Is it safe to store IPTV passwords in an app? It can be—if secrets are encrypted at rest, access requires authenticated APIs, and clients cannot read raw ciphertext from the database. RocketIPTV encrypts playlist credentials with AES-256-GCM bound to your user and playlist id, uses Firebase Auth, and keeps Firestore rules deny-by-default for client SDKs.
What “encrypted at rest” means
Plaintext passwords are not written to Firestore. The API encrypts before storage and decrypts only after verifying your identity token. That is different from hashing: passwords must be recoverable to call your panel, so encryption—not one-way hashing—is required.
What you should still do
- Use unique panel passwords when possible
- Prefer HTTPS providers
- Revoke lost TVs from Devices
- Never paste credentials into random “online players”
Related: legal source responsibility.