Disclosure: I work at TPStreams, a video hosting platform for course businesses. This post is about how the technology works, not about any one product.

If you sell video courses, sooner or later someone asks: "Can people download my videos?" The honest answer depends on how the video is delivered. Here's what each layer of protection actually does.

1. A private link isn't protection

Many setups hide the video from public listings and only allow embeds on your own domain. That stops casual link sharing, and it's worth doing. But if the browser can fetch the video file or the HLS segments directly, browser extensions and download tools can usually save them.

2. HLS with AES-128: better, but the key is reachable

Plain HLS encryption (AES-128) encrypts each segment, but the player has to fetch the key over HTTP to play the video. Anyone who can play the video can usually get the key too, so tools that understand HLS can decrypt and save it. Protecting the key URL with tokens raises the bar, but the key still ends up in the browser's memory.

3. DRM: the key never reaches your JavaScript

DRM (Google Widevine on Chrome, Android and many smart TVs; Apple FairPlay on Safari, iPhone, iPad and Apple TV) changes the model:

  1. Each video is encrypted with its own content key, which is stored on a license server, not next to the video.
  2. When a viewer presses play, the player asks the license server for a license. Your backend attaches a short-lived token proving that this user is allowed to watch.
  3. The license server checks the token and the device, then returns a license with the key and the playback rules (for example, maximum resolution).
  4. The device's DRM module decrypts the video inside a protected path. Your page's JavaScript never sees the key or the decrypted frames.

That's why ordinary download tools stop working. On devices with hardware-backed DRM (Widevine L1, FairPlay), screen-capture tools often record a black rectangle instead of the video.

4. Tokens: stop link sharing

Generate a short-lived token for every playback request on your server, after you've checked the user's login and purchase. Without a valid token, the license request fails. This is what stops people from pasting an embed code or stream URL into a Telegram group.

5. Watermarking: for what DRM can't stop

DRM can't stop someone pointing a phone at the screen, and software-only DRM (Widevine L3 on some desktop setups) is weaker against screen recording. A visible watermark with the viewer's name, email or user ID, placed differently for each session, doesn't prevent recording, but it makes leaked copies traceable. In practice, that deters most sharing.

A practical checklist

  • Low-priced or free content: domain-restricted embeds are often enough.
  • Paid courses, test prep, anything people resell: DRM (Widevine + FairPlay), per-playback tokens issued by your backend, and a per-viewer watermark.
  • Mobile apps: use the platform's native DRM SDKs (ExoPlayer/Media3 with Widevine on Android, AVPlayer with FairPlay on iOS) rather than a WebView.
  • Before you commit, test your provider's player on Chrome, Safari, an Android phone and an iPhone, and try a couple of common download extensions against it.

Providers that handle DRM, tokens and watermarking for you include VdoCipher, Gumlet, Bunny Stream and TPStreams. A longer write-up of how the license flow works is on the TPStreams blog.