In this article
After reading, you'll understand:
- Why one DRM system always leaves part of your audience out
- How one packaged copy serves three licence systems
- What Widevine security levels do to your maximum resolution
- What to check before buying a multi-DRM solution
What is multi-DRM?
Multi-DRM is the practice of protecting one video library with several DRM systems at once so that every viewer can play it. The file is encrypted a single time; what changes per platform is which licence server issues the key.
The name misleads slightly. Multi-DRM is not three locks on the same door — it is one lock cut to fit three different keyholes, because Google, Apple and Microsoft each built their own.
Why one system is never enough
The limitation is not in your player. Browsers refuse DRM systems they do not implement, and that refusal happens below anything your application controls.
| System | Owner | Where it plays | Usual pairing |
|---|---|---|---|
| Widevine | Chrome, Edge, Firefox, Android, most smart TVs | DASH | |
| FairPlay | Apple | Safari, iOS, iPadOS, macOS, tvOS | HLS |
| PlayReady | Microsoft | Windows apps, Xbox, set-top boxes, some smart TVs | DASH / Smooth |
Widevine and FairPlay together reach the overwhelming majority of consumer devices. PlayReady matters for living-room and Windows-app delivery.
The practical consequence is blunt. Protect a course with Widevine alone and every student on an iPhone gets an error instead of a lesson — and they will not report it as a DRM problem, they will report it as "your site is broken", or simply ask for a refund.
How one copy serves three systems
During transcoding, each rendition is encrypted using Common Encryption (CENC). One encrypted copy carries key identifiers that all three systems can read, so you do not store the library three times.
The player asks the browser which DRM systems it supports and picks one — FairPlay on Safari, Widevine nearly everywhere else.
The request goes to the licence server for that system. Your entitlement rules — who, how many devices, for how long — are applied in one place regardless of which system asked.
The key is handed to the platform's protected module. It never reaches your JavaScript, which is what separates DRM from obfuscation.
Widevine levels and your maximum resolution
One detail surprises teams after they switch DRM on: the resolution a viewer receives can drop, and nothing in your settings caused it.
Widevine grades devices by where decryption happens. L1 does it inside the hardware's trusted execution environment; L3 does it in software. Content owners commonly require L1 before allowing 1080p or 4K, and cap L3 devices at 480p or 540p. The level belongs to the viewer's device — an old Android phone or a desktop Chrome without hardware support will be L3 no matter what you configure.
For paid courses and corporate video this rarely justifies a policy that punishes L3 viewers. Blocking them protects a file that was never studio-licensed, while a student on a three-year-old phone sees a blank player. Know the mechanism, then decide deliberately rather than inheriting a broadcaster's default.
What to check when buying multi-DRM
Vendors describe this market in near-identical language, so the differences are in the specifics:
"Multi-DRM" sometimes means Widevine plus an upsell. Ask which systems are on the plan you are quoted, not the platform's maximum.
Some vendors charge per licence request. On a course library with rewatching, that line grows faster than your storage bill.
Your backend should be able to authorise a licence request. If the only rules available are the vendor's presets, you cannot express "this student, this course, until their subscription lapses".
A clear message beats a spinning player. Ask what the viewer sees when their browser supports none of the systems on offer.
What multi-DRM does not solve
Multi-DRM widens coverage. It does not widen the threat model — the honest limits of DRM apply equally to one system or three.
| Threat | Covered? | What actually handles it |
|---|---|---|
| Downloading the file with an extension | Yes | Encryption — the copy is unplayable without a licence |
| Your embed re-hosted on another site | No | Domain restrictions, which live outside the encryption |
| Screen recording | Partly | Blocked where the OS allows; elsewhere a dynamic watermark makes it traceable |
| Capture card on the HDMI output | Partly | HDCP, negotiated on the display link |
| A phone filming the screen | No | Nothing prevents it — watermarking makes it attributable |
How Kinescope handles this
Widevine and FairPlay are included on every paid plan from €10/month and switch on per project — protected delivery costs the same as ordinary delivery, with no per-licence charge and no enterprise contract. PlayReady is not part of the set, which is worth knowing if you deliver to Xbox or Windows apps. Packaging, licence servers and key rotation are handled by the platform; your backend stays the authority on who may receive a key. See video access control for the rules engine.
Read the Kinescope docsFrequently asked questions
What is multi-DRM?
Multi-DRM is delivering one encrypted video library through more than one DRM system at the same time — in practice Widevine for Chrome, Edge, Firefox and Android, FairPlay for Safari, iOS and macOS, and PlayReady where Windows and living-room devices matter. The content is packaged once and each viewer's platform requests a licence from the system it supports.
Why can't I just use one DRM system?
Because the browsers enforce it. Safari will not play Widevine-protected content and Chrome will not play FairPlay-protected content — the restriction sits in the operating system, not in your player. A Widevine-only setup silently locks out every iPhone and Mac viewer.
What is a multi-DRM solution?
A service that runs the packaging and all the licence servers for you, so your application talks to one API instead of integrating with Google, Apple and Microsoft separately. The alternative is building it yourself: three vendor agreements, three licence integrations and ongoing maintenance as each system changes.
What is the difference between Widevine and FairPlay?
They are the same idea from different vendors. Widevine is Google's and covers Chrome, Edge, Firefox, Android and most smart TVs; FairPlay is Apple's and covers Safari, iOS, iPadOS, macOS and tvOS. Widevine is usually paired with DASH, FairPlay with HLS.
Does multi-DRM mean encrypting the video three times?
No. Common Encryption (CENC) lets a single encrypted copy carry key information that all three systems can read, so you store and transcode once. Only the licence exchange differs per platform.
What are Widevine security levels?
Widevine grades devices L1, L2 and L3 by where decryption happens. L1 keeps it inside the hardware's trusted environment and is normally required before a studio allows 1080p or 4K; L3 decrypts in software and is typically capped at 480p or 540p by policy. The level is a property of the viewer's device, not something you configure.
Do I need PlayReady?
Usually not. Widevine and FairPlay between them cover the overwhelming majority of phones, tablets, desktops and browsers. PlayReady earns its place when you deliver to Xbox, Windows apps or broadcast-style set-top boxes.
Further reading
- DRM — how the licence exchange works underneath.
- HDCP — the protection layer on the display cable.
- Watermarking — what covers the gap DRM leaves.
- What is anti-piracy? — where DRM sits among the other methods.
- Video access control — domain, token and session rules.
- Secure video hosting — how Kinescope implements it.
Read next
DRM
Encryption of the video file plus a licence server that issues a per-session key — so a downloaded copy stays unplayable.
Read →SecurityHDCP
Link-level encryption between a video source and the display over HDMI or DisplayPort — the layer that blocks a capture card…
Read →SecurityWatermarking
A mark burned into the frames. It prevents nothing — it makes a leaked copy point back at the account it came from.
Read →