Encrypted media streaming (HLS AES-128)
An MP3 and an MP4, each cut into segments and AES-128 encrypted with ffmpeg. The encrypted segments sit on plain static hosting. The browser gets the decryption key only after a login check.
Audio (MP3 source)
Video (MP4 source)
Proof the stored files are useless without the key
- Raw audio segment (.ts) and raw video segment (.ts) — download and try VLC/QuickTime: encrypted noise.
- Static audio playlist — key URI has no token, players fail with 403.
- Key endpoint without token — 403.
- Playlist endpoint without token — 403.
What is happening
1. ffmpeg cut each source file into segments and encrypted them with AES-128 (one command per file).
2. Segments live on static hosting (Cloudflare Pages, free tier).
3. A small serverless endpoint returns the 16-byte key only when the login token is valid.
4. Desktop Chrome/Safari play via hls.js; iPhone Safari plays natively. Seeking works; the files never sit decrypted on disk.
Honest limit: this stops casual copying and makes leaked links useless. A determined user can still re-record output. Only hardware DRM (FairPlay/Widevine) is stronger, and that needs a paid DRM service and does not run inside Tapcart.