Widevine L1 vs L2 vs L3: Security Levels Explained

Two phones, same Netflix plan, same Wi-Fi, same film. One plays in crisp Full HD, the other looks like it came from 2009. The difference is almost always three characters: L1 or L3. Widevine, Google’s DRM system, grades every device it runs on by how well it can protect decryption keys and decoded video, and streaming services use that grade to decide what quality you are allowed to watch.

This guide explains exactly what L1, L2 and L3 mean, why desktop browsers and rooted phones end up at L3, how to check your own device, and what developers should do with this information.

A quick refresher on Widevine

Widevine is the DRM built into Chrome, Android, Android TV and many smart TVs. When you play a protected video, the Widevine Content Decryption Module (CDM) on your device asks a licence server for a key, then decrypts the video locally. If you want the full picture first, read what is Widevine DRM.

The security level describes where that decryption and the following video decoding take place, and how well that place is shielded from the rest of the device.

The three security levels

Widevine L1: everything happens in hardware

At L1, both decryption and video decoding take place inside a Trusted Execution Environment (TEE). A TEE is an isolated part of the processor, such as ARM TrustZone on most phones, that runs its own small operating system. Apps, including the streaming app itself, cannot read its memory.

Keys are stored and used inside the TEE. Decrypted video frames go through a protected path to the display hardware. Even with full control of the main operating system, an attacker cannot simply copy the frames out of memory.

Because this chain is so strong, film studios allow their highest-value content, including 1080p, 4K and HDR, on L1 devices.

Widevine L2: half in, half out

At L2, cryptographic operations happen inside the TEE, but video decoding and processing happen outside it. That leaves decrypted but still compressed video exposed in normal memory for part of the journey.

L2 is uncommon. Few devices ship with it, and many services treat L2 exactly like L3 when deciding on quality. You mostly see it on older chipsets or some budget hardware where the decoder cannot be placed inside the secure path.

Widevine L3: software only

At L3, there is no TEE involvement. Decryption and decoding happen in software on the main processor. The CDM is heavily obfuscated to make key extraction hard, but it runs in the same environment as everything else on the device.

L3 is used when the hardware cannot support a secure path, when the manufacturer has not certified the device, or when the device’s integrity has been broken, for example by rooting. It is also what every desktop browser uses on Windows, macOS and Linux.

Why L3 limits your video quality

Streaming services do not choose low quality to annoy you. Their licensing deals with studios spell out which resolutions may be sent to which kinds of device. A typical contract might say: SD on software-protected devices, HD on hardware-protected devices, and UHD only on hardware-protected devices with HDCP 2.2 output protection.

The service enforces this in two places:

1. In the licence. The licence server can issue keys only for certain video tracks, based on the security level reported in the licence request.
2. In the manifest or player. The app simply does not offer higher renditions to devices that do not qualify.

Since each service negotiates its own deals, the exact caps differ. Netflix is famously strict about desktop Chrome. YouTube’s paid films and some sports apps have their own rules. That is why one app may look fine on your L3 device while another looks soft. Our article on why Netflix plays in low quality on PC goes through the browser-specific cases.

Which devices are L1 and which are L3

It is impossible to list every device, but these patterns hold broadly:

• Mid-range and flagship Android phones from Samsung, Google Pixel, OnePlus, Motorola, Xiaomi and others: normally L1 out of the box.
• Very cheap or unbranded Android tablets and TV boxes: often L3, because the maker never went through Google’s certification.
• Android TV, Google TV, Chromecast and most big-brand smart TVs: L1.
• Desktop Chrome, Firefox, Edge and other Chromium browsers: L3 on Windows, macOS and Linux.
• Rooted phones or phones with an unlocked bootloader: usually drop to L3. On some models the drop is permanent because the device’s keys are revoked or wiped.
• Apple devices: not applicable. They use FairPlay, which has its own hardware protection.

How to check your Widevine level

On Android

The easiest method is a DRM information app from the Google Play Store. Search for “DRM Info”, install one of the well-reviewed apps, open it and look under the Widevine section for “Security level: L1” or “L3”. These apps read the same values that streaming apps see.

Some streaming apps show it too. Netflix, for example, has a “Playback specification” section in the app’s settings on Android, which shows Widevine security level and whether HD is available on the device.

For a step-by-step walkthrough with screenshots of where to look, see how to check your Widevine security level.

In a browser

Browsers do not display the level directly, but you can test what they will agree to. Our free DRM support checker asks the browser for Widevine at each robustness level:

• HW_SECURE_ALL succeeds only with hardware-backed decryption and decoding, equivalent to L1.
• SW_SECURE_DECODE and SW_SECURE_CRYPTO succeed on software CDMs, equivalent to L3.

On a normal Windows PC in Chrome you will see the software levels pass and the hardware levels fail.

Can you change your Widevine level?

Honestly, rarely. The level is decided by the chipset, the firmware and Google’s certification of that exact device model. There is no app that turns L3 into L1, and any app claiming to do so should be treated as malware.

Things that can make a difference:

• Firmware updates. If a device was misconfigured at launch, the maker sometimes fixes certification in a later update.
• Relocking the bootloader. If you rooted a phone and lost L1, flashing official firmware and relocking can restore it on some models. On others, the keys are gone for good.
• Using a different app or device for playback. A certified streaming stick or TV is the cheapest route to L1 quality on a big screen.
• Using a different browser on Windows. Edge can use hardware PlayReady on supported GPUs, which several services treat as a high-security path. It is not Widevine L1, but the effect for viewers is similar.

What L1 vs L3 means for developers and video businesses

If you distribute your own protected video, the security level gives you a lever:

• Match quality to risk. Offer every rendition to L1 and hardware PlayReady or FairPlay devices, and cap L3 at 720p or 1080p. Most multi-DRM vendors let you set these rules in the licence policy.
• Do not lock out desktop viewers entirely. If your audience watches on laptops, an L3 cap that is too aggressive will generate support tickets. Many course platforms allow 1080p on L3 because their content has a lower piracy risk than new films.
• Detect before you promise. Use EME’s requestMediaKeySystemAccess with robustness strings to find out what a browser can do, and show an honest message (“HD is available in the app or on a TV”) rather than a mysterious blur.
• Combine with watermarking. If you do allow HD on L3, a visible or forensic watermark discourages screen capture and helps trace leaks.

The Encrypted Media Extensions guide shows exactly how those robustness checks look in code.

Security levels and HDCP

Security levels cover what happens inside the device. Once video leaves through an HDMI or DisplayPort cable, a different system called HDCP takes over. Licences often require both: L1 inside the device and HDCP 2.2 on the output for 4K. If your TV, monitor, adapter or capture card does not support the right HDCP version, playback can fall back to lower quality even on an L1 device. HDCP explained covers the details and the common fixes.

Summary

• L1: decryption and decoding in the TEE. Highest quality. Most certified phones and TVs.
• L2: decryption in the TEE, decoding outside. Rare. Usually treated as L3.
• L3: all in software. Desktop browsers, uncertified or rooted devices. Lower quality caps on many services.

If your video looks worse than it should, check the security level first, then the output chain. And if you are building a video platform, use the level to set sensible quality rules instead of treating every device the same.