PSSH is the standardised container (ISO/IEC 23001-7:2024 "Common Encryption", aka CENC) inside an MP4 file for DRM-system-specific information. Every DRM system has a unique 16-byte System ID — Widevine edef8ba9-79d6-4ace-a3c8-27dcd51d21ed, PlayReady 9a04f079-9840-4286-ab92-e65be0885f95, FairPlay 94ce86fb-07ff-4f43-adb8-93d2fa968ca2 — and the PSSH box's SystemID field tells the player which CDM should read its Data payload.
For multi-DRM delivery, a CMAF file typically carries multiple PSSH boxes — one per DRM system. The Widevine PSSH points at the Widevine license server; the PlayReady PSSH carries the WRMHEADER pointing at the PlayReady license server; the FairPlay PSSH points at the FPS key server. The player picks the PSSH matching its CDM, extracts the data, and uses it to construct the license request.
PSSH boxes appear in either the moov (init segment) or moof (fragment) of an MP4/CMAF file. Best practice in 2026 is to put all PSSH data in the init segment so it loads once at startup, not in every fragment. The mpd manifest also carries equivalent ContentProtection elements that mirror the PSSH content — players can use either, but the in-band PSSH wins when both are present.
The book · Volume 3 of 7
Video Streaming: A Complete Guide to Video Delivery: From ABR and CDNs to Players, WebRTC, DRM, and the Economics of Streaming
The PSSH box carries the DRM system data a player hands to the CDM, and a missing or mismatched PSSH is a common reason playback fails on one platform only. This volume covers DRM in detail, including PSSH and Common Encryption, Widevine, PlayReady and FairPlay, license flows and DRM inside web and native players. Written by Nikolay Sapunov, CEO at Fora Soft.
DRM playback failing on one platform because of PSSH or key ID mismatches?
Share a sample stream and your license setup and we will return a DRM audit covering PSSH boxes, key IDs and the player-side fixes for each failing platform. 250+ video products shipped since 2005.
