Xtream Codes Explained: How They Work and Differ From M3U

If you have set up IPTV before, you know the drill: paste a long link into your player, wait a moment, done.

Then a provider hands you three separate things instead of one link, and your app asks for something called an Xtream Codes API login.

Nothing has gone wrong - it is simply a different way of delivering the same channels.

This page explains what that login is, when it beats a plain playlist, and how to turn one into the other when your player refuses to cooperate.

What Xtream Codes Actually Is

Xtream Codes started life as panel software, the control panel IPTV providers used to manage their servers, channels and customer accounts. The original company was shut down by European authorities in 2019.

The name survived anyway. Forks and clones of that panel kept using the same set of web addresses to talk to apps, and those addresses quietly became an unofficial standard.

So today it does not mean a company or a product you can buy. It means the API format, the agreed way an IPTV app asks a server "who am I, and what can I watch?"

That is why your app has a login screen labelled Xtream Codes API, or just XC. It is not asking you to install anything, it is asking which server to phone up.

What Your Provider Actually Gives You

An Xtream login is always the same three pieces.

• Server URL - something like http://example-server.com:8080. The number after the colon is the port, and it matters more than anything else on this page.
• Username - usually a random string rather than an email address.
• Password - same again, and usually just as random.

An M3U setup, by contrast, is one line: a single URL ending in .m3u, .m3u8, or a long get.php address.

If you want the full breakdown of what sits inside one of those files, we wrote a separate plain-English guide on what an M3U file is and how to open it.

M3U vs Xtream Codes: What Is Actually Different

The streams are identical. What changes is how your app fetches them, and how much it knows about your account.

The pattern is simple. M3U is dumber but universal, Xtream is smarter but pickier about which app you use.

The Addresses Hiding Behind the Login

You never need to type these by hand, but seeing them makes the whole thing click. They also explain most of the error messages further down this page.

When you enter your three details, the app quietly builds addresses like these.

• The account check:

  http://server:port/player_api.php?username=USER&password=PASS

• The full playlist as M3U:

  http://server:port/get.php?username=USER&password=PASS&type=m3u_plus&output=ts

• A live channel:

  http://server:port/live/USER/PASS/12345.ts

• A movie:

  http://server:port/movie/USER/PASS/12345.mp4

• The TV guide:

  http://server:port/xmltv.php?username=USER&password=PASS

Look at the second one. That is the important bit.

Turning an Xtream Login Into an M3U

Because get.php exists, any working Xtream login can be turned into a plain M3U link.

That is genuinely useful when your player does not speak the API. VLC, most smart TV browsers, older set-top boxes, car head units, anything stubborn.

You can do it in your browser with our Xtream Codes to M3U converter. Paste in the server, username and password, pick ts or m3u8 as the output format, and you get a normal playlist file back.

The output format matters less than people think. Pick ts for VLC, Kodi and most TV boxes, or m3u8 for browsers and iPhones.

Going the other way does not work. An M3U is just a list of finished stream links, so there is no account sitting behind it to log into.

Your Password Travels Inside the Link

Look again at those addresses. Your username and password sit in plain text inside every single one of them.

That is simply how the format works and there is nothing to fix. It does have one consequence worth knowing about.

Anyone who gets hold of your playlist link, or a clear screenshot of your app, has your whole account rather than just a copy of the channel list. That is why providers cut people off for sharing.

Which Should You Use?

Use Xtream Codes if your app supports it. It is faster on big lists, the movie and series sections are far nicer to browse, and the TV guide simply appears.

You also get to see when your account expires, instead of guessing why everything stopped working.

Two apps cover most people. TiviMate is the usual pick for Android TV, Google TV and Fire TV, because it handles Xtream logins natively and is built for a remote control rather than a touchscreen.

IPTV Smarters Pro is the one to grab for Android phones, tablets and boxes. Same Xtream login screen, laid out for a touchscreen instead of a remote.

Use M3U if you want it to just work anywhere. VLC, Kodi, browsers, old hardware, that TV in the spare room.

No app is going to refuse an M3U. It is also the only sensible format for free, public, legal playlists, which brings us to the awkward part.

About "Free Xtream Codes"

This is worth being blunt about, because a lot of pages are not.

Searches for free Xtream codes lead to lists of server addresses with usernames and passwords attached. Those are almost always someone else's paid account, scraped or resold.

This is exactly why those lists exist at all. The credentials sit in plain text in every link, so one careless paste is all it takes for an account to end up on a public list.

• They die fast. Providers spot shared logins within hours, sometimes minutes.
• They are not free in the legal sense. Using a stranger's subscription credentials is not the same thing as watching a channel a broadcaster puts online for everyone.
• The sites hosting them are risky. They are a common route for fake "player" downloads that turn out not to be players.

So the honest summary: Xtream Codes is a format used mostly by paid providers. If you are looking for free channels, M3U is where you will actually find them.

When the Xtream Login Will Not Work

Almost every Xtream error is one of five things, and the first accounts for most of them.

• "Login incorrect" or "Invalid credentials" - nine times out of ten the port is missing. Copy the address exactly as your provider sent it, colon and number included.
• Extra bits on the end - enter only the server and port. No trailing slash, no /c, no /player_api.php, because the app adds those itself.
• http versus https - if one fails, try the other. Some servers only answer on one of the two, and no error message will tell you which.
• "Max connections reached" - Xtream accounts allow a set number of devices at once. If your phone is still streaming in your pocket, that counts as one of them.
• Worked yesterday, dead today - open your app's account info screen, because Xtream logins show an expiry date. This is a real advantage over M3U, where an expired account just looks like a mysteriously dead playlist.
• Channels play but the TV guide is empty - some providers still serve the guide on a separate XMLTV link even when you log in with Xtream. Look for an xmltv.php address on your account page and add it in your app's EPG settings.

If the login itself is fine but individual channels fail, the problem is the streams rather than the format.

Convert the account to M3U, run it through the M3U Checker, and you will see in seconds whether it is one dead channel or the whole list.

Who Should Look Elsewhere

If your provider only ever sent you a single link ending in .m3u or .m3u8, there is no Xtream login to find and nothing on this page changes your setup.

The tell is simple: no port number, no separate username field. Read our M3U file explainer instead, and carry on as you were.

Quick questions

Xtream Codes is not a mystery and it is not a rival technology. It is a nicer front door to the same building, one that only certain apps have a key for.

If your player speaks it, use it. If it does not, convert the login to M3U, check the list, and carry on watching - either way you are looking at the same channels.