protection system for premium media, and large streaming services rely on it. It follows open standards: the W3C's Encrypted Media Extensions for browsers, and Common Encryption for the video files.
Using it needs a licence agreement with Google, but Google's Widevine overview says it charges no fee for its products and services. The costs for a course business sit elsewhere: packaging videos, running or renting a licence service, building players and testing devices. Our explainer on how DRM works covers DRM in general; this article stays with Widevine and what it means for an institute.
How Widevine works, from a course seller's side
Here is what happens between a student pressing play and the lecture starting:
- Packaging. Each lecture is encrypted once, before it is published. The encrypted files can sit on any CDN, because they are useless without the key.
- A licence request. When a student presses play, the Widevine module on the device, called the content decryption module or CDM, creates a licence request. The player passes it to your servers.
- Your entitlement check. Google's overview notes that devices never contact the licence service directly. A proxy on the video service's side receives each request, validates it and adds its business rules. This is where "is this student enrolled, and is the batch still valid?" gets answered.
- The licence. The licence service returns the key, wrapped so that only that device's module can open it, together with the rules for using it.
- Playback. The module decrypts the video. On the strongest devices, the decrypted pictures stay inside protected hardware all the way to the screen.
Step 3 matters more than it looks. Widevine verifies the device, not the person. Suppose your check issues licences to any logged-in session, or keeps honouring expired enrolments. Widevine will then faithfully protect your videos for people who shouldn't have them.
Where Widevine runs, and where it doesn't
| Device or browser | Widevine? | What to know |
|---|---|---|
| Android phones and tablets | Yes, built in | The security level depends on the chipset and the maker; many phones support L1, some only L3 |
| Android TV, Chromecast and many smart TVs | Yes | Useful for students who watch on a big screen at home |
| Chrome, Firefox and Edge on Windows, Mac and Linux | Yes | Ordinary computers usually run the software level, L3; Edge on Windows also supports PlayReady |
| Safari on a Mac | No | Safari uses Apple's FairPlay |
| iPhone and iPad | Only through a separate library | Google lists a separate iOS client library; Safari and Apple's own media frameworks use FairPlay |
In practice, Widevine reaches your Android and browser viewers but not Apple's devices. If your students use iPhones or Macs, you will usually need FairPlay as well. Apple approves FairPlay production credentials only for organisations that provide a streaming service to consumers. Our explainer on multi-DRM covers serving all three systems from one library.
L1, L2 and L3 in brief
Widevine labels each device by how much of the work happens inside protected hardware. L1 handles keys, decryption and decoding inside a trusted execution environment, so neither apps nor the operating system see keys or decrypted frames. L2, which keeps only the cryptography in hardware, is rare. L3 does everything in software, guarded by obfuscated code on a device the user controls.
Two business consequences follow. The first is quality: because L3 is far easier to attack, streaming services often cap it at lower resolutions and keep HD for L1. The second is coverage: desktop browsers and some budget, older or modified phones sit at L3, so a rule that refuses L3 refuses real students. Our comparison of Widevine L1 vs L3 covers the levels in detail. It also explains why one phone can get HD in one app and SD in another.
What Widevine lets you control
A Widevine licence carries rules as well as a key. Which rules you use is a business decision, not a technical one:
- How long access lasts. A licence can carry an expiry, so a lecture stops playing when its rental period or a batch's validity ends.
- Offline viewing. A licence can be stored on the device, so a downloaded lecture plays without internet. After a set period, the app has to check in again.
- Renewal. Licences can be kept short and renewed during playback, so a cancelled enrolment takes effect sooner.
- Minimum security level. A service can require a hardware-backed level for higher qualities and give software-only devices a lower one.
- Output protection. A licence can require HDCP before video goes to an external screen over HDMI. That blocks ordinary capture devices, but it can also refuse older projectors and monitors in a classroom.
Every rule has a cost in support calls. Short licences and strict output rules stop more misuse, and they also bring more "video not playing" complaints from honest students. Set them per course, not once for everything.
What Widevine can't do
Widevine protects the path to the screen. It doesn't control what happens in front of the screen, and it doesn't know who is holding the phone:
- The analogue hole. A second phone filming a laptop records whatever plays, on L1 as much as on L3.
- Screen capture at L3. Without a protected display path, decrypted frames pass through ordinary memory, where screen recorders can often reach them.
- Shared logins. Five friends using one paid account all receive valid licences.
- Side doors. An unencrypted preview, an old app version or an original file left in open storage skips Widevine completely.
- Everything that isn't video. PDFs, notes and test papers get no protection from it.
Most of these routes don't break Widevine; they go around it. We go through each one in why DRM alone can't stop piracy.
Getting round Widevine to copy paid lectures is also a legal matter in India. Under section 65A of the Copyright Act, 1957, circumventing an effective technological measure to infringe copyright is an offence. It is punishable with up to two years' imprisonment and a fine. This is general information, not legal advice.
What it takes to use Widevine for a course business
Widevine is free, but a working setup has several parts, and each needs an owner:
- A licence service. Google offers a cloud licence service and a server SDK to Widevine licensees; many businesses rent the service through a video vendor instead.
- Packaging for every lecture, including old uploads, previews and every quality level.
- An entitlement check that confirms enrolment, validity and device rules before any licence is issued.
- Players that support Widevine in your Android app and on your website, plus FairPlay for Apple devices.
- Device testing on the phones your students actually use, including budget models and laptops shared with family.
- Support answers for licence errors, HDCP refusals and quality caps, so staff can reply in one message.
If a platform tells you it uses Widevine, these questions show how much that is worth:
- Which of our students' devices get L1, and what quality do L3 devices get?
- How does the licence check confirm enrolment, and how quickly does revoked access take effect?
- Is every quality level, preview and old upload encrypted?
- What protects lectures on iPhones and Macs?
- What happens when a student films the screen or shares a login, and can a leaked copy be traced to the account?
VidSafe protects lectures with VidSafe proprietary encryption, screen- and camera-recording detection, account-sharing prevention, PDF watermarking and RASP. It adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. See how it fits into our LMS for coaching institutes, with branded apps in your institute's own name on Android, iOS, Windows and Mac.
Frequently asked questions
Is Widevine DRM free?
Google says it charges no fee for Widevine's products and services, though you need a licence agreement with Google to use them. The costs come from everything around it: packaging videos, running or renting a licence service, building players and testing devices. If you rent a licence service from a vendor, its charges are separate from Widevine itself.
Does Widevine work on iPhone?
Not in the usual way. Safari and Apple's own media frameworks use Apple's FairPlay, and Google lists Widevine for iOS only as a separate client library. A course seller that wants DRM on iPhones, iPads and Macs normally adds FairPlay, which needs Apple's approval.
Can Widevine stop screen recording?
On devices with L1, screen recordings of protected video usually come out black. At L3, which most desktop browsers use, recorders can often capture the picture. No level can stop a second phone filming the screen, because that camera never touches the device playing the video.
Has Widevine been hacked?
Its software-only level, L3, was publicly broken by a security researcher in January 2019. The hardware-backed L1 level wasn't affected, which is why many services allow only lower qualities on L3 devices. Lecture piracy usually goes around Widevine rather than through it, using cameras, shared logins and unprotected files.
