Is AES encryption the same as DRM?

No. AES-128 encrypts each HLS segment, and any standard player can decrypt it once it fetches the key. DRM goes further: keys stay inside the device's secure module and every play needs a license. Use AES to stop direct downloads, and Multi-DRM for studio or premium content.

Is AES-128 strong enough for video?

Yes. AES-128 has no practical brute-force attack. The real boundary is the key: serve it over HTTPS from a gated endpoint and put a secure token in front of the key URL.

Will AES encryption slow down playback?

Not noticeably. The player fetches the key when playback starts and decrypts segments in memory as it plays. Encrypted segments are cached and delivered by the CDN like any other HLS file.

Do I need a special player?

No. AES-128 is part of the HLS standard, so any HLS-compliant player, including Shaka Player, hls.js, Video.js, AVPlayer and ExoPlayer, plays it with no SDK.

Can someone still pull the key from the browser?

If the key URL is open, yes: anyone who can read the manifest can request the key. That's why the key should be gated over HTTPS and protected with a secure token, so only authorized sessions can fetch it. If keys must never reach the browser at all, use Multi-DRM.

How do I protect the key URL?

Turn on Secure Token for the key endpoint. Each key request then needs a valid, short-lived token, so a key URL copied out of a manifest won't work elsewhere or later. See Token Authentication.

Does AES work with both live and VOD?

Yes. AES-128 encryption is part of the HLS standard for both live and on-demand streams, and players handle both the same way.

Multi-DRM Token Authentication AES Encryption

AES encryption for HLS, built into your delivery

Encrypt every HLS segment with AES-128 on 5centsCDN. A downloaded segment is unusable without the key, and any standard HLS player handles it with no changes.

Get Started

Plays in any standard HLS player, with no SDK and no DRM vendor.

AES-128Per-segment encryptionStandard HLSGated key delivery

How your video stays encrypted

Package with AES-128Every segment encrypted

Encrypted HLS at the edgeCached and delivered

Player reads EXT-X-KEYRequests the key

Key grantedFrom a gated endpoint

Decrypts and playsIn memory, during playback

Segments are unusable on their ownWorks with players you already useKey served from a gated, HTTPS endpoint

Encrypt the file, not just the link

AES (Advanced Encryption Standard) encrypts each segment of your HLS stream with a key. HLS supports AES-128 encryption, so a player can only show the video if it can fetch the matching key. A segment pulled off the wire or copied from cache is unusable on its own.

Any HLS-compliant player reads the EXT-X-KEY line in the manifest, fetches the key, and decrypts segments in memory during playback, invisibly to the viewer. The stream is still delivered as ordinary HLS files; those files are just scrambled without the key.

In practice, security depends less on the cipher than on protecting the key. Serve it over HTTPS from a gated endpoint, and put a secure token in front of the key URL so it can't be fetched by just anyone.

AES-128: The encryption applied to each HLS segment (AES-128-CBC).
Key: What a player needs to decrypt and play.
Key URL: Where the player fetches the key. Serve it gated over HTTPS and protect it with a secure token.
EXT-X-KEY: The manifest line that tells the player where to get the key.

What the player seesCompare the two cases

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:6
#EXT-X-KEY:METHOD=AES-128,URI="/keys/8f2c41?token=…"#EXTINF:6.000,
seg_00001.ts
#EXTINF:6.000,
seg_00002.ts

Plays normallyThe player fetched the key and decrypts segments in memory.

Three levels of protection, one network

Signed links, AES encryption and Multi-DRM build on each other. Start with the level your content needs and step up when it needs more.

Signed or token URLs

Basic

StopsLink sharing and hotlinking
Gets throughAnyone who downloads the file keeps a playable copy

Token Authentication

You're here

AES HLS encryption

Standard

StopsDirect file downloads
Gets throughAnyone who can fetch the key can decrypt the stream, so the key URL needs protecting

Multi-DRM

For paid content

StopsCasual downloading, ripping and key extraction
HowKeys stay in the device's secure module, and every play needs a license

Multi-DRM

Just stopping hotlinking? Secure tokens are enough. Protecting premium content? Step up to Multi-DRM.

From source to encrypted stream in three steps

Zone

vod.example.com · HLS

HLS AES-128 encryptionEncrypt every segment as your video is packaged

Method

AES-128 (AES-128-CBC)

Key endpoint

Gated, HTTPS onlyServed separately from the segmentsOn

Secure Token on key URLPairs with Token Authentication

Your playerShaka, hls.js, AVPlayer…

Key endpointGated · HTTPS

Reads EXT-X-KEY → requests the key

Key granted

HTTPSToken checkedAuthorized session

Decrypting segments in memory

Encrypted segments are cached and served from the 5centsCDN edge like any other HLS file.

Same encode step, same player. The file just stops being usable on its own.

Plays in every HLS player you already use

AES-128 HLS is a standard, not a proprietary format. Any HLS-compliant player reads the EXT-X-KEY line, fetches the key and plays, with no SDK to add.

BrowsersMobile appsSmart TVs

Controls that protect the key

The cipher is the easy part. These controls keep the key in the right hands.

Per-segment AES-128

Every media segment is encrypted as your video is packaged.

Gated key delivery

The key is served from an authenticated, HTTPS-only endpoint, not alongside the segments.

Request without a valid sessionBlocked

Plain HTTP requestRefused

Authorized session, HTTPSKey granted

Token-protected key URL

Put a secure token in front of the key endpoint so it can't be fetched freely.

Pairs with Token Authentication

/keys/8f2c41?token=…Valid

Copied URL, token expired403

Keep your existing players

No DRM SDK and no player swap. It stays standard HLS throughout.

Works with your existing players

Setup is a toggle, not an integration. Turn on AES-128 for your zone, then encode and deliver as usual.

Turn it on

One setting on your zone, applied when your video is encoded and packaged. No SDK to add and no new pipeline.

Deliver as usual

Encrypted HLS is cached and served from the edge like any other stream.

03Recommended

Protect the key URL

Add a secure token in front of the key endpoint. Token Authentication

Works with any HLS-compliant player

Shaka Playerhls.jsVideo.jsAVPlayeriOS · tvOSExoPlayerAndroid

Developer resources

Key served from a gated, HTTPS endpoint
Pairs with Secure Token to protect the key URL
Standard HLS output, no SDK to integrate

Built for video that needs more than a signed link

Internal and training video

Make confidential video much harder to download and reshare.

Download protectionToken-protected key

Membership and light-paywall VOD

Raise the bar past signed links without taking on DRM licensing.

No DRM licensingStandard players

Large VOD catalogs on a budget

Protect big libraries affordably where studio DRM isn't required.

Per-segment AES-128

Compliance-driven delivery

Satisfy policies that call for encrypted video, using a recognized standard.

AES-128HTTPS key delivery

Have some questions
before getting started?

Encrypt your catalog without adding a vendor

Turn on AES where you already encode and deliver. One dashboard, one bill, standard HLS out.

Get Started

Login

AES encryption for HLS, built into your delivery

Encrypt the file, not just the link

Three levels of protection, one network

Signed or token URLs

AES HLS encryption

Multi-DRM

From source to encrypted stream in three steps

Plays in every HLS player you already use

Controls that protect the key

Per-segment AES-128

Gated key delivery

Token-protected key URL

Keep your existing players

Works with your existing players

Turn it on

Deliver as usual

Protect the key URL

Works with any HLS-compliant player

Developer resources

Built for video that needs more than a signed link

Internal and training video

Membership and light-paywall VOD

Large VOD catalogs on a budget

Compliance-driven delivery

Have some questions
before getting started?

Encrypt your catalog without adding a vendor

Products

Solutions

Compare

Tools

Resources

Company

Subscribe to our newsletter

AES encryption for HLS, built into your delivery

Encrypt the file, not just the link

Three levels of protection, one network

Signed or token URLs

AES HLS encryption

Multi-DRM

From source to encrypted stream in three steps

Plays in every HLS player you already use

Controls that protect the key

Per-segment AES-128

Gated key delivery

Token-protected key URL

Keep your existing players

Works with your existing players

Turn it on

Deliver as usual

Protect the key URL

Works with any HLS-compliant player

Developer resources

Built for video that needs more than a signed link

Internal and training video

Membership and light-paywall VOD

Large VOD catalogs on a budget

Compliance-driven delivery

Have some questionsbefore getting started?

Encrypt your catalog without adding a vendor

Products

Solutions

Compare

Tools

Resources

Company

Subscribe to our newsletter

Have some questions
before getting started?