Platform capability
Encrypted HLS for live streaming
HLS segment encryption is available for eligible live streams and plans. Availability depends on the stream configuration, so confirm it for your own stream before a sensitive event rather than assuming every broadcast is encrypted.
Your brand on the surface your audience sees
How it works
What encrypted HLS actually does to a live stream
An HLS stream is a manifest that lists media segments. Encryption changes what those segments contain in transit and at rest on the viewer’s machine.
- Segments are encrypted, the manifest is notDelivery
- The player still reads a normal HLS manifest, but the segments it fetches are ciphertext. A capture taken off the network or scraped from the manifest is not a watchable media file on its own.
- The key is fetched separatelyPlayback
- The player requests the decryption key over a separate request and decrypts as it plays. That separation is what makes a captured segment useless without the matching key. It is not an identity check: key delivery is not bound to a particular viewer, so it does not decide who may watch.
- Eligibility is per stream and per planConfiguration
- Encryption for live is an attribute of an eligible stream on an eligible plan rather than a global default, and it is not something you can simply switch on for a stream you have just created. Ask about the stream you are actually going to broadcast on, on the plan you are actually going to buy.
Before a sensitive event
Three things to confirm, in this order
- 01
Confirm the stream is eligible and encrypted
- 02
Decide who is allowed to watch, separately
- 03
Decide about recording as well as the broadcast
Scope and limits
How encrypted live delivery is configured
Use encryption for media-segment confidentiality and design viewer authorisation separately on the page or embed where the stream appears.
- What encryption coversSegment bytes
- Encryption protects the bytes of the media segments. A segment captured off the network, or pulled from the manifest, is ciphertext and will not open in a player without the matching key.
- Viewer authorisation stays separateViewer authorisation
- It does not decide who may watch. Do not assume live playback carries an authorisation rule of its own — who is entitled to view has to be designed on the page or embed the stream appears on, and verified there.
- What to verify for your own streamConfiguration-dependent
- Eligibility, the encryption setting on the specific stream, and your access rule are three separate checks. Confirm each one for the stream and plan you will actually use rather than inferring them from this page.
Questions
Encrypted HLS questions
Is my live stream encrypted?
It depends on the stream. HLS segment encryption is available for eligible live streams and plans, it is not applied to every stream, and it is not something you can switch on for a stream you have just created. Confirm it with us for the stream you will actually broadcast on before a sensitive event.
What does encryption actually protect against?
Interception and scraping. Segments captured from the network, or pulled from the manifest by a download manager, are ciphertext and will not open in a player without the key. That is the difference between a casual grab producing your video and producing an unusable file.
How should viewer access work alongside encryption?
Use encryption to protect the segment bytes, then apply the viewer entitlement on the page or embed where the stream appears. Verify both the stream encryption setting and that audience-access path before the event.
How should I plan for screen-capture risk?
Treat screen capture as a viewer-level risk and combine encrypted delivery with a controlled audience, event-specific access and clear participant terms. Encryption protects captured network segments; audience controls reduce who reaches the decoded playback shown on screen.
What about the recording of the broadcast?
Recording is opt-in and plan-gated. When it is enabled, each completed segment of the broadcast is uploaded as a separate video in your library, into an eligible project you choose in the same account and region. That is an upload, not an inheritance: check those videos’ on-demand availability and protection separately once the upload has finished.
Put this on your own pages, under your own rules
Tell us about the broadcast and we will confirm what is available for your stream and plan.