Protect online video with encrypted HLS delivery

How encrypted HLS delivery works

HLS delivers a manifest and a sequence of media segments. When an eligible on-demand DynTube project uses AES-128 protection, those segments are encrypted during processing. The setting applies to new output produced through that project. The player reads the manifest, requests the media and obtains the matching key separately as part of playback.

A tool that collects encrypted segments receives ciphertext rather than a ready-to-play media file. This makes HLS encryption useful for paid courses, internal training, screeners and other libraries where a plain downloadable media path creates avoidable exposure.

Configure protection at the project level

Choose the protection model before uploading the library. Encryption is applied while new output is packaged, so project configuration and the content processed through it belong to the same rollout decision. Confirm that the selected plan includes video encryption and that the project produces HLS output.

Use origin rules with encrypted browser playback

An origin allowlist connects browser key delivery to the sites you approve. Add every legitimate production and staging domain, keep the account-level empty-origin and all-origin exemptions aligned with your policy, then verify the same embed from an outside domain. That test proves the effective configuration rather than only the saved list.

Choose AES or certified DRM for each project

AES-128 encrypted HLS and certified DRM are separate packaging paths. DRM uses CMAF output and adds a licence workflow for applications and rights policies that require it. A project uses one protection mode, so start from the contract, rights-holder or internal-policy requirement and configure the corresponding output before processing video.

Add viewer access and attribution around encryption

Encryption protects delivered media bytes. Your website, LMS or application can separately decide who is entitled to reach playback. DynTube private links can carry start time, expiry, play-count or one-time rules for managed sharing, while application-driven access can follow a subscription or account lifecycle.

For content where screen capture is a material concern, plan-dependent watermarking can add viewer-specific attribution during playback. The layers complement one another: entitlement selects the audience, origin rules keep browser embeds on approved sites, encryption protects network segments and watermarking discourages redistribution by an entitled viewer.

A practical encrypted-video rollout

1. Classify the library and identify any contractual DRM requirement.
2. Choose an eligible plan and create the project with the required HLS AES or DRM/CMAF mode.
3. Configure approved browser origins and the account-level origin policy.
4. Upload representative videos and wait for the protected output to finish processing.
5. Test normal playback, a copied embed and the managed access path used by viewers.
6. Apply attribution to sensitive titles where the plan and workflow call for it.
7. Review playback and per-video delivery after launch for unexpected patterns.

Encrypted live streaming is configured separately

HLS segment encryption is also available for eligible live streams and plans. Live eligibility belongs to the specific stream configuration, so confirm the event stream, recording decision and audience-access path with the team before a sensitive broadcast.

Compare the complete protected-video cost

Use the current pricing page to confirm plan inclusions, storage and monthly delivery. Estimate the library and viewing workload separately, then include any advanced protection required by the project. That produces a useful commercial comparison without freezing a plan table inside an evergreen technical guide.

Match the layers to the sharing workflow

A paid course embedded in one LMS may use application entitlement, approved origins and encrypted delivery. A client screener may use a short-lived private link and watermarking. Internal training may use login-based access and viewer attribution. Start from the actual distribution path so every enabled control has a clear job.

Verify the effective playback configuration

Test a newly processed representative video after the project settings are saved. Confirm playback on an approved domain, try the embed from an outside origin, inspect the managed link lifecycle and verify the viewer information required by any watermark. Record the result as part of the project launch checklist so later uploads inherit a configuration the team has already exercised.