The web player

Formats

• Formats: what the browser can play itself goes to the browser, and the rest is decoded in the page: MKV, MP4, AVI, TS, M2TS, FLV, MPG, VOB and OGG; H.264, HEVC, AV1, VP9, MPEG-2 and MPEG-4 pictures; AC-3, E-AC-3, DTS, TrueHD, FLAC, Opus and other sound. The two ways offer different features; see two ways to play.
• Blu-ray ISOs play their main title, with its audio tracks, subtitles and chapters; the server reads the disc. A Blu-ray folder opens from its index.bdmv in the file manager. There are no disc menus.
• HDR: when the browser plays the video itself, HDR shows as far as the browser and the display allow; decoded in the page, it may be shown as SDR.
• Dolby Vision: Safari plays profiles 5 and 8 as Dolby Vision, switching TrueHD and DTS sound to an AC-3, E-AC-3 or AAC track in the same language. Chrome and Edge turn profile 5 into an SDR picture with the right colours using WebGPU, and show the HDR10 base of the others.
• Sound: Dolby Atmos and DTS:X play their base channels, and DTS-HD MA on a Blu-ray plays its core. Sound decoded in the page comes out in stereo.
• An MP4 whose pictures carry no display times plays smoothly instead of shaking.
• What it can't play (DVDs, VC-1, RMVB, WMV and so on) shows Copy link and Download, for VLC, IINA, PotPlayer or Infuse, or play it in the CloudDrive2 App.

Subtitles and controls

• Subtitles: SRT, WebVTT and PGS, both beside the video and inside the file. ASS/SSA files beside the video show with all their effects; ASS inside the file is drawn in a simpler way. .srt, .vtt, .ass, .ssa and .sup files beside the video are listed by themselves, and text subtitles that aren't UTF-8 are read as GB18030. One subtitle shows at a time.
• Layout: the control bar and panels are the apps' player's, with a phone layout in a phone's browser. There is a chapter list, chapter ticks on the seek bar, an episode list, and Video Info and title panels.
• Picture: when the browser plays the video itself you can choose Fit, Fill or Stretch, and there is a Pan & Scan button, picture-in-picture, and AirPlay in Safari; decoded in the page, none of these are there.
• Speed: 0.25× to 3× when the browser plays it, up to 2× when decoded in the page.
• Full screen: double-click the picture or press F. A phone turns to landscape in full screen, and on iPhone videos decoded in the page go full screen too.
• Keys: Space or K to pause, ← → to go back or forward 5 seconds (10 with Shift), ↑ ↓ for volume, M to mute, F for full screen, N and P for next and previous, A and C to cycle audio and subtitles, Esc to leave. On a phone, double-tap the left or right side to go back or forward 10 seconds.
• The time at the end of the seek bar switches between the length and the time left. On a page opened over HTTPS the screen stays on while a video plays.

Computers and phones

• Software decoding, at an http LAN address or when the graphics chip lacks the codec, runs on the processor. Recent computers usually play 1080p H.264 smoothly. Hardware decoding is preferred for 4K HEVC and AV1; software-decoding performance depends on the processor, video bitrate and playback path.
• HEVC in hardware (10-bit included): Intel 7th-generation Core graphics or later, NVIDIA GTX 10 series or later, AMD RX 400 series or later, Macs from 2017 on and every Mac with Apple silicon.
• AV1 in hardware: Intel 11th-generation Core graphics or later, NVIDIA RTX 30 series or later, most AMD RX 6000 series cards and later, Apple M3 and later.
• Dolby Vision profile 5 in Chrome and Edge uses software decoding in the page and WebGPU to produce correctly coloured SDR. Version 1.2.0 improves 10-bit HEVC decoding and threading on Windows; smooth profile 5 playback with correct colours has been verified on a physical PC. This is not a guarantee of smooth 4K playback on every device. WebGPU, multithreading and a secure context are required; insufficient performance can still trigger a warned fallback with incorrect colours.
• Phones and tablets rely on hardware decoding. iPhone and iPad need iOS or iPadOS 16.4 or later.

What a browser can't do

• A browser can't send Dolby, DTS or TrueHD to an AV receiver as a bitstream, take the sound card for itself, or pass DSD to a DAC untouched; sound decoded in the page comes out in stereo.
• A browser can't switch a TV or display's frame rate or HDR mode.
• There are no Blu-ray or DVD disc menus, and DVDs and VC-1 video don't play (Copy link opens them in another player).
• For any of these, use the CloudDrive2 App; it connects to the same media server.

What an HTTP page goes without

Files the browser plays by itself (H.264 in MP4, for example) aren't affected. What suffers is video decoded in the page: formats and sound the browser can't play itself, such as MKV with TrueHD or DTS sound, Blu-ray ISOs, and Dolby Vision in Chrome and Edge. Software decoding usually keeps up with 1080p H.264; when 4K HEVC can't, the player says so and shows the steps below.

When an ordinary remote HTTP page cannot use hardware decoding through WebCodecs, the player tries handing a 4K or HDR picture to the browser's own player. That player may still use the system's hardware decoding, depending on the browser, device and codec, but smooth playback is not guaranteed. It only goes with a sound it plays itself: AAC, plus AC-3 and E-AC-3 in Safari and Edge. When the sound is DTS or TrueHD (a Blu-ray ISO, say), a track of that kind in the same language plays instead, with a notice; without such a track the picture is still decoded in the page in software, and 4K may skip frames. Safari can also play Dolby Vision directly on supported devices, but HDR, Dolby Vision and high-bitrate playback still depend on the device and network. HTTPS or a local secure address is recommended for the page's decoding path.

Three ways around it

• Open it over HTTPS: under Settings → Web Server in the web interface, turn on HTTPS (port 19799 by default) and set up a certificate. The certificate must match the name in the address bar or the browser warns; with a domain of your own you can use a free certificate such as Let's Encrypt, or serve HTTPS through Nginx, Caddy or your NAS's reverse proxy. The self-signed certificate the core service makes covers only localhost and 127.0.0.1, so at a LAN address the browser warns that it isn't trusted. Always use HTTPS from outside your home.
• Open it on the server itself: on the computer running the core service, http://localhost:19798 is already a secure address. This only helps on that one computer.
• Treat the LAN address as secure: the simplest on a home network. Chrome and Edge both have the setting; the steps are below. Chrome on Android phones, tablets and TV boxes has it too, with the same steps.

Safari (Mac, iPhone, iPad) has no such setting; the formats its own player can play depend on the system and device. See "What an HTTP page goes without". Use HTTPS when the page's decoder is needed or the player says it can't keep up. Chrome and Edge on iPhone and iPad don't have this setting either, so use HTTPS; Safari is another option for native playback. In Firefox, open the page over HTTPS, or play in the CloudDrive2 App.

Still decoding in software

• The address must match exactly: http or https, IP address or host name, and the port must all be the same as in the address bar. If the server's IP address changes (the router hands out a new one), add it again; giving the server a fixed address on the router avoids this.
• Turn on graphics acceleration: in Chrome, Settings → System → "Use graphics acceleration when available"; in Edge, the graphics acceleration switch under Settings → System and performance. Relaunch the browser afterwards.
• Check the browser's GPU page: open chrome://gpu or edge://gpu; the "Video Decode" line should say Hardware accelerated.
• HEVC: Chrome decodes HEVC on the graphics chip from version 107 on Windows, macOS and Android; Edge on Windows also needs the HEVC Video Extensions from the Microsoft Store.
• The graphics chip lacks the codec: older graphics can't decode HEVC 10-bit or AV1, for example, and the browser decodes in software anyway; play it in the CloudDrive2 App.
• A computer managed by work or school: an administrator may have turned flags off; ask them to set the policy below.

Setting it by policy (several computers)

Chrome and Edge both have the OverrideSecurityRestrictionsOnInsecureOrigin policy, which does the same as the setting above and suits setting up several computers at once. Once the policy is set, the flag entry no longer takes effect. On Windows, in a Command Prompt run as administrator:

reg add "HKLM\SOFTWARE\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin" /v 1 /t REG_SZ /d "http://192.168.1.20:19798" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin" /v 1 /t REG_SZ /d "http://192.168.1.20:19798" /f

A second address goes under the name 2, and so on. On Linux, create a JSON file in /etc/opt/chrome/policies/managed/ (for Edge, /etc/opt/edge/policies/managed/):

{ "OverrideSecurityRestrictionsOnInsecureOrigin": ["http://192.168.1.20:19798"] }

After relaunching the browser, the policy shows in chrome://policy or edge://policy. On macOS the policy has to be installed with a configuration profile; on a personal Mac, the flag above is simpler.