Widevine vs FairPlay vs PlayReady: Which DRM Should Your OTT App Use?
Every founder planning an OTT app eventually asks the same question: Widevine, FairPlay or PlayReady? Here is the answer nobody leads with: you don’t pick one — your users’ devices pick for you. Safari and every iPhone will only play FairPlay. Chrome and Android only speak Widevine. Xbox and a large share of older smart […]
Every founder planning an OTT app eventually asks the same question: Widevine, FairPlay or PlayReady? Here is the answer nobody leads with: you don’t pick one — your users’ devices pick for you. Safari and every iPhone will only play FairPlay. Chrome and Android only speak Widevine. Xbox and a large share of older smart TVs answer to PlayReady. The real decisions are which DRM to launch with, how to package your video so one encode serves all three, whether to buy or build licence delivery, and what each path costs.
At Triple Minds we build streaming products end to end — from vertical drama apps to full OTT platforms — and DRM is where we see founders lose the most time and money to stale blog advice. This guide is built from the official Google, Apple and Microsoft documentation plus live vendor price lists, all checked in October 2026.
Key Takeaways
- No single DRM covers the market: Widevine owns Android and Chrome, FairPlay owns every Apple surface, PlayReady owns Xbox, Windows hardware playback and many legacy smart TVs.
- The DRM technologies themselves are effectively free — what you pay for is licence delivery: multi-DRM services start around $100–$300/month and scale to roughly $1,500–$5,000/month at 100k monthly users.
- Encrypt once with CMAF + CENC in cbcs mode and one set of files serves all three DRMs — the main holdouts are Android older than 7.1 and pre-2018 smart TVs.
- Security levels, not the DRM logo, decide your resolution: hardware tiers (Widevine L1, PlayReady SL3000, FairPlay) unlock 1080p–4K for studio content; software tiers get capped.
- Two deadlines founders keep missing: Apple’s FairPlay production credentials take 2+ weeks of manual approval, and Google retires its free Widevine cloud licence service on April 13, 2027.
What DRM Actually Does (and Why AES-128 Isn’t It)
A surprising number of streaming apps ship with plain HLS AES-128 encryption and call it DRM. It isn’t. With AES-128, the decryption key is delivered to the player in readable form — it is visible in the browser’s network tab, the key URI sits right in the playlist, and tools like yt-dlp rip such streams trivially. Tokenising the key URL is access control, not content protection.
Real DRM does two things AES-128 cannot. First, keys are handled inside a Content Decryption Module (CDM) — on hardware-secure devices, inside a trusted execution environment — so neither your app nor the user ever sees them. Second, every licence carries enforceable policy: expiry and rental windows, device binding, offline-download limits, concurrency rules and HDCP output control. That policy layer is also why studios care: there is no studio-approved path to streaming licensed 4K content without certified DRM, and hardware-level DRM is typically a contractual precondition for HD and above.
If your catalogue is user-generated or promotional, signed URLs are fine. The moment you charge for content — or license anyone else’s — you need the real thing.
How Multi-DRM Actually Works
The good news: supporting three DRMs does not mean three copies of your library. The industry has converged on CMAF packaging with MPEG Common Encryption (CENC). You encode your ABR ladder once, encrypt it once in cbcs mode (the AES-CBC pattern scheme FairPlay mandates and modern Widevine and PlayReady clients accept), then publish HLS and DASH manifests over the same segments. Only the licence hand-off differs per ecosystem:
Multi-DRM architecture: package and encrypt once, then serve Widevine, FairPlay and PlayReady licences from the same backend.
Playback follows the W3C Encrypted Media Extensions flow: the player detects encrypted media, the CDM generates an opaque licence challenge, your app posts that challenge to the licence server along with its own auth token, the server checks entitlement and returns a licence carrying policy, and the CDM decrypts inside its sandbox. Note what that implies: subscriber authentication and entitlement are entirely your app’s job — DRM has no idea who your customers are.
One packaging caveat before you go cbcs-only: per Google’s ExoPlayer documentation, Widevine cbcs needs Android 7.1 (API 25) or newer; PlayReady added cbcs in version 4.0 (October 2017) and even then it is optional per client, so pre-2018 smart TVs and set-top boxes are often cenc-only. If legacy TV fleets matter to you, packaging vendors commonly recommend dual-packaging (cenc DASH + cbcs HLS) — which roughly doubles packaging and storage. Mobile-and-web-first apps can skip that entirely.
Widevine vs FairPlay vs PlayReady: The Coverage Map
| Surface | Widevine (Google) | FairPlay (Apple) | PlayReady (Microsoft) |
|---|---|---|---|
| Android phones / tablets / Android TV | Yes (L1 on certified devices) | No | Only via your own licensed client |
| iPhone / iPad / Apple TV | No | Yes (only option) | No |
| Safari (macOS / iOS) | No | Yes (only option) | No |
| Chrome / Firefox / Opera | Yes (software L3 by default) | No | Firefox on Windows since v132 (select services) |
| Edge on Windows | Yes | No | Yes (incl. hardware SL3000) |
| Xbox | No | No | Yes (built in, SL3000) |
| Samsung / LG smart TVs | Yes (recent models) | No | Yes (incl. most pre-2018 models) |
| Roku / Fire TV / Chromecast | Yes | No | Roku & Fire TV also support it |
Widevine — the volume workhorse
Google’s official platform list covers Android (mobile, TV, automotive), ChromeOS, Chromecast, Tizen and webOS smart TVs, Roku and Fire TV — and explicitly excludes Apple TV, desktop Safari, Xbox and Nintendo Switch. With Chrome at roughly 70% of desktop browsing (StatCounter, mid-2026) and Android at about two-thirds of global mobile usage, Widevine alone reaches more consumers than the other two combined. Google licenses it royalty-free, and its hosted Cloud License Service costs nothing — but comes with no SLA and no emergency support, and Google is retiring it on April 13, 2027, after which you must self-host or use a certified provider. The much-cited CWIP certification (three-day training, 90% exam, annual fees) only applies if you operate Widevine infrastructure for other companies — not to running your own service.
FairPlay — mandatory for every Apple screen
Apple permits no other DRM on its platforms, so the moment your audience includes Safari, iPhone, iPad or Apple TV, FairPlay stops being a choice. The streaming SDK is bundled with the $99/year Apple Developer Program — but there is a gate founders discover too late: production deployment credentials require Apple’s manual approval. The application must come from the Account Holder of your own developer account, Apple approves only teams operating a consumer streaming service, requests filed by agencies on a client’s behalf are refused, and vendors routinely report two or more weeks of waiting. Apply on day one of your build. The other hidden cost is engineering: FairPlay requires a Key Security Module implemented server-side from Apple’s spec, which is precisely what multi-DRM vendors sell so you don’t have to build it. In return you get the strongest consumer-side enforcement of the three — screen recordings of FairPlay content come out black, and protection survives AirPlay to Apple TV.
PlayReady — the living room and the Windows hardware path
PlayReady’s consumer surface looks smallest — until you count the living room. It is built into Edge and Xbox (no licence needed on either, per Microsoft’s licensing pages), ships in a very large installed base of Samsung, LG and other smart TVs where the TV maker, not you, pays the client royalty, and owns the strongest Windows story: SL3000 hardware DRM in Edge, now reaching Chrome on Windows 11 in recent releases. Microsoft’s own licensing FAQ states the PlayReady Server Agreement carries no fees; client royalties only apply if you ship your own PlayReady client inside your app. Ignore the “$0.35 per device” figure that circulates in older blog posts — it appears on no current Microsoft page, and actual fees are disclosed only inside Microsoft’s sample agreements.
Security Levels Decide Your Resolution, Not the Logo
Here is the nuance that generates the most confused support tickets: the same DRM is strong on one device and weak on another. Security level is a device property. Widevine runs as hardware-backed L1 on a certified phone and as software-only L3 on desktop Chrome or a rooted handset; PlayReady spans software SL2000 to hardware SL3000; FairPlay rides Apple’s hardware security on every modern Apple device.
| Tier | Widevine | PlayReady | FairPlay | Studio content typically allowed |
|---|---|---|---|---|
| Hardware (TEE) | L1 | SL3000 | All modern Apple devices | 1080p–4K HDR |
| Software | L3 (desktop Chrome/Firefox) | SL2000 | — | Widely reported caps around 480–720p |
| Dev/test only | — | SL150 | — | Never commercial content |
Want live proof? Netflix’s own browser support table streams 4K only where hardware DRM exists — Edge and Chrome 117+ on capable Windows 11 PCs with HDCP 2.2 end to end, and Safari on macOS 11+ — while Firefox tops out at 1080p and Edge on a Mac at 720p. The hardware bar is real: a 7th-gen Intel or AMD Ryzen CPU, a GTX 1050-class or newer GPU and HDCP 2.2 on every connected display, which a large share of real-world PCs still fail, falling back to software DRM and 1080p.
Two consequences for your build. First, your licence policy must map security level to maximum resolution and your player must cap rendition selection to match — if the licence server refuses HD keys to an L3 client and the player still requests HD, users get a hard playback error instead of a lower-quality stream. Second, if you own your content, these caps are your policy choice, not a mandate: the L1-for-HD rule comes from Hollywood licensing contracts, so a short-drama, fitness or education app with original content can happily serve 1080p to L3 devices for maximum reach and tighten policy later — policy lives in the licence server, not in the files.
What DRM Really Costs in 2026
The three DRM technologies cost a startup almost nothing: Widevine is royalty-free, FairPlay comes with the $99/year developer program, and PlayReady’s server agreement is fee-free with client royalties paid by device makers. What you actually buy is licence delivery — a multi-DRM service that runs certified Widevine, FairPlay and PlayReady servers behind one API. Verified list prices as of October 2026 (confirm with vendors before budgeting):
| Service | Entry price | Included | Scaling model |
|---|---|---|---|
| EZDRM Universal Complete | $299.99/mo + $199.99 setup | All 4 DRMs (incl. WisePlay), 20k licences or 2k users | Volume quotes above included tier |
| EZDRM single DRM | $99.99/mo + $99.99 setup | One DRM, 10k licences | Per-licence, quote-based volume |
| DoveRunner (ex-PallyCon) | $299/mo | Up to 1,000 MAU | Tiered per-MAU: ≈$539 at 5k, ≈$4,400 at 100k MAU |
| Axinom DRM | €199/mo pay-as-you-go | 100k licences or 2k MAU | Zero-usage months free; quotes at scale |
| DRM.cloud | $250/mo | 10k licences | Committed tiers: $1,450/mo for 500k licences |
| BuyDRM / Verimatrix / VUDRM | Quote only | — | Contract pricing |
The billing-model trap matters more than the vendor. Per-licence and per-MAU plans can differ five- to ten-fold for the same audience. A binge-watcher who triggers 40 licence requests a month costs 40× on per-licence billing and 1× on MAU billing; live streams with short licence durations and key rotation multiply licence counts further. Conversely, a catalogue encrypted under a single key makes per-licence billing nearly free. Pick the meter that matches your content shape.
The rest of the stack can be free: Shaka Player (web), ExoPlayer/Media3 (Android) and AVPlayer (iOS/tvOS) handle all three DRMs between them at zero licence cost, and Shaka Packager encrypts and packages for all three for the price of your own compute. Commercial players are the quiet budget killer — Bitmovin meters per impression after a free tier, THEOplayer (now Dolby OptiView) is quote-only, and JW Player’s DRM tier sits in enterprise contracts that transaction-data site Vendr pegs at a ~$12,000/year median. On AWS, MediaConvert requires its Professional tier for DRM (roughly 2× the Basic rate; about $0.024 per HD output minute at 30fps) and you still bring your own multi-DRM key provider via SPEKE.
Put together, a realistic year-one DRM budget is roughly $1,500–$8,000 (SaaS fees, Apple membership, free players, 2–6 developer-weeks of integration), growing to $1,500–$5,000/month around 100k monthly users, plus optional 24/7 SLA support ($440–$3,000+/month across vendors). On the scale of a full streaming build — see our breakdown of the cost to build a vertical drama app — DRM is a single-digit percentage that protects everything else you paid for.
Which DRM Is Best for Whom: The Decision Framework
- Android-first or emerging-market MVP: Widevine alone is defensible — it covers all of Android plus roughly 85% of desktop browsing, and markets like India are ~93% Android. Add the rest when traction justifies it.
- Any meaningful US or Apple audience: FairPlay is non-negotiable — iOS holds about 61% of US mobile usage — and the two-week credential approval belongs on your day-one checklist.
- Web-first services: Widevine + FairPlay covers effectively every browser. Contrary to a popular myth, you do not need PlayReady for Edge — Edge also ships Widevine; PlayReady only becomes necessary for hardware-secure 4K on Windows.
- Smart-TV reach, Xbox, or licensed studio/sports content: all three DRMs via a multi-DRM service, hardware-tier policies, and often forensic watermarking on top — studio contracts will spell out the requirements.
- Original-content apps (short drama, courses, fitness): the cheapest universal plan is enough, and you can serve HD to software-tier devices because the caps are your own policy. If that’s your lane, our teardowns of short drama monetization and the DramaBox-style white-label build cover the business side.
- Live events: choose MAU billing (licence renewals during long streams explode per-licence bills) and do not run a paid live event on Google’s free no-SLA licence service — if it blips mid-event, nobody owes you an answer.
Five DRM Mistakes We See Founders Make
- Calling AES-128 or ClearKey “DRM”. Both hand the key to the client in readable form; they stop casual downloaders only, and studios will not accept them.
- Promising investors DRM stops screen recording. Hardware paths (Android L1, iOS, Edge SL3000) black-screen recorders, but desktop Chrome and Firefox run software CDMs that OBS can capture. For leak tracing, pair DRM with session watermarking.
- Shipping offline downloads that silently fail. Persistent licences must be enabled in the licence-server policy and supported in the player SDK; miss either end and downloads refuse to play.
- Ignoring HDCP in support planning. 4K requires HDCP 2.2 on every HDMI hop; one old AV receiver downgrades the stream or throws an error, and the resulting tickets will land on you, not the DRM vendor.
- Trusting device capability on paper. Android handsets can drop from L1 to L3 after bootloader unlocks or bad OEM updates, TV capability reporting is notoriously unreliable, and Widevine retires old CDM versions roughly annually — query security levels at runtime and test on real devices.
How Triple Minds Wires DRM into Your OTT App
DRM touches every layer of a streaming product, which is why we treat it as architecture, not a plugin. On a typical engagement our team sets up the CMAF/cbcs packaging pipeline (or dual packaging where legacy TVs demand it), selects the multi-DRM vendor whose billing model fits your content shape, walks you through Apple’s FairPlay credential approval, integrates Shaka Player, Media3 and AVPlayer across web, Android and iOS, and encodes your resolution-per-security-level policy so premium content stays protected without hard playback errors. The same crew builds the rest of the app around it — from mobile app development to live-streaming products like our BIGO Live-style white-label platform — so protection, playback and monetization are designed together rather than bolted on.
Frequently Asked Questions
Can I launch an OTT app with just one DRM?
Only in narrow cases. An Android-first or emerging-market MVP can launch on Widevine alone, and an Apple-only app on FairPlay alone. But Safari and iOS play nothing except FairPlay, Chrome and Android play nothing except Widevine, and Xbox plus many older smart TVs need PlayReady — so any app chasing the full device market ends up running all three through a multi-DRM service.
How much does multi-DRM cost for a streaming startup?
As of October 2026, entry plans run $100–$300 per month (EZDRM from $99.99, DoveRunner $299, Axinom €199, DRM.cloud $250), plus Apple’s $99/year developer program. Players and packaging can be free (Shaka Player, Media3/ExoPlayer, AVPlayer, Shaka Packager). A realistic year-one budget is roughly $1,500–$8,000 including integration effort, growing to about $1,500–$5,000 per month around 100,000 monthly users.
Is Widevine really free?
The technology is royalty-free and Google’s hosted Cloud License Service costs nothing — but it carries no SLA and no emergency support, and Google is retiring it on April 13, 2027. Production services pay a certified multi-DRM provider for licence delivery, or self-host with Google’s licence server SDK. The CWIP certification fees only apply to companies operating Widevine infrastructure for third parties.
Why does 4K content play at 1080p or lower in some browsers?
Because resolution is gated by the device’s DRM security level, not your encode. Desktop Chrome and Firefox run software-only Widevine L3, which studio policies cap at lower resolutions; hardware paths — PlayReady SL3000 in Edge, Chrome 117+ on capable Windows 11 PCs, FairPlay in Safari — unlock 4K. Netflix’s own browser support table demonstrates exactly this split, and HDCP 2.2 is additionally required on every connected display.
Does DRM stop screen recording?
On hardware-secure paths, largely yes: Android Widevine L1, iOS/Safari FairPlay and Edge’s PlayReady SL3000 typically produce a black screen in capture tools. On desktop Chrome and Firefox, no — their software CDMs can be captured by OBS or OS recorders. No web-only service fully blocks desktop recording, which is why premium services add forensic or session watermarking to trace leaks.
Do I need DRM if I own all my content?
No studio can force you, so it becomes a business decision. DRM still deters ripping, enables rental windows, offline limits, device binding and concurrency control, and keeps the door open to licensing premium content later. A common path for original-content apps: launch with a low-cost universal multi-DRM plan, allow HD on software-tier devices for reach, and tighten policy later — policy lives in the licence server, so no repackaging is needed.
Got a project in mind? Let’s build it together.
We work with founders and product teams across consulting, development, and growth marketing. Tell us what you’re building and we’ll show you how we’d ship it.