AES-128 vs DRM: what each one protects
AES-128 is a cipher; DRM is a system built around one. HLS AES-128 encryption scrambles the video, but to play it the viewer's player has to be given the key, so anyone who can watch the video can collect the key and rebuild the file. DRM encrypts in much the same way but delivers the key as a licence that only a trusted decoder in the device can open, so the key never appears in the page.
For free video, AES-128 with signed links can be enough. For anything people pay to see, it is not. This page explains how each works, what each stops and what it does not, and how to choose.
How HLS AES-128 works
HLS, the streaming format used by Safari, iPhones and, through a player library, every other browser, can encrypt each video segment with AES using a 128-bit key in CBC mode. This is the AES-128 method defined in the HLS specification, RFC 8216. The playlist names a key address. The player downloads the key from that address over HTTPS, then decrypts each segment as it plays.
Hosts protect the key address with a token or a session so that only the embedded player can ask for it, which stops casual hotlinking. But the key is delivered to the player as ordinary data, and anything the player can read, a script or a downloader acting as the player can read too. Rotating keys and short-lived tokens make a stolen key less useful; they do not change who is handed the key.
How DRM is different
DRM, meaning Widevine, PlayReady and FairPlay, also encrypts the video with AES underneath. What it changes is how the key travels. The player asks a licence server for a licence; the server checks the request and answers with a licence encrypted for the device's own decryption module. The browser hands it to that module through the Encrypted Media Extensions API, and the page's JavaScript never sees the key.
On devices with hardware DRM, decryption and decoding both happen inside secure hardware, which is why screen recordings come out black there. On software DRM (Widevine L3) the key is still hidden from the page but the decoded picture can be reached; Widevine L1 versus L3 explains the difference. DRM licences can also carry rules, such as an expiry or a requirement for hardware protection.
Side by side
| Threat or question | AES-128 HLS with signed links | DRM |
|---|---|---|
| Right-click save and direct file links | Stopped: there is no plain file to link to | Stopped |
| Link sharing and hotlinking | Stopped when the key address is protected by a token | Stopped: a copied link plays nothing without a licence the host authorises |
| Download extensions and stream rippers | Not stopped: they fetch the key the same way the player does | Stopped: there is no readable key to fetch |
| Key visible in the browser's network traffic | Yes, that is how the player gets it | No: the licence is encrypted for the device's decryption module |
| Screen recording | Not stopped | Black frames on devices with hardware DRM; recordable on software DRM |
| A phone camera pointed at the screen | Not stopped | Not stopped |
| Browser support | Every modern browser, no setup | Every mainstream browser through Widevine, PlayReady or FairPlay; in-app browsers with no DRM module cannot play it |
| Cost and setup | A key server and tokens: cheap | A licence service and multi-DRM packaging: often sold as an add-on or an enterprise feature |
| Right for | Free-to-watch video you do not want casually re-hosted | Paid courses, memberships, premium and licensed content |
When AES-128 is enough
If your videos are free to watch and the goal is to stop casual saving and other sites embedding them, signed links, a domain allow-list and AES-128 can be enough, and they are cheaper and work in every browser. If people pay for access, or you have licensed the content from someone else, the key problem decides it and you want DRM. The same split is covered, layer by layer, in how to stop people downloading your videos.
Is AES-256 better?
Not for this problem. AES-128 has no practical attack, so the cipher is not what breaks video protection; key delivery is. A 256-bit key sent to the player in the clear is exactly as available to a downloader as a 128-bit one. When a host advertises "AES-256 video encryption", ask where the key goes and who can read it.
What StreamVault does
StreamVault does not offer AES-128 as a middle tier. A video is either delivered as ordinary HLS behind signed playback links and your access rules (allowed domains, password, expiry dates), or it is protected with DRM. In the dashboard an unprotected project's videos are labelled as playing in the clear, and a protected one as encrypted with Widevine, PlayReady and FairPlay.
DRM is a project setting, switched on per project, and it is on every paid plan: upload once and the same encrypted files serve all three systems. See how Studio DRM works, what DRM costs across platforms and the DRM test, which shows which of the three your own browser supports.
Questions
Is AES-128 encryption the same as DRM?
No. AES-128 is a cipher. DRM is a system for deciding who gets the key and what they may do with it, and it uses ciphers such as AES underneath. With HLS AES-128 the player downloads the key from an address in the playlist and decrypts the segments itself, so anyone who can play the video can collect the key. With DRM the key travels inside a licence that only the device's decryption module can open, so it never appears in the page.
Can HLS AES-128 video be downloaded?
Yes, by anyone who can watch it. The player has to be given the key to play the video, and a download extension or stream ripper can request the same key the same way. Protecting the key address with a token stops other sites and shared links from getting it, but it does not stop a viewer who is allowed to watch.
Is AES-256 safer than AES-128 for video?
Not in a way that matters here. AES-128 has no practical attack, so the cipher is not the weak point; the weak point is that the player must be handed the key. A longer key changes nothing about who receives it. If a host advertises AES-256 video encryption as though it were DRM, ask where the key goes.
Does DRM use AES?
Yes. The common encryption schemes behind Widevine, PlayReady and FairPlay (cenc and cbcs) are built on AES. What DRM adds is key management: the key is requested through a licence server, delivered encrypted for one device, and used inside a protected decryption module, rather than handed to the page.
When is AES-128 with signed URLs enough?
When the videos are free to watch and the goal is to stop casual saving and other sites embedding them. Signed links, a domain allow-list and AES-128 are cheaper and work in every browser. When people pay for access, or you have licensed the content from someone else, use DRM.
Does StreamVault use AES-128?
No. StreamVault does not offer AES-128 as a middle tier. A video is either delivered as ordinary HLS behind signed playback links and your access rules, or it is protected with DRM (Widevine, PlayReady and FairPlay from one upload). DRM is a project setting you can turn on for the videos that need it.
Does DRM stop screen recording?
On devices with hardware DRM, yes: recordings come out black. On software DRM, which includes Chrome on a Mac and Firefox, the key is still hidden from the page but the decoded picture can be recorded. A phone camera works everywhere. Pair DRM with a viewer watermark so that anything that leaks can be traced.