Skip to main content
BlindCast has two data flows — upload and playback — connected by a shared key hierarchy. The server never handles plaintext video.

Data flow

Key hierarchy

All encryption keys derive from a single master key using HKDF-SHA-256. You store and protect one secret — everything else is derived deterministically.
  • Master key: Generated once with blindcast keygen. Stored in a secret manager. Never sent to browsers.
  • Content key: Derived per contentId. The key server issues this to authenticated viewers.
  • Segment key (optional): Derived per epoch for key rotation. The manifest includes a new EXT-X-KEY tag every N segments.

What each tool does

ToolResponsibilityRuns on
CLIGenerate keys, encrypt segments, upload to S3, run dev serverYour machine or CI
UploaderEncrypt segments in-browser, upload via presigned URLsCreator’s browser
Key ServerAuthenticate viewers, derive and serve content keysDocker container or Cloudflare Worker
PlayerFetch manifest, get key, decrypt segments, render videoViewer’s browser

Next steps