DRM, watermark or signed URLs: what protects a course
What DRM really blocks, what signed URLs do and what a watermark proves: an honest comparison for people who sell online courses, with the limits of each.
People who sell an online course are often told “put it behind DRM and you're done”. It isn't true, and the vendors who sell DRM don't say so either. This guide compares three tools, says what they really do and where they stop, using the specifications and documentation we could read.
For the context (Telegram, copyright law) we point to our guide to video course piracy; here we stay on the technology.
What does DRM do, and what doesn't it?
DRM encrypts the content and lets only an authorized player decrypt it. The W3C makes clear that its Encrypted Media Extensions specification “does not define a content protection or Digital Rights Management system”: it defines a common interface to use one, and the strength of protection depends on the decryption module and the key system.
That comes from the working draft of 13 October 2026, which also notes that only the Clear Key system is mandatory to implement (W3C). Google Widevine, one of the most widespread systems, requires a licence agreement with no access fee, adopts EME and common encryption, and issues a licence individualized to the requesting device (Google). In the documentation we could read we found no description of Widevine's security levels, so we do not describe them.
What it does not do: it does not stop filming the screen with another camera and it does not tie a copy to a person. These are limits of any system that works on the file and not on the physical environment.
What does Apple's FairPlay block?
Apple documents that with FairPlay Streaming the video is not captured by iOS 11 screen recording or by QuickTime on macOS: the playing portion is blacked out. The same page states the protection covers the video part and not the audio.
It is a technical note from 2017, archived, so it does not describe the newest systems. The page also offers a way to detect recording, the UIScreen.isCaptured property, and suggests pausing the video and warning the user. It says nothing about filming with an outside camera (Apple). On non-Apple systems the behaviour depends on the player and the device.
What are signed URLs?
A signed URL is an address with an expiry and other restrictions, checked when the request arrives. With Amazon's CloudFront, for example, the expiry can be a few minutes or years and an optional setting can limit access to an IP address.
The CloudFront documentation describes two policies: a “canned” one, with only an expiry and not reusable across files, and a custom one, with wildcards, a start time and an IP restriction. It also explains that the app must check who is entitled (has paid, is signed in) before issuing the URL (AWS). The page does not say the URL is tied to a user: only the IP restriction ties it to a client, and it is optional. In practice a signed URL protects against the permanent link, but whoever has it during its validity can use or share it.
What does a watermark prove?
A watermark links a copy to an account, if the code stays legible. It does not prevent copying or filming the screen. A visible watermark deters but can be cropped or covered; a forensic one is invisible and needs tools and usually a vendor.
The vendor pages we read, Kinescope and Verimatrix, agree on this split and offer no independent tests of effectiveness. How it works in detail, and what you can read in a leaked copy, we explain in Per-student watermarks for video courses. The main limit is the same: an account is not a person, because it may have been lent.
How do the three tools compare?
Each covers a different threat and none covers all of them. DRM protects the file and, on some systems, stops software screen capture; signed URLs limit how long a link lasts; a watermark lets you attribute a copy.
| DRM | Signed URLs | Watermark | |
|---|---|---|---|
| Downloading the file as it is | Yes | Partly | No |
| Sharing a permanent link | Partly | Partly | No |
| Capturing the screen with software | Partly | No | No |
| Filming the screen with another camera | No | No | No |
| Linking a copy to an account | No | No | Partly |
A qualitative comparison by the editors, not a measurement. “Partly” depends on system and configuration: for signed URLs protection lasts only while the link is valid; for the watermark it works only if the code stays legible.
This table extends the one in the piracy guide and adds signed URLs. To see how to combine them for your situation, read Account sharing in video courses.
How do you choose, on a small budget or a large one?
On a small budget start with measures that are cheap and informative: links that expire, a device limit and a per-student watermark. DRM makes sense when the course is your main product and is worth hundreds, because it adds cost and integration complexity.
A reasonable sequence: (1) host the videos so the link is not permanent, (2) limit devices per account, (3) show a personal code and keep a session log, (4) consider DRM if the value of the course and your tolerance for risk justify it. Whoever sells you protection should be able to answer five questions in writing: what exactly it blocks, on which systems, what it does not block, what each tier costs and what happens to your videos if you change vendor.
Key terms. DRM is an encryption system that lets only an authorized player play content. A signed URL is an address with an expiry and other restrictions checked at request time. A watermark is a mark, visible or invisible, that identifies the origin of a copy.
How we checked this. We read the W3C draft of October 2026 and found that the specification does not define a DRM system. We read Apple's note and found that FairPlay's protection covers only the video. We found no description of Widevine's security levels and no MovieLabs specification, and we say so. Contact: hi@heytea.app. Editorial note: we fact-check every figure against the sources listed below and correct mistakes openly.
Frequently asked questions
Is DRM enough to protect an online course?
No. DRM encrypts the video and lets only an authorized player decode the stream, but it does not stop anyone from filming the screen with another camera. On Apple systems with FairPlay Streaming the video is not captured by screen recording, but Apple states that the protection covers the video part and says nothing about filming with a camera. It must be paired with other measures.
What is a signed URL and what does it protect?
A signed URL is an address that includes an expiry and other restrictions, checked when the request arrives. CloudFront, for example, allows expiries from a few minutes to years and, optionally, an IP address limit. It protects against the permanent link, but while it is valid whoever holds it can use or share it: by itself it does not tie it to a user.
Do watermarks and DRM do the same thing?
No: they solve different problems. DRM tries to prevent access to the file and some captures; a watermark prevents nothing but lets you link a copy to an account, if the code stays legible. Neither stops someone filming the screen with another camera.
What does the web standard say about DRM?
The W3C, in the Encrypted Media Extensions specification, says it does not define a content protection or rights management system: it defines a common interface to use them. The strength of protection depends on the decryption module and the key system used, not on the specification. Only the Clear Key system is mandatory to implement.
Which protection suits a creator with a small budget?
Start with what is cheap and informative: links that expire, a device limit and a per-student watermark to see where a copy came from. DRM adds cost and complexity that make sense when the course is your main product and is worth hundreds. No combination removes copying altogether.
Sources
- W3C, “Encrypted Media Extensions”, working draft of 13 October 2026. Read on 16 October 2026. w3.org
- Apple, QA1970, “Responding to screen capture in iOS 11”, 25 October 2017 (archive). Read on 16 October 2026. developer.apple.com
- Amazon Web Services, CloudFront, “Use signed URLs”, developer guide (undated). Read on 16 October 2026. docs.aws.amazon.com
- Google, Widevine DRM, overview (updated 9 October 2024). Read on 16 October 2026. developers.google.com
- Kinescope and Verimatrix, pages on visible and forensic watermarking. Vendor sources, with no independent tests. kinescope.com