What is Widevine DRM and How It Works?
To prevent unauthorized use and leakage of content, many online content services are applying a multi-DRM solution provided by professional DRM vendors. A multi-DRM solution basically has license management features for multiple DRMs such as PlayReady, Widevine and FairPlay to support major web browsers and mobile OS.
In this series, we will examine each of the DRMs and related elements of multi-DRM technology in the following order.
- Part 1: What is Microsoft PlayReady DRM & How Does it Work?
- Part 2: Google Widevine DRM (this article)
- Part 3: What is Apple FairPlay DRM & How Does it Work?
- Part 4: All about DRM packaging & CPIX/SPEKE API
- Part 5: How to play DRM content & all about Multi-DRM client standards
What is Widevine DRM?
Widevine DRM is Google’s content protection system for premium media. Widevine is used by major content services around the world, including Google Play, YouTube, Netflix, Hulu, Amazon, and more.
Widevine is embedded in web browsers such as Chrome and Firefox, and devices with Android OS and other various OTT devices.
History of Widevine
Widevine DRM was developed by Widevine Technologies to replace smartcard-based content security technologies. Since Google acquired Widevine Technologies in 2010, Widevine has been built into Google’s various platforms, including Chrome, Android Mobile and Android TV.
Widevine versions
Widevine Classic (v1~v6):
Widevine Classic was supported by older version of Android (3.1 ~ 5.1) and older smart TVs. It is no longer available for new services or devices because Google has stopped support. Widevine Classic uses the .WVM file format, which is a proprietary packaging format.
Widevine Modular:
It is the current Widevine DRM, which is developed with new specifications and features. Widevine Modular supports adaptive streaming formats such as DASH/HLS as well as HTML5 standards (EME/MSE). The term ‘Widevine’ is now commonly used to refer to the Widevine Modular version.
Widevine Modular manages individual versions of each component instead of the version of DRM itself.
Widevine DRM Security Levels: L1, L2, L3
Google Widevine DRM defines three security tiers:
- L1: Full security. All decryption and content handling happen within a Trusted Execution Environment (TEE)—protected by hardware. This level enables full HD and UHD playback.
- L2: Moderate security. Cryptographic operations occur in a secure environment, but video processing may happen outside TEE. Typically supports up to SD or HD.
- L3: Lowest security. Both crypto and video decoding are handled in software. Devices with L3 are generally limited to SD streaming.
Components of Widevine DRM & How They Work
The Widevine DRM ecosystem consists of Widevine cloud licensing services, licensed proxy servers, and client devices supporting Widevine.
Widevine Cloud Licensing Service is operated directly by Google, and it generates and delivers DRM licenses upon request from a license proxy server in a content service or DRM solution. Access to cloud licensing services is only allowed through organization-specific credentials.
The license proxy server handles user authentication and authorization for DRM license requests from client devices and delivers licenses issued from the Widevine cloud licensing service to clients.
Client devices include Android mobile, TV, set-top box, Chrome, and Firefox browser. To manufacture Widevine client devices, a separate contract with Widevine is needed to get the key box and CDM module and test the integration.
In order to establish a license proxy server and provide Widevine licenses for content services, 3rd party solution providers must complete and qualify for Widevine’s Certified Widevine Implementation Partner (CWIP) program. DoveRunner is an official Widevine partner with CWIP qualification.
How Do The Widevine DRM Components Flow Together As A Platform?
Widevine DRM works end-to-end, securing content from the moment it’s encoded and encrypted. It works end to end:
1. Content Preparation:
Videos are packaged into multiple bitrates using DASH and encrypted using CENC.
2. Client-Side DRM:
The Widevine CDM (Content Decryption Module) in the device communicates with the Widevine license server to request decryption keys.
3. Streaming:
DASH streams are delivered adaptively. The player switches quality based on the network, requesting license keys as needed.
4. Decryption & Playback:
The CDM decrypts the stream in a trusted area (L1/L2) or in software (L3), ensuring security and smooth playback.
What Devices Support Google Widevine DRM Compatibility?
Google Widevine DRM is widely supported across platforms:
Smartphones & Tablets:
Android and iOS devices (with Widevine support in browsers such as Chrome).
Smart TVs & Streaming Devices:
Android TV, Chromecast, Fire TV, Apple TV, consoles like PlayStation/Xbox, Blu-ray players, and more.
Compatibility depends on device certification level (L1, L2, L3), which determines the maximum playback quality.
Features & Benefits of Widevine DRM
Content protection
Widevine DRM supports a wide range of client devices and works synergistically with multiple content protection systems, such as multi-DRM.
Video playback support
Widevine comes with an HTML5 player that supports adaptive streaming, QoS, and accessibility features across a variety of devices. Shaka Player, an open-source web player developed by Google, supports DASH and HLS streaming and can play multi-DRM content in most web browsers and mobile devices.
Standardized format
With the support for industry-recognized media containers such as ISO BMFF (MP4) and WebM, single-encrypted content can be played anywhere.
Device security
Content services can utilize powerful device security by applying hardware-based root of trust, decryption, and content rendering with factory-provisioned key boxes.
Widevine DRM applied to Android or OTT devices can support hardware-based content security (Widevine L1) depending on the model. However, PC browsers such as Chrome and Firefox support a software-based (Widevine L3) DRM, which is vulnerable to screen recording. (Learn more)
Related Article – How Google’s Widevine DRM Prevents HD, Ultra-HD Video Leakage to Piracy Market
How does Dynamic Adaptive Streaming Work in Widevine DRM?
Widevine uses Dynamic Adaptive Streaming over HTTP (DASH) to deliver smooth playback:
- The video content is available in multiple quality levels. As the user’s network speed fluctuates, the player dynamically switches between bitrates.
- Encrypted video segments are downloaded and then decrypted just-in-time via the Widevine CDM, ensuring both security and seamless playback.
What are the Components for Android in Widevine DRM?
On Android, Google Widevine DRM includes:
Widevine CDM:
Integrated with Android’s MediaDRM framework.
Widevine License Server:
Issues content decryption keys to the reported CDM instance.
Adaptive Packager:
Tools such as the Shaka Packager prepare encrypted DASH streams.
These parts work together to securely deliver encrypted content and manage license workflows.
Use Cases
When issuing a DRM license to a Widevine client, the Widevine license server can set the following rules for the duration of content playback.
License Duration:
The validity period of the license. It is about ‘How long you can play content with the license’ (play time). Common rule for all of the below scenarios.
Playback Duration:
The period of time that the license is valid since the initial playback of the content (when the license was first used). Only used in an offline scenario or license renewal scenario.
Rental Duration:
The period of time that the license is valid before the initial playback of the content. Used only in offline scenarios.
These licensing settings allow service providers to implement a variety of scenarios, including:
Basic Streaming Scenario
In streaming scenarios, the playback device is always considered to be connected to the internet, and you can set the ‘License Duration’ to limit the duration of playback.
(E.g. License Duration 180 minutes-> 3 hours of content to play)
License renewal scenario
To support live (linear) content or simultaneous playback limits, you can periodically renew your license through the License Renewal feature while playing content in streaming. If you set the total playable duration to ‘Playback Duration’ and set the ‘Renewal Delay’ value to a shorter period, the license renewal is performed at that interval.
(E.g. Playback Duration 180 minutes, Renewal Delay 15 minutes-> Reissue license every 15 minutes, up to 3 hours of content playback)
Offline (Rental) Scenario
For offline playback of downloaded content, the ‘Rental Duration’ and ‘Playback Duration’ settings allow you to specify ‘How long you can keep the downloaded content’ and ‘How long you can play the content’ separately.
(E.g. Rental Duration 30 days, Playback Duration 3 hours-> watch within 30 days after download, up to 3 hours after playback starts)
Supported Platforms and Content Formats
Widevine DRM supports the following platforms and content formats:
PC platform
- Windows 7.0 or later: Chrome, FireFox, Edge (Chromium based)
- Mac OS 10.0 or later: Chrome, FireFox, Edge (Chromium based)
Mobile platform
- Android 4.4 or later: using Android native app
- Android 5.0 or later: using Chrome mobile browser
- iOS 9.0 or later: using Widevine iOS CDM
OTT platform
- Android TV: OS 4.4 or later
- Amazon Fire TV: OS 5.0 or later
- Samsung Smart TV: Tizen OS 3.0 or later
- LG Smart TV: webOS 3.0 or later
- Chromecast, Roku
Content format
- Streaming formats: MPEG-DASH, HLS, CMAF
- Video formats: MPEG-TS, fMP4, WebM container
- Video codecs: AVC (H.264), HEVC (H.265), VP8, VP9
- Audio codecs: AAC, AC3, Opus, Vorbis
Related Article – DRM for All Screen Types? Not So Straight Forward
How does Widevine CDM Deliver the Best User Experience?
Widevine CDM is built to offer a seamless, secure streaming experience without extra downloads or interruptions. Here’s how it enhances playback quality and user convenience:
No plugins are necessary because of Native Widevine CDM
Widevine DRM is built into Android, Chrome, and other compatible platforms—so users get secure playback without installing plugins or extensions.
Highest Quality Adaptive Streaming with DASH
Users get smooth video that adapts to network changes, without interrupting playback—even while switching between quality levels based on real-time bandwidth.
What Is Encrypted Streaming and How Does a DRM License Support It?
Encrypted streaming secures video from encoding through playback—using DRM licenses to control access:
Video Encoding at Multiple Bitrates
Videos are compressed at multiple resolutions (e.g., 360p, 720p, 1080p) to support adaptive streaming.
Each Video File Is Encrypted with CENC
Common Encryption (CENC) standards allow multiple DRM systems to work with the same encrypted content format.
Introducing DoveRunner Multi-DRM
DoveRunner is a cloud-based SaaS (Solution as a Service). It provides integrated licensing management of PlayReady, Widevine, and FairPlay DRM, which are essential elements of multi-DRM technology.
Frequently Asked Questions on Google Widevine DRM
What is Widevine DRM, and how does it protect digital content?
Google Widevine DRM is a digital rights management system that encrypts video content and controls how it’s accessed and played across devices. It ensures that only authorized users and approved devices can decrypt and view the content, preventing piracy, unauthorized sharing, and tampering.
Which streaming platforms use Widevine DRM for content protection?
Major platforms that rely on Widevine DRM include:
- Netflix
- Amazon Prime Video
- Disney+
- HBO Max
- YouTube
- VdoCipher
- Google TV / Android TV apps
These platforms use Widevine to stream content securely across a wide range of devices and operating systems.
What are the different security levels in Widevine DRM?
Widevine supports three security levels:
- L1: All content processing and decryption happen in a secure hardware environment (TEE). Required for HD/UHD playback.
- L2: Keys are processed securely, but video may be handled in software. Usually supports up to HD.
- L3: All operations occur in software without hardware protection. Limited to SD quality due to lower security.
Can Widevine DRM be used for offline video playback?
Yes. Widevine DRM supports offline playback by issuing time-bound, device-specific licenses that allow content to be downloaded and decrypted later—even without an internet connection. This is common in mobile apps for platforms like Netflix and Amazon Prime Video.
How does Widevine DRM affect device compatibility and streaming quality?
Device compatibility depends on the Widevine security level supported by the hardware:
- Devices with L1 certification can stream in HD or 4K.
- Devices with L2 or L3 may be limited to SD or lower resolutions.
This ensures that higher-quality content is only delivered to devices capable of securely handling it—balancing protection and playback quality.
