Any OTT platform that wants to license premium content runs into the same wall: there is no single DRM that plays everywhere. Google, Apple and Microsoft each ship their own, each locked to their own devices and browsers. This guide explains what Widevine, FairPlay and PlayReady actually do, which platforms each one covers, and why a real streaming service ends up running all three — a setup called multi-DRM.
Widevine, FairPlay and PlayReady are the three DRM systems that protect streaming video, split by ecosystem: Widevine covers Android and Chrome, FairPlay covers Apple devices and Safari, and PlayReady covers Windows, Xbox and many smart TVs. No single one works everywhere, so OTT services run multi-DRM — all three from one packaging workflow.
What DRM does in streaming (in one paragraph)
DRM encrypts your video at packaging and hands each device an individual decryption licence. Without a valid licence the file is unplayable, which is exactly what studios and rights-holders require before they will license premium content to you. DRM is different from plain encryption: encryption scrambles the file, while DRM adds the licence layer that decides who may decrypt it, on which device, for how long and in which country. For the full picture of how encryption, licensing and access controls fit together, see the DRM video encryption platform overview.
Widevine (Google)
Widevine is Google’s DRM and the widest-reaching of the three. It handles Android phones and tablets, the Chrome browser, Android TV, and most smart TVs and set-top boxes that run Android or Chromecast built-in. Widevine protects content delivered over MPEG-DASH using Common Encryption (CENC).
Widevine defines three security levels. L1 performs all decryption and video processing inside the device’s hardware-backed Trusted Execution Environment (TEE) — this is what unlocks HD and 4K on premium services. L3 is software-only, with no hardware protection, so services typically cap it at standard definition. L2 sits in between. When Netflix or Prime Video refuses to play HD on a device, a missing L1 is usually why.
FairPlay (Apple)
FairPlay Streaming is Apple’s DRM, and its importance is exclusivity: it is the only DRM that works on iPhone, iPad, Apple TV and Safari on macOS. If you want protected playback anywhere in the Apple ecosystem, FairPlay is not optional — nothing else is allowed. FairPlay is delivered over Apple’s HLS format using SAMPLE-AES encryption, which is why an Apple-ready stream is packaged differently from an Android or Windows one.
This is the single biggest reason a service cannot get by with one DRM. Cover only Widevine and you lose every Apple viewer; cover only FairPlay and you lose everyone else.
PlayReady (Microsoft)
PlayReady is Microsoft’s DRM and the quiet workhorse of the living room. It covers Windows and the Edge browser, Xbox, and a large share of smart TVs and set-top boxes — many TV manufacturers ship PlayReady rather than Widevine. Like Widevine, it runs over MPEG-DASH with Common Encryption, and it has its own hardware and software security tiers (SL2000 and SL3000 for hardware-backed premium playback, SL150 for software).
Widevine vs FairPlay vs PlayReady: the comparison
| Widevine | FairPlay | PlayReady | |
|---|---|---|---|
| Owner | Apple | Microsoft | |
| Devices & browsers | Android, Chrome, Android TV, many smart TVs | iOS, iPadOS, tvOS, Safari (macOS) | Windows, Edge, Xbox, many smart TVs & STBs |
| Streaming format | MPEG-DASH (CENC) | HLS (SAMPLE-AES) | MPEG-DASH (CENC) |
| Hardware security tier | L1 | Hardware-backed on Apple silicon | SL3000 / SL2000 |
| Software tier | L3 (often SD-capped) | — | SL150 |
| You can skip it if… | You never ship Android/Chrome | You never ship to Apple (rare) | You never ship Windows/Xbox/those TVs |
Why OTT needs all three: multi-DRM
Because the three systems split the device world cleanly between them, covering a real audience means running multi-DRM — all three, from one pipeline. Practically, that means packaging your catalogue in two streaming formats: MPEG-DASH (for Widevine and PlayReady) and HLS (for FairPlay). Your player then detects the platform it is running on and requests the right manifest and the right licence automatically. If you want to go deeper on the packaging side, see HLS vs DASH.
The good news is that Common Encryption (CENC) lets you encrypt the DASH side once and signal both Widevine and PlayReady from the same files, so multi-DRM is not three times the work — but it is more than one integration, and it has to keep working as each vendor updates its rules.
The real cost of multi-DRM is maintenance, not licences
Teams usually assume the expense of multi-DRM is the licence fees. It rarely is. The cost is the on-call engineer the morning an OS update changes FairPlay behaviour on iOS, or a smart-TV firmware push breaks PlayReady on one manufacturer. Three DRM integrations mean three moving targets. This is why most platforms run multi-DRM as a managed workflow rather than three DIY integrations they own forever — the maintenance is the product. It is also why DRM is usually a procurement requirement before it is a technical one: no studio or league licenses premium content to a platform that cannot prove it protects every device family.
How Enveu handles it
Enveu runs Widevine, PlayReady and FairPlay from a single packaging workflow inside Experience Cloud, so you protect the catalogue once and it plays everywhere — with AES-encrypted HLS and DASH, geo-blocking, concurrency and device limits, and screen-recording protection on supported devices, across both VOD and live. DRM policy is set per asset in the video CMS, and because Enveu takes no revenue share, the protection that makes a paywall meaningful is not taxed as you grow. One workflow, three DRMs, no integration project in between.
Frequently asked questions
Do I really need all three DRM systems?
If you ship on more than one device family, yes. Widevine misses every Apple device, FairPlay misses everything non-Apple, and PlayReady covers Windows, Xbox and many TVs. Multi-DRM is how you cover a real audience without gaps.
Which DRM does each device use?
Android and Chrome use Widevine; iPhone, iPad, Apple TV and Safari use FairPlay; Windows, Edge, Xbox and many smart TVs use PlayReady. Some TVs support more than one.
What is the difference between Widevine and FairPlay?
They are rival DRMs for different ecosystems. Widevine (Google) protects DASH streams on Android and Chrome; FairPlay (Apple) protects HLS streams on Apple devices and Safari. Neither works on the other’s platforms, so OTT services run both.
Is DRM the same as AES encryption?
No. AES encryption scrambles the video file. DRM adds the licence layer on top — deciding who may decrypt it, on which device, for how long and where. DRM uses encryption, but encryption alone is not DRM.
What are Widevine security levels L1 and L3?
L1 performs decryption inside the device’s hardware Trusted Execution Environment and is required for HD and 4K playback. L3 is software-only with no hardware protection, so services usually limit it to standard definition.
