Multi-DRM explained: Widevine, FairPlay, and PlayReady

Multi-DRM is the practice of protecting a single video with more than one digital rights management system, so it plays encrypted on every device your viewers use. It exists because no single DRM reaches everyone: Google's Widevine is absent from Safari and iOS, Apple's FairPlay works only inside Apple's ecosystem, and Microsoft's PlayReady owns Smart TVs, consoles, and native Windows apps. That's why a single DRM is rarely the right choice on its own: whichever one you pick, the devices outside its reach either can't play the video or fall back to an unprotected stream.

For a paid course or a members-area video, that slice is lost revenue or an open door. This guide covers how the three systems divide the device map, what Widevine's levels mean for playback quality, and where the line between needing all three and needing only two falls.

Key takeaways

• No single DRM covers every device. Widevine covers browsers and Android, FairPlay owns Apple, and PlayReady reaches Smart TVs, Xbox, and native Windows apps.
• The video is packaged once with Common Encryption; each device just fetches its key from the system it supports. You don't encode three times.
• Widevine plus FairPlay reaches close to 99% of browser and mobile viewers, where embedded course and membership players run. PlayReady mainly adds TVs, Xbox, and native Windows apps.
• The device's security level decides its maximum quality: hardware-backed levels unlock HD and 4K, software-only levels are usually held to SD.

Why one DRM can't reach every viewer

Each DRM is tied to the platforms its owner controls, so what the viewer opens the video in decides which system applies, and what quality they can get:

Apple is the hard constraint: it does not allow Widevine or PlayReady in the <video> element, so any protected video on iPhone, iPad, or Safari has to use FairPlay. A Widevine-only setup means every Apple viewer either can't play the video or falls back to an unencrypted stream.

That's the whole case for multi-DRM: cover the browser and mobile world with Widevine and FairPlay, and the TVs, consoles, and native Windows apps beyond them with PlayReady. Packaged onto the same video, they let each device load the one system it can use, with nothing for the viewer to pick.

Widevine: Google's DRM, with the security levels that decide quality

Widevine is the most widely deployed DRM by device count. It protects Chrome, Firefox, and Edge on the desktop, every Android device with Google services, Android TV, Chromecast, and most non-Apple Smart TVs. For an audience on browsers and Android, Widevine alone reaches the large majority, which is why teams usually set it up first.

Widevine has three security levels, and they decide where decryption happens and, through licensing policy, what resolution a device is allowed to play.

A Trusted Execution Environment (TEE) is a locked-off part of the chip, separate from the main operating system; most current smartphones and recent Smart TVs have one.

On an L1 device, the keys and the decrypted frames stay inside that enclave, which the operating system can't read, and the video runs a protected path to the display. That hardware path is what the major streaming services and the studios licensing to them require before they serve HD or 4K.

L3 has no such enclave, so protection runs in hardened software that ends up in normal memory, and content owners commonly hold L3 playback to SD. We see the other side of this in support: a customer reports that one or two students can't get HD, and the cause is almost always an old or low-end device that only certifies for L3, the licensing policy doing its job.

This level split has a direct security consequence. On hardware-backed playback, screen recorders like OBS or the built-in OS capture return a black frame, because the decrypted video never reaches readable memory. On L3 software playback, screen capture can still work, which is another reason holding L3 to SD is standard practice.

FairPlay: the only way into Safari and iOS

FairPlay Streaming is Apple's DRM, and its whole importance is exclusivity: it is the only DRM that works in Safari on macOS, and it is required for any protected playback on iOS, iPadOS, and tvOS. It's tied to Apple's HLS delivery and to hardware-backed key handling on Apple silicon.

Mechanically it's a short handshake: the player sends a Server Playback Context (SPC) to your license server, which returns a Content Key Context (CKC). The friction is rarely technical; the slow part is Apple's certificate-issuance process, which routes through the Apple developer programme and is often the slowest step when you add FairPlay to a multi-DRM setup.

Without FairPlay, you can't protect video on Apple devices at all. Given how much of a course audience watches on an iPhone, that makes it non-negotiable for a consumer market.

PlayReady: Windows, Xbox, and Smart TVs

PlayReady is a DRM system built by Microsoft. It's most associated with Smart TVs, but it runs on billions of devices: Windows and native Windows apps, Xbox, smart TVs including Samsung Tizen and LG webOS, set-top boxes, and mobile platforms. Like Widevine, it splits into a software tier (SL2000) and a hardware tier (SL3000), with SL3000 gating premium 4K the way Widevine L1 does. It also carries the richest licensing-rules model of the three: expiration dates, rental windows, and play-count limits are first-class features, which is why operators handling rentals and time-limited access lean on it.

For a video embedded in a web page or a mobile app, such as a course inside an LMS or a members-area lesson, you rarely need PlayReady. On Windows desktop browsers, Chrome, Firefox, and Edge all use Widevine, and Safari and iOS use FairPlay, so those two already cover where an embedded player runs. PlayReady matters when your distribution is a native Smart-TV or Xbox app, a Windows/UWP application, or when you need its rental-and-expiry licensing controls. Outside those cases, PlayReady is a cost and an integration you can skip without losing meaningful reach.

What "multi-DRM" means in practice

Multi-DRM sounds like it should mean encoding the video three times, but it doesn't. Modern DRM shares one encryption layer, Common Encryption (CENC), so you package the video once and all three systems decrypt the same file. Storing and delivering one set rather than three also keeps storage and CDN costs flat as you add DRM systems.

What differs per system is the license: each device type talks to its own license server (Widevine's, Apple's, Microsoft's) to fetch the key it's allowed to use. So multi-DRM in practice means one encrypted master, three license paths, and a packager that writes the headers each system looks for.

There's a second layer worth knowing, because it's how the quality-by-device rule is enforced. Multi-key packaging encrypts the SD renditions with one key and the HD or 4K renditions with another. The license server releases the high-resolution key only to hardware-backed devices (Widevine L1, PlayReady SL3000, FairPlay hardware). So a compromised L3 laptop can decrypt the SD stream but never receives the 4K key at all. The quality ceiling comes from which key the device is trusted to hold, so no player setting can override it.

How to get multi-DRM: three routes

There are three ways to get multi-DRM, and the right one depends on scale.

• Build it in-house. Each system has a client porting kit and a server SDK, so the packaging is the easy part. The ongoing cost is the part that's easy to underestimate: operating license servers, provisioning keys securely, binding them to devices, and tracking vendor changes that can silently break playback (Samsung's PlayReady migrations are the classic example). It's justified in one case: a large streaming operation with its own infrastructure and engineers who already own the encoding pipeline.
• Hire a DRM vendor. Specialist providers such as DoveRunner, BuyDRM, and castLabs sell multi-DRM license delivery as a service, so you don't run the license servers yourself. You still wire up the packaging and player and pay per license or stream, so this fits teams that own their pipeline but want the DRM layer handled.
• Use a platform with DRM built in. Hosting that already includes DRM turns the whole question into a toggle: you upload, switch protection on, and the packaging, license servers, and player are handled. For a course platform, a membership site, or a business protecting training video, this is usually the right trade, because the license-server plumbing is undifferentiated work. DRM is also one layer of a wider anti-piracy approach — encryption, signed links, and traceability work together, and running each in-house multiplies the maintenance.

Whichever route you pick, remember what DRM does and doesn't do. It's a studio-grade barrier against download-and-redistribute piracy, and on hardware-backed devices it blocks screen capture too. What it can't stop is the analog hole — someone pointing a phone camera at the screen. No DRM level closes that, and DRM gives you no way to tell who leaked a stream. That's the job of forensic watermarking, which embeds a per-viewer identifier so a leaked copy traces back to one account. Mature setups run both: DRM raises the cost of stealing, watermarking names whoever gets through.

How Kinescope handles multi-DRM

Kinescope has Widevine and FairPlay built in — the two that cover browsers and mobile, where embedded course and membership players run. DRM is a per-project toggle: switch it on, and every upload to that project is encrypted.

Each playback fetches a per-session license key, so SaveFrom or VLC get ciphertext, and on iOS, Android, Safari, and Edge, screen recording is blocked at the OS level. Protected playback works inside Moodle, Canvas, Teachable, Thinkific, and any LMS that takes an embed, with no plugin for you or your students. For the analog-hole gap, dynamic per-viewer watermarks tie any screen recording back to the individual account.

On pricing, DRM is included in the first paid plan, Super, from €10/month billed by actual usage, with the white-label player, analytics, and full API, and no enterprise contract to sign. Cost tracks your real traffic rather than a fixed licensing fee. The free plan (100 minutes of storage, 200 GB of monthly traffic) lets you test protected playback first. See how Kinescope's DRM and watermarking fit together.