Widevine, FairPlay, and PlayReady in 2026: How the Three DRMs Actually Work
The DRM landscape explained for engineers — what EME and CDMs do, how license servers fit, and the real differences between Google's, Apple's, and Microsoft's content protection stacks.
Digital Rights Management is the layer of streaming that works precisely because nobody understands it. The user presses play; encryption keys fly between browser, license server, and CDM; and the video plays — all invisible. But when DRM fails, it fails hard: a licensing error is a black screen with a cryptic code and a paying customer who can’t watch.
The Three DRMs and Their Territories
| DRM | Vendor | Native Platform | Browser Coverage |
|---|---|---|---|
| Widevine | Android, Chrome | Chrome, Firefox, Edge, Android WebView | |
| FairPlay | Apple | iOS, macOS, tvOS | Safari only |
| PlayReady | Microsoft | Windows, Xbox | Edge, Windows apps |
A modern multi-platform video service runs all three — Widevine for Chrome/Android, FairPlay for Safari/Apple TV, and often PlayReady for Windows set-tops or Edge.
How EME and the License Flow Work
The browser’s Encrypted Media Extensions API is the contract. The player asks the CDM (Content Decryption Module) to prove it can decrypt; the CDM exchanges a license request with your server; your server returns a license containing the content keys.
[Player] ──EME request──> [CDM]
│ license request (challenge)
▼
[License Server]
│ validates session, returns keys
▼
[Player] <── license (key + policy) ──
│
▼ decrypts segments in hardware/CDM → decoded video
The CDM handles decryption in a sandboxed environment — the key never touches JavaScript, so the player can’t leak it to page scripts.
The License Server’s Real Job
A license server is not a key database — it’s a policy engine. The request it receives carries a session token; the response is a license with constraints embedded:
- Expiry — how long the key stays valid
- HDCP requirement — whether the output needs an encrypted display path
- Security level — software-only (L3) vs. hardware-backed (L1) decryption
- Renewal/renewal delay — how often the player must re-check in
“The three DRMs converge on the same architecture — a license server that vends keys under policy. The difference is which platforms each one reaches and how much of the decryption happens in hardware.”
Server-side license implementation, key rotation, and the session-binding patterns are in the DRM systems explained for engineers guide.