AES-128 encryption (HLS)
AES-128 encryption (HLS) is a method of protecting HLS video by encrypting each segment with a 128-bit AES key, which the player downloads from a key URL before playback. It is built into the HLS standard and works in most HLS players without a DRM system. Because the key is delivered to the player directly, protection depends on securing that key URL.
Why it matters
AES-128 gives a basic layer of protection at little extra cost, since nearly every HLS player supports it. It stops casual downloading of video files. But because the key reaches the player directly, it does not meet the protection most studios require for premium content.
How it works
- The packager encrypts each HLS segment in full with a 128-bit AES key.
- The playlist includes an EXT-X-KEY tag pointing to a URL where the key can be fetched.
- The player downloads the key, ideally from a URL protected by a token or login.
- Each segment is decrypted in the player and then played as normal.
Is AES-128 HLS encryption secure?
AES-128 itself is strong encryption, but HLS AES-128 protection is only as secure as the key URL. Anyone who can fetch the key and the segments can decrypt the video, and the key is visible to the player. It stops casual copying and hotlinking, especially with tokenized key URLs, but it is not a substitute for DRM on premium content.
AES-128 vs DRM: what is the difference?
AES-128 encrypts the video but hands the key directly to the player, while DRM protects the key inside a secure module on the device and enforces rules such as expiry and output limits. AES-128 is cheaper and simpler. DRM is stronger and is usually required by studios and sports leagues.
Where it's used
Online learning platforms, corporate training teams and microdrama apps use AES-128 to stop casual downloading without the cost of full DRM, though premium studio content usually needs stronger protection.
By the numbers
- RFC 8216 defines the HLS AES-128 method as full-segment encryption with a 128-bit key in CBC mode with PKCS7 padding. (IETF RFC 8216: HTTP Live Streaming)
- NIST announced the Advanced Encryption Standard as FIPS PUB 197 on November 26, 2001, with key sizes of 128, 192 and 256 bits. (Wikipedia: Advanced Encryption Standard)
