Widevine vs FairPlay vs PlayReady: Which DRM Do You Need?

Every serious streaming service that reaches more than one kind of device runs into the same fact: there is no single DRM that works everywhere. Google, Apple and Microsoft each built their own system, and each company made its own system the default on its own platforms. So the question is rarely “Widevine or FairPlay or PlayReady”. It is “how do I support all three without tripling my work?”

This comparison lays out the real differences between the three, where each one is required, and how modern packaging lets you encrypt once and serve every device.

The short answer

• Widevine (Google): needed for Chrome, Firefox, Edge (as an option), Android, Android TV, Chromecast and many smart TVs.
• FairPlay Streaming (Apple): needed for Safari, iPhone, iPad, Apple TV and Apple Vision devices.
• PlayReady (Microsoft): needed for Edge’s hardware-protected playback on Windows, Xbox, and many smart TVs and set-top boxes, especially in the pay-TV world.

To cover desktop browsers, mobile and living-room devices, you need all three. That combination is called multi-DRM.

Side-by-side comparison

Widevine: the widest reach outside Apple

Widevine’s strength is numbers. Chrome is the most used browser in the world, Android the most used mobile OS, and Google TV and Android TV sit inside hundreds of TV models. The Widevine CDM also ships inside Firefox and Edge.

Its tiered security model is well understood by studios. L1 means hardware protection, L3 means software. Services map quality caps directly onto those levels. We cover the tiers in detail in Widevine L1 vs L2 vs L3.

The weak spot is desktop. Chrome, Firefox and Edge on Windows, macOS and Linux use the software CDM, so the highest-value content is usually capped there. If you want a primer on the whole system, start with what is Widevine DRM.

FairPlay Streaming: required for Apple devices

Apple devices do not support Widevine or PlayReady for web or native playback. If your service must work on iPhone, iPad, Apple TV or in Safari on a Mac, you need FairPlay Streaming (FPS).

FairPlay is tied to HLS. The content key is delivered using a flow Apple calls Secure Key Delivery. The player sends a “Server Playback Context” (SPC) to your key server, and the key server answers with a “Content Key Context” (CKC). To run a key server, you request the FairPlay Streaming deployment package from Apple, which includes certificates and credentials. Apple does not charge for it, but you must apply through a developer account and be approved. Most businesses skip that step by using a DRM provider that already has it.

On modern Apple hardware, decryption runs inside the Secure Enclave and protected media pipeline, so FairPlay content on current iPhones, iPads, Apple TVs and Apple silicon Macs gets hardware-level protection. That is why Safari on a Mac is often allowed higher quality than Chrome on the same machine.

PlayReady: strong in Windows and pay-TV

PlayReady is Microsoft’s DRM and has deep roots in the broadcast and operator world. Many smart TVs, set-top boxes and operator platforms support it, and it is often a contractual requirement in pay-TV deals.

On Windows, Edge can use PlayReady SL3000 with hardware-backed decryption on supported Intel, AMD and NVIDIA graphics. That makes Edge the browser where many services allow 1080p or even 4K on a PC. Xbox consoles also use PlayReady.

PlayReady security levels:

• SL3000: hardware-protected, comparable to Widevine L1.
• SL2000: software-protected, comparable to Widevine L3.
• SL150: for testing and development only.

Encryption: CENC, cenc and cbcs

The feature that makes supporting three DRMs practical is Common Encryption (CENC), an MPEG standard (ISO/IEC 23001-7) that defines how media is encrypted independently of which DRM delivers the key.

There are two modes you will see:

• cenc: AES-128 in counter (CTR) mode. The original default for DASH with Widevine and PlayReady.
• cbcs: AES-128 in CBC mode with a pattern that encrypts only some blocks. This is what FairPlay uses, and newer versions of Widevine and PlayReady support it too.

Because Apple devices only accept cbcs, the modern recommendation is to encrypt everything in cbcs and package it as CMAF. One set of encrypted segments then works with HLS for Apple devices and with DASH or HLS for everyone else. The only per-DRM pieces are small bits of signalling in the manifests and the licence server calls.

Older devices, including some smart TVs from before about 2019 and older versions of Chrome and Android, support only cenc. If your audience includes many of those, you may still need a second cenc copy of the content for them.

Licensing and business model

None of the three is paid per title by the content owner in a public price list. The practical cost comes from running or renting licence servers.

• Widevine: Google licenses Widevine to device makers and to service providers. You can sign an agreement directly or, much more often, use a certified multi-DRM vendor.
• FairPlay: free from Apple, but you need to request credentials and build or rent a key server.
• PlayReady: Microsoft licenses server and client implementations, with fees depending on the arrangement. Again, most services use a vendor.

Multi-DRM vendors typically charge per licence issued or offer monthly plans based on viewers. For small to mid-sized platforms this is far cheaper than building three integrations.

How the player chooses

In the browser, the player uses Encrypted Media Extensions to ask which key systems are available, usually in a preferred order. A typical setup:

1. On Safari, request com.apple.fps and play HLS with FairPlay.
2. On Edge, try PlayReady with hardware robustness first, then fall back to Widevine.
3. Everywhere else, request com.widevine.alpha.

Native apps do the same using platform APIs: ExoPlayer/Media3 with Widevine on Android, AVFoundation with FairPlay on iOS and tvOS, and PlayReady on Xbox and many TVs.

You can see which systems your own browser offers with the free DRM support checker.

Which should you start with?

If you are launching something new, the order depends on your audience.

• Web-first product, mostly desktop users: Widevine first, then FairPlay for Safari and iPhone.
• Mobile-first product: Widevine for Android and FairPlay for iOS from day one.
• TV and operator deals: add PlayReady early, because many TV platforms and contracts expect it.
• E-learning or corporate video: Widevine plus FairPlay covers nearly everyone. PlayReady becomes important if many users watch in Edge and you want higher quality there.

In practice, a multi-DRM service gives you all three behind one API, so the real decision is which vendor to use, not which DRM to drop.

Offline downloads compared

All three systems support downloading protected video for offline viewing, which matters for travel, fitness and education apps. The mechanics differ slightly.

• Widevine issues a persistent licence that the CDM stores on the device. Your policy sets how long it lasts before and after first play. Android apps use this through Media3’s download APIs. Desktop browsers generally do not support persistent Widevine licences for web apps.
• FairPlay uses persistable content keys stored with the downloaded HLS asset. iOS apps manage them through AVFoundation’s AVContentKeySession, and the key’s expiry is enforced by the system.
• PlayReady supports persistent licences on Windows apps, Xbox and many TV platforms, with similar expiry rules.

Whichever system you use, keep offline licences short enough to match your business model, for example 30 days for subscribers, renewed automatically when the device goes online.

A note on testing

Because each system behaves differently when something fails, test all three before launch. Watch for Safari failing to fetch the FairPlay certificate, Edge choosing PlayReady when you expected Widevine, and older TVs rejecting cbcs content. Our DRM support checker is a quick first step on any browser.

Summary

Widevine, FairPlay and PlayReady solve the same problem for different device families. Widevine owns Android and most browsers, FairPlay owns Apple, and PlayReady is strong on Windows, Xbox and TVs. With CMAF packaging and cbcs encryption, one set of files can serve all three, and a multi-DRM provider handles the licensing. If you want to reach every screen, plan for all three from the start.