# WebRTC Guide, Part 2: Encryption, Codecs, and SFU vs MCU vs Mesh

> How WebRTC works under the hood: mandatory DTLS-SRTP, data channels, VP8/H.264/AV1/HEVC codecs, congestion control, simulcast, and SFU vs MCU vs mesh servers.

Source: https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu · Published 2026-10-30 · ByteVancer · Real-Time Web

**Encryption you can't turn off, the codecs every browser must ship, and why group calls go through an SFU. WebRTC under the hood, with the open-source servers.**

> **Part 2 of 3: WebRTC, explained** — [Part 1: What WebRTC is and how a call connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works) · **Part 2: Encryption, codecs, and SFU vs MCU vs mesh (you're here)** · [Part 3: WHIP, E2EE, MoQ, security and debugging](https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026)

[Part 1](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works) showed how a call connects. This part opens the box, as of 30 Oct 2026: what encrypts the media, which codecs you get, how bandwidth adapts, and which server shape a group call needs.

## TL;DR

- Encryption is mandatory: DTLS-SRTP for media, DTLS for data. Plain RTP is forbidden.
- Every browser must ship VP8, H.264, Opus and G.711. VP9, AV1 and HEVC are extras.
- Congestion control is a de-facto Google algorithm described in expired IETF drafts, not an RFC.
- Group calls: mesh needs no media server, an SFU forwards, an MCU mixes and re-encodes.

**What the RFCs require**
- **DTLS-SRTP** Media security — RFC 8827: MUST
- **SCTP/DTLS** Data channels — RFC 8831
- **VP8 + H.264** Video codecs — RFC 7742: MUST
- **Opus + G.711** Audio codecs — RFC 7874: MUST

## Encryption is mandatory

RFC 8827: "Implementations MUST support DTLS … and DTLS-SRTP", "All media channels MUST be secured via SRTP" and "Media traffic MUST NOT be sent over plain (unencrypted) RTP". Implementations "MUST NOT offer SDP security descriptions" (SDES), the older scheme that put keys in signaling; Chrome removed SDES in M98.

## Data channels

RFC 8831 runs data channels as SCTP over DTLS over ICE/UDP. Each channel can be reliable or partially reliable, ordered or unordered; DCEP (RFC 8832) opens them. Chrome removed its old non-standard RTP data channels in M90.

## Codecs: the mandatory set and the newer ones

RFC 7742: "WebRTC Browsers MUST implement the VP8 video codec … and H.264 Constrained Baseline". RFC 7874 requires Opus plus G.711 (PCMA/PCMU) for audio.

**RFCs, MDN WebRTC codecs and Chrome Status, as of 30 Oct 2026.**
- **VP8** — Status: Mandatory (RFC 7742)
- **H.264 Constrained Baseline** — Status: Mandatory (RFC 7742); Chrome since M52
- **Opus, G.711** — Status: Mandatory audio (RFC 7874)
- **VP9** — Status: Chrome 48+, Firefox (MDN)
- **AV1** — Status: Chrome desktop shipped an AV1 encoder for WebRTC in Chrome 90
- **HEVC (H.265)** — Status: Chrome 136, hardware-only; Safari 18.0 added the RFC 7789 payload format

Chrome's HEVC note: "we will not provide a software implementation", so it depends on the device. Chrome added a Codec Selection API in M119.

## Congestion control and simulcast

WebRTC adapts its bitrate to the network. Google Congestion Control (GCC), combining delay-based and loss-based control, is described in draft-ietf-rmcat-gcc, an expired draft. Its feedback companion, transport-wide congestion control, is also an expired draft, built on "keeping the receiver dumb".

Simulcast (RFC 8853) is "the act of simultaneously sending multiple different encoded streams of the same media source", tagged with a=simulcast and RIDs. SVC layers one stream instead: the W3C WebRTC-SVC Working Draft defines scalabilityMode values such as L1T3 and L3T3, and Chrome shipped SVC in M111. Both let a server send each viewer a fitting quality.

## SFU vs MCU vs mesh

**Three ways to run a group call (RFC 7667)**
- **Group call** — Pick a topology
  - **Mesh** — Every peer sends to every other; no media server. By our reading, each sender uploads N−1 copies.
  - **SFU** — Selective Forwarding Middlebox: forwards streams, adds little delay, no signal processing. Leans on simulcast/SVC.
  - **MCU** — Media-Mixing Mixer: decodes, mixes, re-encodes. Costs quality and latency; each endpoint gets one stream.

No source we trust gives a participant count where mesh breaks; measure your users' uplinks. Discord's 2018 write-up describes a homegrown C++ SFU serving "more than 2.6 million concurrent voice users" on "more than 850 voice servers in 13 regions" (Discord's 2018 figures).

## Open-source WebRTC servers

**Each project's own GitHub description and license; for coturn's license, see its repo.**
- **mediasoup** — Describes itself as: "Cutting Edge WebRTC Video Conferencing"; License: ISC
- **Janus** — Describes itself as: "Janus WebRTC Server"; License: GPL-3.0
- **LiveKit** — Describes itself as: "End-to-end realtime stack for connecting humans and AI"; License: Apache-2.0
- **Jitsi Videobridge** — Describes itself as: "WebRTC compatible video router or SFU"; License: Apache-2.0
- **Pion** — Describes itself as: "Pure Go implementation of the WebRTC API"; License: MIT
- **coturn** — Describes itself as: TURN server; License: Check the repo

Vendor claims, not benchmarks: Jitsi says "up to hundreds of conferences per server"; coturn says it "can handle thousands simultaneous calls per CPU (when TURN protocol is used)" and load-balances for scale. Licenses matter as much as features: GPL-3.0 and Apache-2.0 carry different obligations. We wire these servers into products as part of [real-time web development](https://bytevancer.com/services/web-development). [Part 3](https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026) covers WHIP, end-to-end encryption and security.

## The whole series

1. [Part 1: What WebRTC is and how a call connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works)
2. **Part 2: Encryption, codecs, and SFU vs MCU vs mesh (this post)**
3. [Part 3: WHIP, E2EE, MoQ, security and debugging](https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026)

## Frequently asked questions

**Is WebRTC encrypted?**
Yes, always. RFC 8827 requires DTLS-SRTP for all media and forbids plain RTP; data channels run over DTLS.

**What is a WebRTC data channel?**
A channel for arbitrary data over the peer connection, using SCTP over DTLS (RFC 8831). It can be reliable or partially reliable, ordered or unordered.

**Which codecs does WebRTC support?**
Browsers must implement VP8, H.264 Constrained Baseline, Opus and G.711. VP9, AV1 and HEVC (Chrome 136, hardware-only) are available in some browsers.

**What is the difference between an SFU, an MCU and mesh?**
Mesh sends every stream peer to peer. An SFU forwards streams without decoding them. An MCU decodes, mixes and re-encodes into one stream, costing quality and latency.

**What is the best open-source WebRTC server?**
It depends on language and license: mediasoup (ISC), Janus (GPL-3.0), LiveKit and Jitsi Videobridge (Apache-2.0) and Pion (MIT, Go) are common; coturn covers TURN.

## Keep reading

- [WebRTC Guide, Part 1: What WebRTC Is and How a Call Actually Connects](https://bytevancer.com/blog/webrtc-guide-part-1-how-webrtc-works) — What WebRTC is and how it works: the 2021 standard, browser support, BYO signaling, SDP offer/answer, ICE, STUN and TURN, and when you need a TURN server.
- [WebRTC Guide, Part 3: WHIP, E2EE, MoQ, Security and Debugging in 2026](https://bytevancer.com/blog/webrtc-guide-part-3-whip-e2ee-moq-2026) — WebRTC in 2026: WHIP (RFC 9725) and WHEP, SFrame E2EE, WebRTC vs WebSocket, LL-HLS and MoQ, IP leaks and mDNS, libwebrtc CVEs, and debugging with getStats.
- [All ByteVancer engineering articles](https://bytevancer.com/blog)

## Choosing an SFU, or a whole real-time stack?

We help pick, self-host and integrate the media server and TURN layer your app needs. See our [real-time web app development](https://bytevancer.com/services/web-development) or [talk to the team](https://bytevancer.com/contact).

## Sources

- [RFC 8827 — security architecture](https://www.rfc-editor.org/rfc/rfc8827.html)
- [Chrome Status — SDES removal](https://chromestatus.com/feature/5695324321480704)
- [RFC 8831 — data channels](https://www.rfc-editor.org/rfc/rfc8831.html)
- [RFC 8832 — DCEP](https://www.rfc-editor.org/rfc/rfc8832.html)
- [Chrome Status — RTP data channels removed](https://chromestatus.com/feature/6485681910054912)
- [RFC 7742 — video](https://www.rfc-editor.org/rfc/rfc7742.html)
- [RFC 7874 — audio](https://www.rfc-editor.org/rfc/rfc7874.html)
- [MDN — WebRTC codecs](https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Formats/WebRTC_codecs)
- [Chrome Status — VP9](https://chromestatus.com/feature/5652783105572864)
- [Chrome Status — H.264](https://chromestatus.com/feature/6417796455989248)
- [Chrome Status — AV1 encoder](https://chromestatus.com/feature/6206321818861568)
- [Chromium blog — Chrome 90 AV1](https://blog.chromium.org/2021/03/chrome-90-beta-av1-encoder-for-webrtc.html)
- [Chrome Status — HEVC](https://chromestatus.com/feature/5153479456456704)
- [WebKit — Safari 18.0](https://webkit.org/blog/15865/webkit-features-in-safari-18-0/)
- [Chrome Status — Codec Selection](https://chromestatus.com/feature/5200982281027584)
- [IETF — draft-ietf-rmcat-gcc](https://datatracker.ietf.org/doc/draft-ietf-rmcat-gcc/)
- [IETF — transport-wide CC draft](https://datatracker.ietf.org/doc/draft-holmer-rmcat-transport-wide-cc-extensions/)
- [RFC 8853 — simulcast](https://www.rfc-editor.org/rfc/rfc8853.html)
- [W3C — WebRTC-SVC](https://www.w3.org/TR/webrtc-svc/)
- [Chrome Status — SVC](https://chromestatus.com/feature/5769626174619648)
- [RFC 7667 — RTP topologies](https://www.rfc-editor.org/rfc/rfc7667.html)
- [Discord blog, Sep 10, 2018](https://discord.com/blog/how-discord-handles-two-and-half-million-concurrent-voice-users-using-webrtc)
- [mediasoup](https://github.com/versatica/mediasoup)
- [Janus](https://github.com/meetecho/janus-gateway)
- [LiveKit](https://github.com/livekit/livekit)
- [Jitsi Videobridge](https://github.com/jitsi/jitsi-videobridge)
- [Pion](https://github.com/pion/webrtc)
- [coturn](https://github.com/coturn/coturn)

---

*This is the Markdown copy of https://bytevancer.com/blog/webrtc-guide-part-2-encryption-codecs-sfu — the page itself has the interactive charts and diagrams.*