HLS encryption
HLS encryption is the protection of video streamed over HLS (HTTP Live Streaming) by encrypting its segments so only authorized players can play them. HLS supports simple AES-128 encryption of whole segments, and SAMPLE-AES, which encrypts the media inside each segment and is used with FairPlay DRM. Keys are delivered through a key URL or a DRM license server.
Why it matters
HLS is the main way video reaches Apple devices and many browsers, so how it is encrypted decides who can copy paid content. The choice between simple AES-128 and FairPlay DRM affects cost, device support and whether studio contracts can be met.
How it works
- The packager encrypts segments with a content key, either whole (AES-128) or sample by sample (SAMPLE-AES).
- The playlist's EXT-X-KEY tag tells players the encryption method and where to get the key.
- With AES-128, the player fetches the key from a URL; with FairPlay, it requests a license.
- Segments are decrypted on the device and played back.
AES-128 vs SAMPLE-AES: what is the difference?
AES-128 encrypts each HLS segment as a whole, while SAMPLE-AES encrypts the individual audio and video samples inside it. SAMPLE-AES is the method used with FairPlay DRM and with common encryption for fMP4 segments. AES-128 is simpler and works with almost any HLS player, but usually delivers the key in a less protected way.
How do I protect HLS video from being downloaded?
Combine encryption with access control. Encrypt segments with AES-128 or, for premium content, FairPlay DRM. Protect the key URL and the playlist with signed, expiring tokens tied to a logged-in viewer. Add visible watermarks to discourage screen recording. No method stops every determined copier, so match the layers to the content's value. When a licensor asks for more than encrypted segments, the same FastPix account can add DRM-protected playback through the DRM API.
Where it's used
Course platforms, corporate training teams and microdrama apps encrypt HLS streams so paid videos cannot simply be downloaded and shared, usually pairing encryption with signed URLs or tokens.
By the numbers
- RFC 8216, which documents HTTP Live Streaming, was published by the IETF in August 2017 and defines the AES-128 and SAMPLE-AES encryption methods. (IETF RFC 8216: HTTP Live Streaming)
- Apple's HLS authoring specification says media segment URLs should not be completely static, and should be issued per device or changed over time. (Apple Developer: HLS Authoring Specification for Apple Devices)
