How to Protect Your Videos From Being Downloaded

If you sell online courses, run a membership site, publish premium fitness programmes or share confidential training, your videos are your product. Seeing them re-uploaded to a file-sharing site, or passed around a group chat, is painful and expensive. The good news is that you can make downloading much harder, and leaks much more traceable, with the right mix of tools. Here is how to protect videos from being downloaded, in layers, from cheap and simple to strong and professional.

This guide explains the options from weakest to strongest, what each one stops, what it costs, and how to combine them sensibly.

First, a reality check

No protection is absolute. Anything a viewer can see, they can film with a phone. The realistic goals are:

1. Stop casual copying. Most people will not download if there is no obvious button or link.
2. Stop tool-based downloading. Browser extensions and command-line tools grab unprotected streams in seconds. Good protection defeats them.
3. Make leaks traceable. If a copy escapes, you know which account it came from.
4. Make sharing accounts unattractive. Limit how many people can use one login.

With those goals in mind, here are the layers.

Layer 1: do not use a direct MP4 link

The weakest setup is an MP4 file on a public URL, embedded with a plain <video> tag. Anyone can right-click and save, or copy the URL from the page source. Disabling right-click hides the menu but does nothing against developer tools.

Minimum fix: stream with HLS instead. The video is split into many small segments listed in a playlist, so there is no single file to save. This alone stops the least technical users, but download tools handle HLS easily.

Layer 2: access control with signed URLs

Make sure only logged-in, paying users can fetch your video at all.

• Signed URLs or tokens add an expiring signature to every playlist and segment request. A link copied from the browser stops working after minutes or hours.
• Signed cookies do the same at the CDN level for a whole folder.
• Domain restrictions / referrer checks ensure the player only works on your site.

This stops link sharing and hotlinking, but a logged-in user can still download while their session is valid. See what is a video CDN for how token authentication works.

Layer 3: HLS AES-128 encryption

Encrypt the segments and deliver the key only to authenticated sessions. Without the key, downloaded segments are useless.

The limitation: the key is delivered to the browser in a readable form, so download tools running in a logged-in session can fetch it and decrypt everything. AES-128 is good at keeping out strangers, not at stopping determined customers. We compare it in detail in AES-128 HLS encryption vs DRM.

Layer 4: DRM

Digital rights management (Widevine, FairPlay and PlayReady) encrypts video and protects the key itself inside a Content Decryption Module on the viewer’s device. The browser’s JavaScript never sees the key, so standard download tools cannot decrypt the video.

DRM also:

• Blocks screen recording and screenshots on many devices and browsers, which show a black rectangle instead of the video.
• Lets you set licence rules, such as expiry times for offline downloads.
• Lets you set quality limits by device security level.

To reach all devices you need all three DRM systems, which is called multi-DRM. Most businesses get it through a DRM vendor or a video platform that includes it. Costs range from tens of dollars per month for small libraries to much more for large audiences.

DRM is the strongest protection against downloading. It does not stop a camera pointed at a screen, and software-only DRM on desktop browsers is weaker than hardware-backed DRM on phones and TVs. That is why the next layer matters.

Layer 5: watermarking

Watermarking does not prevent copying; it identifies the source.

• Dynamic visible watermark: overlays the viewer’s email, name or ID on the video, moving it around the frame. Viewers see it, which discourages sharing. If a recording leaks, you can read who it came from. Cheap and effective, especially for courses.
• Forensic (invisible) watermark: embeds a hidden, unique mark in each viewer’s stream that survives re-encoding and camera recording. Used by studios and sports leagues. More expensive.

See forensic watermarking explained for how both work.

Layer 6: account and session controls

Many leaks are really account sharing. Controls that help:

• Concurrent stream limits: only one or two active playback sessions per account.
• Device limits: a maximum number of registered devices.
• Login alerts: email users when a new device logs in.
• Anomaly detection: flag accounts that watch from many locations or at impossible speeds.
• Short sessions: require re-authentication periodically.

Comparison of methods

Recommended setups by budget

Just starting (low budget)

Use a hosted video platform that offers:

• Private videos with domain restrictions.
• Signed or expiring playback URLs.
• HLS streaming with encryption.
• A dynamic visible watermark with the viewer’s email.

Many platforms aimed at course creators include these on mid-level plans. Avoid public YouTube or unlisted links for paid content.

Growing course or membership site

Add DRM. Choose a platform with built-in DRM, or add a multi-DRM vendor to your own setup. Keep the visible watermark. Add concurrent session limits in your membership software. Read our guide to the best way to host videos for online courses for platform types.

Premium media or high-value content

Use multi-DRM with hardware-level policies (for example, highest quality only on hardware-protected devices), forensic watermarking, strict session controls, and an anti-piracy monitoring service that finds and takes down leaked copies.

What not to do

• Do not rely on “download protection” plugins that only hide the right-click menu or obscure the video URL with JavaScript.
• Do not put paid content on public video sites as unlisted or private links shared outside the platform’s own access system.
• Do not make protection so strict that paying users cannot watch. Blocking all desktop browsers or capping quality too low generates refunds. Test on the devices your customers use.
• Do not forget the audio. Some courses leak as audio-only recordings. Watermarking helps here too, and so do audio-specific watermarks.

Legal backup

Technical protection works best alongside clear terms:

• State in your terms that content is licensed for personal use and may not be shared.
• Say that videos are watermarked and that leaks can be traced to accounts.
• Register copyright where it helps enforcement in your country.
• Use DMCA or equivalent takedown notices when copies appear. Many hosting sites and search engines act quickly on valid notices.

How download tools actually work

Understanding the tools helps you judge which protections matter.

• Browser extensions watch the network requests a page makes. When they see an MP4 file or an HLS playlist, they offer a download button. They can only save what the browser can already read.
• Command-line downloaders fetch a page or playlist URL, follow it to the segments, download them and join them into one file. If the stream uses AES-128 and the key URL works with the user’s cookies, they fetch the key too.
• Screen recorders capture whatever is on screen. They are stopped only when the operating system and browser mark the video as protected, which happens with DRM on many platforms.

Every one of these tools is defeated by DRM at the decryption stage, because the key never reaches a place they can read. Screen recording is defeated on many devices by DRM’s protected output. What remains is external recording with a camera, which is exactly where watermarking earns its place.

Measuring whether your protection works

Test your own setup the way a student would:

1. Log in as a normal user in a clean browser.
2. Try right-click, the browser’s developer tools and a popular download extension.
3. Try a screen recording tool on Windows and macOS.
4. Check that a copied playback URL stops working after it expires.
5. Watch on a phone and a TV to make sure protection has not broken normal playback.

If a free extension can save the lesson in under a minute, your protection is not yet at the DRM layer.

A 30-day plan for creators

Week 1. Move paid lessons off public links and onto a host with private playback and domain restrictions. Replace any direct MP4 links.

Week 2. Turn on HLS encryption and signed playback URLs. Add a dynamic watermark with each student’s ID.

Week 3. Update your terms of use to mention watermarking and account sharing. Set a concurrent stream limit in your membership software.

Week 4. Test from a student account with a download extension. If lessons can still be saved, add DRM.

Most creators find that weeks one and two solve most of the problem.

Summary

You cannot make video impossible to copy, but you can make it hard, unattractive and traceable. Replace direct MP4 links with HLS, restrict access with signed URLs, use DRM to stop download tools, add a visible or forensic watermark to identify leakers, and limit account sharing. For most creators, a hosted platform with DRM and dynamic watermarking gives strong protection at a reasonable cost. Check what your viewers’ browsers support with the DRM support checker.