Skip to install
better-helium

Pure bash · macOS 13+ · MIT

Netflix plays in Helium again.

Helium ships without Google’s Widevine library, so Netflix, Hotstar, Disney+ and Spotify refuse to play. better-helium copies Widevine in from Chrome’s own installer and re-signs the app. One script. Idempotent. Re-run it after every Helium update.

Homebrew
brew tap vinayakkulkarni/better-helium https://github.com/vinayakkulkarni/better-heliumbrew trust vinayakkulkarni/better-heliumbrew install better-helium

No Homebrew? Clone it with git. macOS asks for your password once, in its own dialog.

DRM gates on macOS

RCA.md

  1. Widevine CDM

    Present, 4.10.x

    Stock Helium: Fails, MissingAfter better-helium: Passes, Present, 4.10.x

  2. Security level

    L3, same as Chrome

    Stock Helium: Not applicable, n/aAfter better-helium: Passes, L3, same as Chrome

  3. VMP signing

    Only Google can grant it

    Stock Helium: Fails, Not licensedAfter better-helium: Fails, Only Google can grant it

  4. Gatekeeper

    Ad-hoc re-signed

    Stock Helium: Passes, Signed by imput.netAfter better-helium: Passes, Ad-hoc re-signed

01

Install and run

Requirements

  • macOS 13 (Ventura) or later
  • Apple Silicon or Intel, auto-detected
  • Helium installed in /Applications
  • Internet on the first run for the Chrome.dmg download

You do not need Google Chrome installed.

Homebrew
brew tap vinayakkulkarni/better-helium https://github.com/vinayakkulkarni/better-heliumbrew trust vinayakkulkarni/better-heliumbrew install better-helium

Homebrew 7 asks you to trust a third-party tap before it installs from it; brew trust is that step. Upgrade later with brew upgrade better-helium.

Git clone
git clone https://github.com/vinayakkulkarni/better-helium.gitcd better-helium./better-helium

The script is self-contained. Run it from the clone, or put it anywhere on your PATH.

The first patch downloads Google’s Chrome.dmg (~250 MB) and caches the Widevine library. Later patches reuse the cache and take about 30 seconds.

Usage

better-helium
Patch Helium. No-op if already patched.
--check
Report status without changing anything. Exit 0 patched, 1 unpatched, 2 error.
--force
Re-patch even if Helium already has Widevine.
--refresh
Re-download Widevine from Chrome to get a newer version.
--uninstall
Remove Widevine from Helium and re-sign.

02

What plays after the patch

Every Chromium browser on macOS runs Widevine at L3, Chrome included. The caps below are the same ones Chrome has.

Services that play after patching
Service Plays at
Netflixup to 720p
Hotstar (Disney+)up to 1080p
Disney+ (.com)up to 720p
YouTubefull
Spotify web playerfull
Apple Music webfull

What still won’t work

  • Amazon Prime Video SD only

    Amazon also checks VMP signing on the browser binary. Only Google can grant VMP, and Helium is not on its licensed-publisher list. Use Safari for HD Prime Video.

  • Widevine L1 content not possible

    L1 needs a hardware TEE. Every Chromium browser on macOS, Chrome included, is L3-only.

03

How it works

Widevine is closed-source and only ships inside commercial Chromium builds. Downloading it from Google’s own installer keeps the repo free of redistributed binaries.

The full technical story is in RCA.md.

  1. 01

    Detect Helium and the CPU

    Finds the Helium framework version inside /Applications/Helium.app. Apple Silicon maps to mac_arm64, Intel to mac_x64.

  2. 02

    Take Widevine from Chrome

    Downloads Google’s public Chrome.dmg once (~250 MB), mounts it, copies the WidevineCdm directory to ~/.cache/better-helium and throws the rest away. You do not need Chrome installed.

  3. 03

    Move Helium out of /Applications

    macOS App Management blocks writes inside app bundles in /Applications, even with sudo. The script quits Helium and moves the bundle to /tmp, where it can write.

    sudo mv /Applications/Helium.app /tmp/Helium.app.better-helium.<pid>
  4. 04

    Inject, strip, re-sign

    Copies WidevineCdm into the Helium framework, strips extended attributes and ad-hoc re-signs the bundle, then verifies the signature.

    codesign --force --deep -s - "<tmp_app>"
  5. 05

    Move it back

    Returns the bundle to /Applications. Open helium://components to see the Widevine Content Decryption Module listed.

Why it asks for your password

Moving a bundle in and out of /Applications needs administrator rights. The script asks macOS through AppleScript’s with administrator privileges, so the password goes to Apple’s own dialog. The script never sees or stores it.

After a Helium update

Updates rewrite the bundle and remove Widevine. Run better-helium again. better-helium --check answers in about 40 ms, fast enough for a shell prompt indicator that warns you when Helium is unpatched.