What Is Multi-DRM? One Stream, Every Device

A viewer on an iPhone, another in Chrome on a Windows laptop and a third on a Samsung TV all press play on the same film. Behind the scenes, three different DRM systems unlock the same encrypted video. That arrangement is called multi-DRM, and it is how every large streaming service delivers protected video to every device without keeping three separate copies of its library.

This guide explains what multi-DRM is, why it exists, how the pieces fit together, and what a small or mid-sized video business needs to get it running.

Why one DRM is never enough

DRM (digital rights management) encrypts video so that only a licensed player on a trusted device can decrypt it. The problem is that the three companies that control most screens each built their own system:

• Google Widevine on Chrome, Firefox, Android, Android TV and Chromecast.
• Apple FairPlay Streaming on Safari, iPhone, iPad and Apple TV.
• Microsoft PlayReady on Edge, Windows, Xbox and many smart TVs.

No platform supports its rivals’ systems natively. Safari will not use Widevine, Chrome will not use FairPlay. So if you pick just one DRM, whole groups of viewers simply cannot watch. We compare them in detail in Widevine vs FairPlay vs PlayReady.

Multi-DRM is the practice of protecting content once and delivering it through whichever DRM each device understands.

The four building blocks

A multi-DRM setup has four parts. Understanding them makes vendor sales pages much easier to read.

1. Encryption and packaging

Your source video is encoded into an adaptive bitrate ladder, then encrypted using Common Encryption (CENC). CENC defines how the video data is encrypted, independent of which DRM will later deliver the key. That is the trick that makes multi-DRM possible: the encrypted segments are the same for everyone.

The segments are usually packaged as CMAF (fragmented MP4) and described by both an HLS playlist and a DASH manifest. Each manifest carries the signalling each DRM needs, such as a pssh box for Widevine and PlayReady, and an EXT-X-KEY or EXT-X-SESSION-KEY line for FairPlay.

Tools that do this include Shaka Packager, Bento4, Unified Streaming, AWS Elemental MediaConvert and MediaPackage, and most online video platforms.

2. Key management

Each video (or each part of a video) gets one or more content keys and matching key IDs. A key management service stores them. The packager asks it for keys during encryption, and the licence servers ask it for the same keys during playback. Many multi-DRM vendors implement the CPIX standard or the older SPEKE API so that packagers and key services can talk to each other.

3. Licence servers

For each DRM system, a licence server receives a request from the viewer’s device, checks whether the viewer is allowed to watch, and returns the content key in a form that only that device’s CDM can open. Widevine, PlayReady and FairPlay each have their own licence protocol, which is why vendors run all three for you.

4. The player

The player detects which DRM the device supports, fetches the manifest, requests a licence from the right server and plays the video. In browsers this happens through Encrypted Media Extensions. In apps it happens through the platform’s media framework: Media3/ExoPlayer on Android, AVFoundation on Apple devices.

How a playback session flows

Here is the whole thing in order, for a viewer in Chrome:

1. The viewer logs into your site. Your backend checks their subscription.
2. Your backend issues a short-lived playback token that says “user 1234 may watch video 567 until 18:05”.
3. The player loads the DASH or HLS manifest, sees Widevine signalling and calls EME for com.widevine.alpha.
4. The Widevine CDM creates a licence request. The player sends it, with the token, to the multi-DRM vendor’s Widevine licence endpoint.
5. The vendor validates the token, looks up the content key and returns a Widevine licence with your policy: allowed resolutions, expiry time, whether offline playback is allowed.
6. The CDM decrypts the segments and the video plays.

On an iPhone the flow is the same, except step 3 uses FairPlay, step 4 goes to the FairPlay endpoint, and the manifest is HLS. The encrypted segments on your CDN are identical.

cenc vs cbcs: the compatibility question

CENC has two main encryption schemes:

• cenc (AES-CTR): the original default for Widevine and PlayReady.
• cbcs (AES-CBC with pattern encryption): the only scheme FairPlay supports.

Modern Widevine and PlayReady clients support cbcs, so the clean modern approach is to encrypt everything in cbcs and serve it as CMAF. One copy of every segment, three DRMs.

The catch is older devices. Some smart TVs and set-top boxes from before roughly 2019 and very old Android versions only understand cenc. If your analytics show lots of those, you may need to keep a second cenc copy for them, or accept that those viewers get a fallback. Most new services start with cbcs only and add a cenc copy only if support tickets show a real need.

What multi-DRM gives you beyond encryption

A good multi-DRM setup does more than lock files. Through licence policies, you can:

• Limit quality by device security. Allow 4K only on hardware-protected devices (Widevine L1, PlayReady SL3000, FairPlay on Apple hardware), and cap software-only devices at 720p. See Widevine L1 vs L2 vs L3.
• Require output protection. Demand HDCP on external displays for HD and above. See HDCP explained.
• Control rentals and offline viewing. Issue persistent licences that expire 48 hours after first play, for example.
• Rotate keys during live events so that a leaked key only unlocks a few minutes.
• Restrict concurrency when combined with your own session tracking.

Multi-DRM providers

You can build multi-DRM yourself, but it means getting licences or credentials from Google, Apple and Microsoft, running three licence services, and keeping up with updates. Nearly every business below the size of a national broadcaster uses a provider instead. Well-known options include:

• Dedicated DRM vendors: EZDRM, BuyDRM KeyOS, Axinom DRM, DoveRunner (formerly PallyCon), castLabs DRMtoday, Irdeto, Verimatrix, Intertrust ExpressPlay.
• Cloud platforms: AWS (via SPEKE partners with MediaPackage), Google Cloud Video Stitcher and partner integrations, and managed video platforms that bundle DRM.
• All-in-one video platforms for smaller teams: VdoCipher, Gumlet, Mux (with DRM add-on), Brightcove, JW Player, Kaltura and others handle encoding, packaging, DRM and playback together.

When comparing, ask about: supported devices and DRM versions, cbcs and cenc support, live and VOD pricing, licence-per-play vs monthly pricing, offline download support, analytics, and how tokens are issued.

Do you really need multi-DRM?

Not every video needs Hollywood-grade protection. Multi-DRM is the right choice when:

• Your content licences require it (films, series, sports, music videos from labels).
• You sell premium content where leaks directly cost revenue, such as paid courses, fitness programmes or pay-per-view events.
• You need offline downloads that expire.

It may be overkill when:

• Your video is free marketing content.
• You only need to stop casual right-click downloads of internal training videos. In that case, signed URLs and AES-128 HLS encryption may be enough.

For a practical breakdown of options, including watermarking and domain restrictions, read how to protect your videos from being downloaded.

A simple multi-DRM launch checklist

1. Choose a vendor and confirm device coverage for your audience.
2. Encode an adaptive ladder. Our encoding settings guide has a starting point.
3. Package as CMAF with cbcs encryption. Generate HLS and DASH manifests.
4. Integrate a player that supports all three DRMs, such as Shaka Player, Video.js with EME, Bitmovin, THEOplayer or JW Player.
5. Build a token endpoint in your backend so licences are only issued to logged-in, entitled users.
6. Set licence policies per quality level and device security.
7. Test on real devices: Chrome, Edge and Firefox on Windows, Safari on Mac and iPhone, an Android phone, and at least one smart TV or streaming stick.
8. Monitor licence errors after launch. They tell you which devices are failing and why.

Mistakes teams make in their first multi-DRM launch

A few problems come up so often that they are worth listing before you start.

• Forgetting the FairPlay certificate. FairPlay players need an application certificate before they can build a licence request. If the player cannot fetch it, Safari fails silently or with a vague media error.
• Issuing licences without checking entitlement. A licence server that hands keys to anyone who asks provides encryption without protection. Always pass a signed, short-lived token and validate it on every request.
• Setting licence lifetimes too long. A licence valid for a year makes shared links far more useful to pirates. For streaming, a licence that lasts for the session, or a few hours, is usually enough.
• Testing only in Chrome. Chrome is the most forgiving environment. Edge with hardware PlayReady, Safari with FairPlay and older smart TVs each fail in different ways, so test them early.
• Ignoring licence error analytics. Licence failures show up as “video won’t play” support tickets. Log every failed request with device, browser and error code so you can spot patterns.

Summary

Multi-DRM means encrypting video once with Common Encryption, then letting Widevine, FairPlay and PlayReady each deliver keys to the devices they support. It is the standard way to protect premium video across browsers, phones and TVs. For most businesses, the smart path is CMAF packaging, cbcs encryption and a multi-DRM vendor that runs the licence servers, so you can focus on your content and your viewers.