Widevine DRM protects premium video content across Android devices and supported browsers. Learn how Widevine works, understand L1, L2, and L3 security levels, and secure OTT streaming with Muvi One.
Widevine is Google’s digital rights management (DRM) system. It is built into Android, Chrome, Firefox and Android TV and Google TV devices. It encrypts video, and it releases the decryption key only to devices that meet a defined security level.
If you stream licensed video to Android phones, Chromium-based browsers or Android-based TVs, Widevine is the DRM those devices expect. When it is set up wrongly, viewers see black screens, capped resolution or license errors.
This guide explains what Widevine is, what its L1, L2 and L3 security levels mean, how the components fit together, how a license request works, and what an OTT team needs to put it into production.
DRM lets you deliver encrypted video openly while ensuring only authorized devices can decrypt and play it. Widevine works in three steps: the video is encrypted before delivery, a license server issues decryption keys on request, and the device decrypts and renders the video inside a protected environment.
Widevine began as Widevine Technologies, a content-security company, and was acquired by Google in 2010. Google has since built it into Android, Chrome and Android TV.
Widevine Modular is the current version. It works with MPEG-DASH and HLS streaming and with the HTML5 Encrypted Media Extensions (EME) standard. Widevine Classic is a legacy version that required content packaged in Widevine’s proprietary .wvm format. It ran on older Android versions and older TVs and is not used for new services.
Have you observed L1 certification on some of the latest Android phones in the market? Widevine DRM has 3 security levels that define what resolution of licensed content a device is capable of streaming over the internet.
Before we go into various categories of Widevine DRMs, it is important to understand TEE or a Trusted Environment Execution. It is an important security layer of the primary processor that ensures the data is governed by the defined standards of the broadcaster agreements. A very important component in the Widevine DRM structure, it protects the encrypted content by securing the decryption keys.
All top Android devices including phones and smart TVs come with L1 certification that assures the device is capable of playing HD content. All forms of rendering, be it decrypting the video content and decoding other information are carried out within the TEE layer before being allowed to stream on the device. This ensures screen recording does not work and that is why L1 is the most preferred Widevine certification and is mandated by platforms like Netflix and Prime Video for HD playback of its content.
It is a special hardware-based encryption technique that makes it extremely challenging for hackers to get access to the decrypted content on Android devices.
L2 does not apply to mobile devices and content decryption and rendering are carried out by security hardware within the TEE.
Widewine L3 certification implies that there is only software-based decryption. There is no TEE present that decrypts and stores security keys but it is stored in lower environments in a software-based CDM. This lack of security on low-end devices means they cannot stream HD or higher content and most big streaming platforms blog HD playback for the same.
Additionally, there are two important versions of Widevine DRM that you should know.
It is an older version of Widevine that requires content to be strictly in .wmv formats and is deployed on old Android phones and smart TV devices.
This is the current version of Widevine deployed on all the latest Chromium-based browsers, Android-based phones, smart TVs, etc. With support for multiple protocols, it is in accordance with HTML5 standards and has the capability to run encrypted streams via multiple streaming protocols.
Widevine L1 | Widevine L3 |
It is a hardware-based decryption model offering robust security to the content | It is a software-based decryption model and offers basic encryption only |
Streams content in HD and higher resolutions | Does not stream content in HD or higher resolutions |
Preferred by OTT platform providers, it comes as a standard on all high-end devices | Due to its limited content protection capability, L3 is available in medium to lower end devices only
|
After the security levels or DRM certifications comes the next question is: how does Widevine DRM work? It is a complex solution to a very complex problem. It has various components that work together to stream secured content on Widevine-enabled devices. Here is a brief description of Widevine DRM’s components.
All the components mentioned in the previous section are responsible for the secured streaming of the content on Widevine-enabled devices. The process is fairly simple to understand. Itgoes like this.
Step 1: Encrypt and package. Before delivery, the content is encrypted (typically with CENC) and packaged as DASH or HLS, with metadata identifying the key.
Step 2: Playback request. The viewer presses play. The player loads the manifest, detects that the content is encrypted and asks the browser or operating system (through EME on the web) to start a Widevine session with the CDM.
Step 3: License request. The CDM generates a license request and hands it to the player, which sends it to the license server.
Step 4: License issued. The license server, through its proxy, authenticates the request, checks the viewer’s entitlement and returns a license containing the keys and usage rules. The license is protected for that CDM, so the player cannot read the keys.
Step 5: Decrypt and render. The player passes the license to the CDM. The CDM decrypts the segments through the platform’s secure path, OEMCrypto, inside the TEE on L1 devices, and playback runs at the resolution allowed by the license and the device’s security level.
Widevine-supported devices and browsers
Not supported natively: Safari and Apple devices (iOS, iPadOS, tvOS) use FairPlay. Services that need Apple coverage add FairPlay alongside Widevine, an approach called multi-DRM.
Advantages of Widevine DRM
Limitations to plan for
Widevine DRM is a critical part of secure video streaming, especially for OTT platforms targeting Android devices, Android TV, Google TV, and Chromium-based browsers. By combining encryption, secure key management, device-level security, and license controls, Widevine helps streaming businesses protect premium content while delivering it across a wide range of devices.
With Muvi One, you can simplify the implementation of DRM-protected streaming without building the entire infrastructure from scratch. Muvi One supports DRM-enabled content delivery and provides the tools needed to launch and manage a secure OTT platform across web, mobile, and TV platforms. For businesses looking to protect licensed content while delivering a seamless viewing experience, Muvi One brings content management, monetization, multi-platform distribution, and security together in one platform. Get a free 14-day trial to learn more.
Widevine DRM is Google’s digital rights management system that protects premium video content from unauthorized access and playback. It uses encryption, licenses, and device-level security to ensure that only authorized devices can decrypt and play protected content.
Widevine encrypts video content before delivery and uses a license server to provide authorized devices with the keys needed for decryption. The device’s Content Decryption Module (CDM) processes the license and decrypts the content through the device’s supported security environment.
Widevine L1, L2, and L3 are security levels that determine how securely content decryption is handled on a device. L1 provides the strongest hardware-backed protection, while L3 relies primarily on software-based security. L2 is an intermediate level found in some device implementations.
Widevine L1 uses hardware-backed security and a Trusted Execution Environment (TEE) to protect keys and decrypted content, while L3 uses software-based decryption. Because L1 provides stronger protection, streaming services can typically allow higher-quality playback on L1-certified devices.
Widevine is widely supported on Android phones and tablets, Android TV, Google TV, Chromecast with Google TV, and major desktop browsers such as Chrome and Firefox. Support and available security levels can vary by device and implementation.
Written by: Shivashish
Shivashish works as a content writer at Muvi. He has worked in domains like e-commerce, employee engagement, sports and entertainment. A poet by heart, Shivashish believes in creating quality content that is rich in information and easy to understand.
One Platform, Infinite Streaming Possibilities
Live & On-Demand, Audio & Video, Mobile & TV Apps, Player, and Monetization
Start free trialNo credit card required.
Add your comment