The Whatplay browser: how it detects videos and why DRM won’t play

4 min read

Whatplay includes a full web browser, with bookmarks and history. You browse just like in any other, with one difference: while the page loads, Whatplay checks whether there are videos and offers to open them in its player, with the picture-in-picture window and casting to the TV. Here we explain how it finds them, what each notice means and why there are videos it will never be able to open.

How it finds videos

The browser doesn’t change the page or block its content: it watches. It looks for clues in several ways at once:

What the page requests: if the page downloads an HLS (.m3u8) or DASH (.mpd) manifest, or a video file, the browser sees it go by, even if the address has no extension.
The page’s players: the website’s video and audio elements, with their size, duration and cover image.
Standard markup: many websites describe their videos for search engines, for example with the og:video tag or with VideoObject structured data.
Links: the ones leading to video files, audio files or lists, such as .mp4, .mkv, .webm, .mp3, .m3u or .w3u.

When it finds something, you’ll see the number of videos. Tapping it opens “Videos on this page”, with each video, its type (MP4, M3U8…), its duration and, if it’s an adaptive stream, the highest resolution it offers (“up to 1080p”) and how many quality levels it has.

The check

Before playing, Whatplay checks each candidate: it requests it the way the page would, reads the beginning and decides based on the content, not on the extension or on what the server says, which is often wrong. That’s how it knows whether it’s a direct video, an HLS stream, a DASH stream, a channel list or an ordinary web page. That’s where the statuses you’ll see come from:

“Checking…”: it’s looking at it.
“Not checked yet: it’s checked when you open it”: the page only mentions it, for example in a link; it’s checked when you tap it.
“DRM-protected: can’t be opened”: we explain this below.
“Only plays on its website”: the video is hidden inside images and only that website’s own player knows how to play it. You can watch it there, full screen, but it can’t be cast to the TV.
“That link doesn’t lead to a video” or “This address is a channel list”: in the second case, you can import it into your Lists.

What DRM is

DRM (digital rights management) is a system that encrypts video and only lets authorized players decrypt it, with a license that’s requested for each playback. It’s used by paid platforms and many services with purchased or rented content. The best known are Widevine (from Google), PlayReady (from Microsoft) and FairPlay (from Apple). On the web they work through a standard browser component, Encrypted Media Extensions (EME), and decryption happens in a protected part of the device, so the picture can’t leave it without control.

It’s different from the AES-128 encryption in HLS, which only protects the video in transit: any HLS player can open it if it can download the key, and so can Whatplay. We cover it in HLS and DASH.

Why Whatplay doesn’t play DRM

Opening a DRM video outside the service’s official player would mean bypassing that protection, and Whatplay doesn’t circumvent anyone’s DRM. That’s why, when it detects that a page is receiving encrypted video or that its manifest declares DRM, it doesn’t offer it and tells you so: “This page plays DRM-protected video. That video can only be watched on the website itself.” For that content, use the service’s official website or app, where you have your subscription. It doesn’t download files either: if a website offers a download, you’ll see “Whatplay doesn’t download files”.

Notices you may see

Cookies: if the website asks you to choose in its cookie notice, make your choice on the page yourself.
“Confirm you’re human”: some websites ask for a verification. Whatplay doesn’t skip it: you complete it on the page yourself and, when the video appears, it moves to the player. The help covers it in A site asks me to confirm I’m human.
Pop-ups and redirects: the browser blocks them and lets you know; if you need a window, you can open it.
Another app: if the page wants to open another app, the browser asks you first.

Handy tricks

“Desktop site”, in the browser’s menu, loads the website as it would look on a computer, which is useful when the mobile version hides the player.
Save the websites you visit often in “Bookmarks”; if you use sync, they reach your other devices too.
In Settings › Browser, “Clear browsing data” wipes cookies, cache, site data and history, and “Search engine” chooses the one used when you type in the address bar.
On Android TV, you use the browser with a pointer that you move with the arrows on the remote, and OK clicks.
With parental controls, you can require the PIN to open the browser; we explain it in parental controls at home.

And remember that every website has its own terms of use: respect them.