// open-source video fingerprinting defense

Encrypted video traffic still leaks what you're watching.

Dodge makes it much harder to tell what you're watching, without disrupting playback. It reshapes the segment-by-segment download pattern of streaming video so that prying eyes (a coffee shop neighbor, a network admin, an ISP) no longer see an identifying fingerprint. Add it to your own site as a video player module, or use it yourself with the browser extension once it's released.

dash.js v5.2.0 · 2026-04-30
3 components · dash.js module · browser extension · defense generator
// how the attack works, and what we do about it
01 / OBSERVATION

Videos arrive in segments.

Constant duration, variable size. The size depends on the visual complexity of the content.

When you watch online video, your browser doesn't download the file all at once. It fetches a sequence of segments, small pieces a few seconds long.

Every segment has the same duration, but not the same size. For example, action scenes are large, and still scenes are small.

segment size over timeunits: KB
900 600 300 0 t → action still action
02 / IDENTIFICATION

That pattern is a fingerprint.

Encryption (HTTPS) hides what's inside segments, but not how big they are. VPNs and Tor don't change this.

Different videos produce different sequences of sizes, and these differences are significant enough to identify a specific title from a known catalog.

Anyone watching your network, whether they run the cafe's router, your campus, or your ISP, can use videos' patterns to identify what you're watching.

three titles · same network observer distinct identities
video_A video_B video_C → encryption hides bytes; size and timing remain visible
03 / DEFENSE

Dodge rewrites the trail.

Reshape the sequence (change download sizes, add padding segments) until it no longer matches a specific title.

A Dodge defense reshapes the download sequence so the visible traffic no longer identifies a specific title. There are many ways to do this, each with its own goals and trade-offs in viewing experience.

Want to watch videos that haven't been published alongside a defense, or verify that your content provider has set up Dodge correctly? The browser extension, still in development, will swap out undefended players so you can start defending.

To learn more about the attack and what defenses do about it, read
how video fingerprinting works and how Dodge defends.

before / aftershape ≠ identity
in: real → apply defense → out: shaped player tcp / tls network observer video server
// for viewers

Watch privately.

The browser extension swaps out undefended players for Dodge, applies ready-made defenses, and verifies defense setups.

The extension →
// for builders

Integrate Dodge, or build defenses.

Use the dash.js module in your player, generate defenses with our tools, or write your own that follow the extended manifest spec.

Docs →
// known limitations

What we know, and don't.

Traffic analysis defense, especially for video, is a young research area. A poorly designed defense can leak as much as no defense at all, and we'll continue learning about what works as more people deploy. Dodge is engineered to be safe by default: with a well-thought-out defense, your traffic should be no easier to identify than without one; usually much harder.

We publish our research, source code, and limitations openly. If you're a content provider thinking about deployment, we'd like to help.