pycenc

Pure-Python CENC (Common Encryption) decryptor for fragmented MP4.

pycenc decrypts cenc-encrypted DASH/fragmented MP4 files (the scheme used by Widevine, PlayReady, and ClearKey) using a content key you already have. It is a pure-Python alternative to Bento4's mp4decrypt — no compiled dependencies, just the cryptography library.

What this is: an implementation of ISO/IEC 23001-7 (CENC) — a published standard for common encryption of fragmented MP4. It performs standard AES-128-CTR decryption given a content key.

What this is not: it does not obtain keys. There is no CDM, no key exchange, no license server, no network access. You supply the key; the library does the crypto. (Obtaining keys from a DRM system is a separate concern this library does not address.)

Install

pip install pycenc
# or, from source:
uv tool install .   # or: pip install .

CLI

pycenc --key KID:KEY input.m4s output.mp4
# KID is accepted but informational (single key decrypts all samples):
pycenc --key 3adcf39a811a5ab45f901e5b835b688c input.m4s output.mp4

Library

from pycenc import decrypt_bytes, decrypt_file

# in-memory
with open("encrypted.m4s", "rb") as f:
    data = f.read()
clear = decrypt_bytes(key_bytes, data)          # -> bytes

# file-based
with open("encrypted.m4s", "rb") as fi, open("decrypted.mp4", "wb") as fo:
    decrypt_file(key_bytes, fi, fo)

key_bytes is a 16-byte AES-128 content key.

How it works

1. Walks the ISO BMFF box tree (moov/trak/moof/traf/mdat) without external parsers.
2. For each fragment, reads the senc box (per-sample IVs + subsample split) and the trun box (sample sizes), then decrypts each sample's encrypted bytes with AES-128-CTR.
3. Auto-detects the IV size (8 or 16 bytes) and whether subsample encryption is used — some files in the wild carry non-compliant senc flags or tenc reporting per_sample_iv_size=0, so detection validates each interpretation against the box length rather than trusting the flags.
4. Produces a clean, muxable MP4: strips the CENC boxes (sinf/senc/saiz/saio/pssh), restores sample-entry types (encv→avc1, enca→mp4a), recomputes box sizes, and fixes trun.data_offset. The output opens directly in ffmpeg and standard players.

Supported

Limitations

• Single content key per file (the common case). Multi-key support is planned.
• cenc scheme only for now; cbcs/cens are on the roadmap.
• Reads the file into memory (fine for typical streaming segments; streaming I/O is a future improvement).

License

MIT — see LICENSE.