HLS Encryption: How to Encrypt Video Streams in AES-128 [2022 Update]

By Kevin Graham

17 Min Read

banner image featured
author avatar

Kevin Graham

Kevin is a content writer and former software developer. He focuses on producing compelling content for B2B software companies.

Table of Contents

    As piracy and hacking continue to increase each year, broadcasters should be concerned with securing their video content. That’s because the U.S. Chamber of Commerce estimated $29.2 billion of lost revenue from piracy.That lost revenue isn’t just from feature films and television; it is from online content as well. 

    Data breaches, unauthorized video sharing, and hacks, therefore, can be a substantial cost for many companies. That’s why protecting video content and securely delivering streams to users should be a broadcasting best practice.

    First, we’ll cover what video encryption is and why it matters. Then we’ll dive into the HLS streaming protocol and how AES-128 encryption works. Finally, we’ll look at the key features necessary for a secure cloud video platform.

    Table of Contents:

    • What is Video Encryption?
    • Why Does Protecting Video Content Matter?
    • The HLS Protocol
    • HLS Encryption Explained
    • 4 Key Features of Secure Video Clouds
    • Dacast Video Platform
    • Conclusion

    What is Video Encryption?

    what is video encryption
    Encryption helps hide sensitive data from unauthorized users.

    Encryption is a method for masking data so that only authorized users can decrypt and access a file. It’s a part of cryptography, which is a field of study devoted to the secure communication of information or data.

    Over the years, a multitude of encryption algorithms has been developed with varying levels of security. Most algorithms, however, scramble the data into what’s called ciphertext and require the receiving party to use a key to reassemble the data back into plaintext.

    Can You Encrypt Video?

    While it’s straightforward to understand the encryption of text documents, how exactly does video stream encryption work?

    Video encryption allows broadcasters to scramble their video content using a secure algorithm and transmit the data to viewers. Authorized viewers can then decode the video and watch it. That is how encrypted streaming works. 

    Many broadcasters encrypt not only stored video content, but also streaming video to prevent unauthorized third parties from accessing the content in transit. That way, someone can’t private their live stream and show it elsewhere. With encrypted streaming, broadcasters can protect the revenue streams they have set up for their live streaming.

    Why Does Protecting Video Content Matter?

    Broadcasters usually have one or more reasons for protecting videos, from keeping sensitive information safe to implementing digital rights management or ensuring proper monetization of content.

    • Sensitive Information: Many organizations use video streams for internal meetings and events that shouldn’t be available to the public. If these videos aren’t protected, the company could risk violating industry regulations or leaking information to competitors.
    • Digital Rights Management: Video stream encryption is a critical aspect of digital rights management (DRM), which broadcasters require for a variety of reasons. For example, geographical regions—such as the People’s Republic of China (PRC)—may have specific regulations or censorship limiting who can view certain types of content. 
    • Monetization: Brands may have video streams at various price points that need access controls as well, such as charging more for high-definition videos or ad-free content. The ability to safely accept payment from viewers and ensure video content isn’t pirated are both crucial for monetization.

    Encrypted streaming helps protect sensitive information, monetization potential, and digital rights management for broadcasters. 

    The HLS Streaming Protocol

    encrypted hls
    Most of today’s broadcasters use the HLS protocol to encrypt streaming videos.

    Video streaming requires sending enormous amounts of data to viewers. RAW video files are too large, so broadcasters must encode videos into a compressed format using a codec like H.264 advanced video coding to reduce the file size.

    A video stream also requires choosing a container format, which encompasses the necessary video, audio, and metadata. Most broadcasters choose the MP4 format because it’s compatible with a wide range of devices.

    Finally, broadcasters need to choose a self-hosted video delivery method or private hosting. Two of the most common are the HLS streaming protocol and RTMP. These are standardized methods for transmitting video and audio data over the Internet as a continuous stream rather than a single file download. That is why HLS encryption is the most common method of encrypting streaming videos. 

    What is HLS Streaming?

    HTTP Live Streaming (HLS) is a protocol that splits video streams into chunks that are transferred and reassembled within the user’s video player. In most cases, the video player is an HTML5 or Video.js player that offers playback natively in the user’s web browser.

    Pure HTML5 playback without a streaming protocol requires downloading the entire video file during initiation. That’s why it’s crucial to break down videos into smaller files so that playback can start faster and there’s less wasted data. 

    In contrast to RTMP, the HLS protocol leverages HTTP to transfer video content in chunks to viewers. That means broadcasters can use a standard server or video content delivery network (CDN) to store and deliver video content. With HLS streaming, broadcasters can scale their streams to reach a much larger audience without compromising on quality.

    HLS streaming is used by most broadcasters because it’s the protocol supported by HTML5 players. These video players—which are built into web browsers—have become the default playback method rather than Flash. HLS streams, therefore, are supported by nearly every device from tablets to laptops and smart TVs.

    What is Adaptive Bitrate Streaming?

    Moreover, HLS is an adaptive bitrate streaming (ABR) protocol. That means broadcasters offer multiple variants of a particular stream at different bitrates or levels of quality.

    These separate streams are split into 2 to 10-second segments and indexed in a manifest file. Then an adaptive video player can use the manifest file to choose the optimum video segment based on network conditions and the user’s device.

    ABR streaming is crucial for broadcasters that want to offer the best viewing experience possible for their viewers.

    HLS Encryption Explained

    hls aes encryption
    AES is the most common way to encrypt HLS streams.

    While there are many types of encryption algorithms, the most commonly used method for HLS is AES-128. Advanced Encryption Standard (AES) is a block cipher that encrypts and decrypts data in 128-bit blocks. Here are the basics of how AES-128 works. Here are the basics of how HLS AES-128 decryption works

    How Does AES 128 Encryption Work?

    The first block is encrypted using an initialization vector (IV)—or 16-byte random value—and the next block uses this to start the encryption process. Each subsequent block uses ciphertext from the preceding block for encryption in a method known as cipher block chaining (CBC).

    As AES is a symmetric key algorithm, there needs to be a secret key that’s used for both encryption and decryption. That means the broadcaster encrypts the video using the key and the viewer’s browser decrypts it using the same key.

    AES has seen widespread adoption because it’s straightforward to implement and safe enough for general use. The U.S. Government even uses the algorithm for encrypting sensitive data, and it’s the way most digital rights management (DRM) systems protect media. HLS AES 128 encryption is easy to implement, and therefore commonly used. 

    HLS Encryption Methods

    While the HLS supports AES-128 encryption, there are two different ways to implement the standard in practice.

    Broadcasters can use one key to encrypt the entire video stream, but that also means the whole stream is unprotected if the secret key is intercepted by an unauthorized third party.

    Alternatively, each segment of a stream can be encrypted with a different key. That way, only a few seconds of video can be accessed with each specific key. Broadcasters might choose this method if the video content their sharing is highly sensitive.

    4 Key Features of Secure Video Clouds

    aes video encryption
    Cloud video security features include AES encryption, geographic and referrer restrictions, and payment security. Source: medium.com

    Many companies use a secure video platform to host their video content and share it with their intended audience. Here are four security features to look for in a private video hosting platform.

    1. AES Encryption

    When it comes to AES video encryption, there is often a debate over which key length to use for AES: 128-bit or 256-bit. In general, a larger key is harder to compromise with a brute force attack, but a simple calculation shows that even a 128-bit key would take far too long to crack.

    That’s why the ability to protect the secret key from unwanted third parties is far more critical than the key size. As long as the cloud platform uses at least AES-128 encryptions, the videos should be safe from brute force attacks.

    Larger key sizes also require more computing power, but most modern devices can handle decrypting AES-256 without performance issues. Be sure to consider your target audience and the quality of devices they’ll use for streaming before choosing an encryption algorithm for your content.

    2. Manifest File

    The HLS manifest file—or M3U8 playlist—is necessary for video players to select and retrieve the right video segments for ABR streaming. In addition, the M3U8 manifest file contains the secret encryption key for each video segment. 

    If there’s an overall AES key being used, it will appear in the manifest file as a link after the EXT-X-KEY tag. This file should be served over HTTPS and require authentication to minimize the risk of this key being exposed to eavesdroppers.

    Many streaming platforms rotate these AES keys at regular intervals, so there’s a lower chance that they get compromised during streams. In general, the more frequently keys are rotated or refreshed, the more secure the video content will be.

    3. HTTPS Delivery

    HTTPS is a way of transferring data using HTTP (Hyper-Text Transfer Protocol) that’s secured using Secure Sockets Layer (SSL). SSL was later renamed to transport layer security (TLS), but the end goal is the same: to prevent hackers from intercepting data in transit.

    With HTTPS, a server is secured using an SSL certificate that’s issued by a certificate authority (CA). When users connect to a server with a valid certificate, data transferred between the two parties will automatically be encrypted.

    When using AES encryption with HLS streaming, it’s crucial to exchange the secret keys over HTTPS. That way, broadcasters can prevent man-in-the-middle attacks, where hackers intercept sensitive data—such as AES keys—while it’s being exchanged between two parties.

    4. Password Protection

    While many broadcasters focus on encryption, password-protected video streaming is just as important. The most common way to protect video content is by using passwords to restrict who has access to a particular piece of content. Password protection is a simple and powerful way to limit video viewership to internal employees, specific clients, or other smaller audiences. 

    That said, it’s a good idea to generate a secure password, change them out periodically, and follow other password protection best practices. Otherwise, the password can get leaked online, and unwanted viewers could gain access to the content.

    Dacast’s Secure Video Platform

    secure video platform
    Dacast’s Video Streaming Software is the leading Online Video and Hosting Platform, which utilizes HLS encryption for secure video delivery worldwide.

    Dacast is a secure video streaming solution that supports HLS encryption for video on demand (VOD) content. That means broadcasters can deliver video content to their audience with AES-128 encryption taking place behind the scenes.

    Moreover, Dacast relies on HTTPS to deliver video streams to viewers to prevent man-in-the-middle attacks and keep their financial information safe. This is critical for broadcasters that want to monetize their videos using the platform’s secure paywall capabilities.

    Beyond HLS encryption and HTTPS, Dacast encourages broadcasters to utilize password protection for hosting their video content. Within the Dacast platform, it’s straightforward to add passwords to live streams, VOD content, or entire playlists.

    Along with securing and protecting the video streams themselves, Dacast allows broadcasters to set geographic and referrer restrictions. Geographic restrictions can help prevent piracy by blacklisting certain countries where malicious actors often operate. 

    Similarly, referrer restrictions allow broadcasters to block well-known piracy sites or competitors from resharing video content. An HTTP referrer is metadata that identifies a website that has linked to a particular video.

    Finally, Dacast offers a secure video upload feature for adding video content to the secure video hosting platform. That way, users can safely upload files in bulk or migrate an entire collection of video content with ease, keeping videos safe during the upload process as well. 

    Here are more details on the many features of the Dacast platform and our commitment to video security.

    Basic Functionality

    If you’re looking for advanced security, monetization, and distribution tools, Dacast is a great choice.

    Key Features




    • Professional features may require some time to learn

    Technical Specifications

    • Minimum dimension: None (but 240p is the recommended minimum)
    • Maximum dimension: 1080p or 4K (depends on the user’s hardware and internet)
    • Supported aspect ratios: No restrictions (but 16:9 is the default)
    • Maximum file size: Unlimited, though larger file sizes can impact viewer experience
    • Maximum video length:
    • Total file storage: 10 to 1,000 GB depending on the plan
    • Accepted video formats: MP4 (preferred), .MOV, M4V, M2V, .AVI, MPG, .FLV, .WMV, .MKV, WebM, OGV, MXF, ASF, VOB, MTS


    Dacast offers multiple pricing plans geared toward all business budgets. Here is an overview:

    • Starter Plan: $39/month (includes 1,000 GB of bandwidth & 50 GB of storage)
    • Event Plan: $63/month (includes 6 TB of bandwidth upfront and 50 GB of storage)
    • Scale Plan: $188/month (includes 24 TB of bandwidth per year and 1 TB of storage)

    Broadcasters can contact Dacast directly to learn more about custom-priced high-volume plans.

    Best Use Cases

    Dacast’s live streaming platform is great for:


    hls video encryption
    HLS video encryption is essential to delivering your video content securely to only the desired audience.

    Video content is invaluable for most brands, but if data gets into the wrong hands, it can be devastating. That’s why it should be the priority of every broadcaster to offer secure stream services and store video content safely using a reliable video streaming solution. Both HLS video encryption and M3U* encrypted players are two secure methods for keeping content safe.

    Dacast is a unified streaming solution that makes the annual list of the most important, most innovative, and most interesting companies for 2021 Streaming Media Magazine’s Top 50 List.

    With the company’s commitment to offering a robust and secure streaming video platform for its users, this powerful platform helps companies around the world scale and monetize their online video content.

    At Dacast, we’re confident that the solution is ideal for broadcasters that need a secure online video platform (OVP) for their live streaming and VOD needs. That’s why we offer a risk-free trial for 14-day. Try Dacast out and see if it fits your needs for secure video delivery.


    For regular live streaming tips, as well as exclusive offers, we invite you to join our LinkedIn group.

    author avatar

    Kevin Graham

    Kevin is a content writer and former software developer. He focuses on producing compelling content for B2B software companies.

    Sign up for a 14-Day trial.

    Read Next

    article featured

    How to Troubleshoot Live Streaming Issues [2022 Update]

    author avatar

    Kevin Graham

    16 Min Read

    article featured

    Password Protected Video Hosting – What You Need to Know in 2022

    author avatar

    Harmonie Duhamel

    17 Min Read

    article featured

    The Definitive Guide to Online Video Hosting Pricing and Costs in 2021

    author avatar

    Emily Krings

    44 Min Read