What is Widevine DRM and how it works

What is Widevine DRM?

Widevine DRM is Google's content protection system for premium media. It's used by major content services worldwide, and it's built into Chrome, Firefox, and Edge, Android devices, Chromecast and Google TV, and many smart TVs and OTT devices.

A short history

Widevine Technologies developed Widevine to replace smartcard-based content security, and Google acquired the company in 2010. The original Widevine Classic (.WVM format) is long retired. Today's Widevine DRM (once called Widevine Modular) is built on DASH, HLS, CMAF, and the HTML5 EME/MSE standards.

Widevine doesn't have a single product version. Instead each component is versioned separately, most notably the CDM version and the OEMCrypto API version that a device implements.

Components and how they work

A Widevine deployment has a license server, a license proxy, and client devices.

• License server: generates and issues DRM licenses. It runs on Google's Widevine License Server SDK, hosted either by a Widevine partner vendor such as DoveRunner or by the content service itself. Hosting it requires a Widevine agreement and credentials.
• Client devices: Android phones and TVs, set-top boxes, and browsers. Device makers integrate the Widevine CDM and OEMCrypto under a separate agreement with Widevine.

Google recently deprecated its Cloud License Service and the Proxy SDK that relayed requests to it. Widevine licenses are now issued only by License Server SDK deployments, run by partner vendors or by content services themselves.

Google runs the Certified Widevine Implementation Partner (CWIP) program as optional training for partners. (Ref. 1) DoveRunner is an official Widevine partner.

Security levels

Widevine clients have one of three security levels:

• L1: decryption and video decoding both happen inside the device's Trusted Execution Environment (TEE). Required for HD/UHD premium content on most services.
• L2: only decryption happens in the TEE. Rare.
• L3: everything runs in software.

Desktop Chrome, Firefox, and Edge use Widevine L3, which is why they're limited in resolution and vulnerable to screen recording. On Windows, hardware-backed 4K in the browser comes from PlayReady SL3000 instead. Desktop browsers also enforce Verified Media Path (VMP), and Google regularly revokes old CDM versions, so outdated browsers stop playing Widevine content.

The license can also require HDCP on the output (for example HDCP 2.2 for UHD), so content won't play on an unprotected display.

Use cases

When issuing a license, the Widevine license server can set these rules for how long content can be played. (Ref. 2)

• License Duration: how long the license is valid, that is, how long you can play content with it. Used in every scenario below.
• Playback Duration: how long the license stays valid after the first playback. Used for offline or license renewal scenarios.
• Rental Duration: how long the license stays valid before the first playback. Used for offline scenarios.

Basic streaming

The device is assumed to be online, and License Duration limits how long content can be played.

(Example: License Duration 180 minutes → 3 hours of playback)

License renewal

For live (linear) content or concurrent-stream limits, the license can be renewed periodically during streaming. Set the total playable time as Playback Duration and a shorter Renewal Delay, and the license is renewed at that interval.

(Example: Playback Duration 180 minutes, Renewal Delay 15 minutes → license reissued every 15 minutes, up to 3 hours of playback)

Offline (rental)

For downloaded content, Rental Duration and Playback Duration set separately how long the download can be kept and how long it can be played.

(Example: Rental Duration 30 days, Playback Duration 3 hours → watch within 30 days of download, up to 3 hours after playback starts)

Supported platforms and content formats

• Browsers: Chrome, Firefox, and Edge on Windows, macOS, Linux, and ChromeOS (L3). Safari doesn't support Widevine; Apple platforms use FairPlay.
• Mobile: Android apps and Chrome on Android (L1 or L3 depending on the device)
• OTT: Android TV and Google TV, Chromecast, Fire TV, Roku, and smart TVs such as Samsung Tizen and LG webOS

See DoveRunner's supported environments for current per-platform details.

Content formats

• Streaming formats: MPEG-DASH, HLS, CMAF, using fMP4 or WebM containers
• Encryption modes: cenc (widest support), cbcs (Android 7+, Chromecast, browsers, and most current devices)
• Video codecs: AVC (H.264), HEVC (H.265), VP9, AV1
• Audio codecs: AAC, AC3, E-AC-3, Opus

Shaka Player, the open-source web player started by Google, plays Widevine, PlayReady, and FairPlay content in most browsers.

DoveRunner Multi-DRM is a cloud-based SaaS that manages PlayReady, Widevine, and FairPlay licenses through one integration.