Encryption is an opt-in add-on that scrambles every video chunk with AES-128 and gates the decryption key behind a short-lived playback token.
Enabling encryption
Encryption is selected per video at upload time, in the Smart Stream Console. Tick "Protect with encryption" before kicking off the transcode. It cannot be toggled after processing completes — to change the setting you re-upload the source.
Cost: +3 Credits per video (one-time, at upload).
How it protects content
- Every 6-second HLS chunk on the CDN is AES-128 encrypted with a unique key per video.
- The decryption key is not in the chunk URL or the manifest.
- When the Player SDK fetches the manifest, the server checks the playback token and issues the key over a short-lived signed URL.
- The key URL expires in 5 minutes, matching the token.
- Tokens are bound to a single video — they can't be replayed against a different one.
What this stops:
- Scraping chunks off the CDN with
curl— without the key the bytes are noise. - Sharing a manifest URL — the key URL is per-session and expires in minutes.
- Casual download / hotlinking — the bound token + short TTL make most off-the-shelf scrapers give up.
⚠️ AES-128 is content protection, not DRM
This is excellent at deterring casual piracy, but it is not hardware DRM (Widevine, FairPlay, PlayReady). A determined attacker who captures the key during playback can decrypt the segments.
Use AES-128 for: paid courses, internal training, members-only content, soft-launch previews.
For studio-grade hardware DRM, contact us — it's on the roadmap.
When to encrypt
| Use case | Encrypt? |
|---|---|
| Public marketing videos | No — wastes credits |
| Free YouTube-style content | No |
| Paid courses / lessons | Yes |
| Internal corporate training | Yes |
| Behind-paywall content | Yes |
| User-generated content | Optional — case by case |
What it doesn't change
Encryption is transparent to the Player SDK and to your integration
code — you don't change a single attribute. The SDK detects
#EXT-X-KEY in the manifest, fetches the key, and decrypts chunks
in real time.
It also doesn't change the playback price for your end users — encryption only adds a one-time +3 Credits at upload.