Widevine L1 vs L3: what the security levels mean
Widevine L1 decrypts and decodes protected video inside the device's secure hardware. Widevine L3 does the same work in ordinary software. L1 is what makes a screen recording come out black and what streaming services usually require for HD and 4K. L3 is what Chrome and Firefox use on a computer: it still blocks downloads, but it cannot hide the picture from a screen recorder.
Widevine is Google's DRM system, used by Chrome, Firefox, Edge, Android and many TVs and streaming sticks (Google's Widevine documentation). To see which level your own browser has, run the DRM test.
The three levels
The levels are defined by where two jobs happen: decrypting the video, and decoding it into the picture you see.
| Level | Decryption happens | Decoding happens | Typically found on |
|---|---|---|---|
| L1 | Inside the device's trusted execution environment (secure hardware) | Inside secure hardware, so the decoded picture never reaches ordinary memory | Android phones, TVs and streaming sticks with the hardware to support it; some Chromebooks |
| L2 | Inside secure hardware | Outside it, in ordinary memory | Rare in consumer devices |
| L3 | In software | In software | Chrome and Firefox on a computer; Android devices without the hardware support |
What the level changes in practice
Screen recording
At L1 the decoded frames stay on the secure hardware path, so a screen recorder captures black. At L3 the decoded picture passes through ordinary memory and a recorder can capture it. For anyone selling video this is the difference that matters most, and it is laid out device by device on the screen-recording page.
What each device records →Downloading
Both levels encrypt the stream and release the key only through a licence. For the everyday tools (download extensions, stream rippers, right-click save) there is nothing to grab at either level.
Resolution
Each service decides what an L3 device may watch, and many give HD and 4K to L1 devices and keep L3 lower. StreamVault's player applies a quality cap when DRM runs in software: 720p on Linux and 1080p on Mac and Windows. Because StreamVault encodes up to 1080p, in practice only Linux viewers see a lower picture.
Screen sharing and second screens
On a hardware path, anything that copies the screen receives black frames: Zoom, Teams or Meet screen sharing, AirPlay mirroring, many capture cards, and a monitor connection without HDCP. Software playback is usually allowed on mirrored and external displays.
How well the keys are guarded
L3 keeps its keys in software, which a determined and skilled person can attack with debugging tools in a way they cannot attack a hardware module. That is why studios hold premium resolutions back for L1, and why a viewer watermark is worth having alongside DRM: it makes whatever does leak traceable.
Which level does each browser and device get?
Not every protected video uses Widevine. Apple devices use FairPlay and Windows PCs can use PlayReady, so the useful question is whether the path is hardware or software, not only which level Widevine reports.
| Where it is watched | Protection used | Widevine level | A screen recording gets |
|---|---|---|---|
| Chrome on Android | Widevine | L1 on most phones | Black frames |
| Chrome on a Mac | Widevine | L3 | Can be recorded |
| Chrome on Windows 10 | Widevine | L3 | Can be recorded |
| Chrome on Windows 11 | PlayReady SL3000 where the PC supports it (Chrome 140+), otherwise Widevine | L3 on the Widevine fallback | Black frames on most PCs |
| Chrome on Linux | Widevine | L3 | Can be recorded |
| Firefox on a computer | Widevine | L3 | Can be recorded |
| Edge on Windows | PlayReady SL3000 | Not Widevine on this path | Black frames on supported PCs |
| Safari on a Mac; any browser on iPhone or iPad | FairPlay | Not Widevine | Black frames |
A phone camera pointed at the screen records fine on every row. No DRM level prevents that.
Why a phone can end up on L3
Widevine L1 depends on the phone's hardware and on its software being certified. A device without the hardware support, an emulator, an uncertified device, or a phone with an unlocked bootloader or a custom ROM can report L3 even though similar models report L1. If a protected video unexpectedly records, or plays at a lower quality on a phone, that is the first thing to check.
What this means for protecting your own videos
You cannot choose a viewer's level: the device and the browser decide. What you can choose is a host whose player asks for the strongest protection the device offers and falls back gracefully, plus controls that do not depend on the level.
StreamVault encrypts each protected video once, so the same files serve Widevine, PlayReady and FairPlay. The player starts with the strongest path the device has (FairPlay on Apple devices, hardware PlayReady on Windows PCs that support it, Widevine with hardware robustness on Android) and falls back to Widevine L3 where that is all there is. Protected video plays at every level. The level only decides whether a recording comes out black and, on software paths, the quality cap above.
The viewer watermark covers the gap: it shows the viewer's identity on a badge that moves around the picture, so a recording made on a software path points back to an account. The screen-capture deterrents are described, with their limits, on the features page. For the difference between encrypting a stream and licensing it, read AES-128 encryption versus DRM.
Questions
Is Widevine L1 better than L3?
For protection, yes. L1 keeps the keys and the decoded picture in secure hardware, so a screen recorder captures black; L3 does the same work in software. For compatibility L3 is the more widely available level, which is why every Widevine-capable browser and device can fall back to it. Neither level stops a phone camera.
Does Chrome have Widevine L1?
On a computer, no. Chrome and Firefox on Windows, Mac and Linux use L3, with some Chromebooks the exception. On Android, Chrome uses L1 where the phone supports it. On Windows 11, Chrome 140 and later can use hardware PlayReady (SL3000), the same path Edge uses, which gives hardware protection without Widevine L1.
Why is my Android phone on Widevine L3?
L1 depends on the phone's hardware and on its software being certified. A device without that hardware support, an emulator, an uncertified device, or a phone with an unlocked bootloader or a custom ROM can fall back to L3 even though similar models report L1.
What is Widevine L2?
The in-between level: decryption happens in secure hardware but decoding does not. It is uncommon in consumer devices, and because decoding happens outside the secure hardware a screen recorder can still capture the picture.
Can Widevine L3 video be downloaded?
Not with ordinary tools. The stream is encrypted and the key is released only through a licence, so download extensions, stream rippers and right-click save find nothing they can use. L3 is a software implementation, though, and a determined, skilled person can attack software in ways they cannot attack secure hardware, which is why studios keep premium resolutions for L1 and why a watermark is worth having.
Do I need Widevine L1 to protect course videos?
No. DRM at any level means there is no clean file to download or share, which stops most copying of paid content. A hardware path (Widevine L1, hardware PlayReady or FairPlay) adds black-frame protection against screen recorders on the devices that have it. Pair either with a viewer watermark so that anything that does get out can be traced.
Does StreamVault only play on L1 devices?
No. Protected video plays at every level. A viewer on Widevine L3 gets the same video over a software path, with the quality cap above where it applies. Apple devices use FairPlay and Windows PCs can use hardware PlayReady, so many viewers are on a hardware path without having Widevine L1 at all.