Back Up IPTV and Kodi Settings Without Leaking Logins

[TOC]

Quick answer: Before you back up IPTV and Kodi settings, assume the file holds every streaming login you own: Xtream passwords, M3U links, debrid API keys, and Trakt tokens. Encrypt it with 7-Zip AES-256 or Cryptomator, keep one copy offline, and never share it with a public link.

Most cord-cutters think of a backup as a convenience file. After a factory reset, it saves you the tedious hour of re-typing playlist URLs on a Firestick remote. As of 2026, though, that same little file is often the single most valuable thing an attacker could pull out of your Google Drive. It puts every credential in your streaming setup in one place.

That’s the problem. This guide shows you how to back up IPTV and Kodi settings without turning the backup into a liability. It covers what’s actually inside those files, where to keep them, how to export from TiviMate, IPTV Smarters, Kodi, and Stremio, and exactly which passwords and keys to rotate if a backup ever escapes.

Why Streaming Backups Are a Security Problem

Backups exist so you can recover from failure. Fine. But a good backup is, by design, a complete snapshot, and that includes all the stuff you’d rather nobody else saw. Once that snapshot lands somewhere less protected than the original device, the backup becomes the weakest point in the whole chain.

Cloud Backup Accounts Get Breached Too

Over the past couple of years, several enterprise backup and cloud-sync platforms have disclosed incidents where attackers went after stored customer backups rather than the live systems. In some of those cases, the backups held configuration files with credentials baked right in. Attackers didn’t have to break into each customer one by one. The vault already had the keys.

Home users face a smaller version of the same thing. Your “vault” is usually a personal Google Drive, Dropbox, OneDrive, or Gmail account. Get phished once, or reuse a password that showed up in some old breach, and everything in that account is exposed at the same moment.

Your Backup Is Only as Safe as Where You Store It

Where do your streaming logins normally live? Inside an app on a Firestick 4K or an Onn box under the TV, behind your home router. Not a fortress. Still, a stranger has a much harder time reaching it than a cloud folder that anyone with your email and password can open from anywhere on earth.

Copy those logins into a backup and upload it, and now the security of every streaming account depends on one cloud password. A single breached Dropbox can hand over your IPTV line, your Real-Debrid subscription (typically around €3–€16 depending on the plan length), and years of Trakt history in one go. So where you store the file matters more than how you made it.

What’s Actually Inside an IPTV or Kodi Backup File

Almost nobody opens their backup files. So almost nobody knows what’s in them. Short version: a lot of readable credentials. Here’s what to expect, category by category.

Xtream Codes Usernames, Passwords, and Server URLs

Xtream-based players store three things per playlist: the server address, your username, and your password. Plenty of apps keep these as plain text inside a SQLite database or a settings file. A custom file extension doesn’t prove anything, either. Underneath, many backups are just a renamed ZIP or a JSON file.

Anyone holding those three values can log in to your line from their own device. If your provider caps you at one or two connections, which is common on cheaper plans, your streams may start buffering or get kicked off entirely because someone else is sitting in your slot.

M3U and EPG Links With Credentials in the Query String

People miss this one constantly. A typical M3U URL looks something like http://provider.example:8080/get.php?username=XXXX&password=YYYY&type=m3u_plus. Look closely. The username and password are right there in the link.

An M3U URL alone is a full credential. No separate login step. The same applies to many EPG links (the xmltv.php URLs) coming from Xtream panels. Ever pasted your playlist link into a Reddit thread or a Discord channel while troubleshooting a channel that wouldn’t load? Then you’ve effectively posted your password in public.

Debrid API Keys and Trakt OAuth Tokens

Kodi addons and Stremio configurations often store a Real-Debrid, AllDebrid, Premiumize, or TorBox API key or access token. A Real-Debrid API key leak lets someone use your paid account from anywhere. Debrid services also tend to dislike accounts that show traffic from lots of different IPs at once, and they may flag or suspend yours (policies vary by service, and they don’t always spell out the thresholds).

Trakt OAuth tokens cost you less. Still personal, though. They grant access to your watch history, lists, and ratings, and whoever has one can modify all of that until you revoke the app.

Addon Settings That Store Logins in Plain Text

In Kodi, each addon keeps its configuration in userdata/addon_data/[addon.id]/settings.xml. Since Kodi 20 “Nexus,” the PVR IPTV Simple Client stores per-instance settings in files like instance-settings-1.xml inside its addon_data folder, and those files include your M3U URL. Kodi’s own passwords.xml can hold saved SMB or NAS credentials too.

You can check your own backup on a PC in about five minutes. Extract it (rename it to .zip first if it won’t open), then search the folder for these terms:

password and username
api_key, apikey, and token
get.php and xmltv.php (Xtream URLs)

On Windows, open Command Prompt in the extracted folder and run findstr /s /i /m “password token api_key” *.* to list matching files. On macOS or Linux, grep -ril “password” . does the same job. Prefer something visual? Notepad++ has Search > Find in Files, which is friendlier.

Safer Places to Store Your Backups

No storage option is perfect. The real goal is balancing leak risk against how fast you can get back up and running when a device dies. Here’s how the usual choices stack up.

Storage option	Leak risk	Convenience	Restore speed
USB drive via OTG	Low (offline)	Medium	Fast
Home NAS / SMB share	Low to medium	High	Fast
Cloud with encrypted container	Low	High	Medium
Cloud, unencrypted	High	High	Medium
Email, public links, Telegram	Very high	High	Medium

USB Drive via OTG Adapter on Firestick and Onn

An OTG adapter with a power passthrough port, usually somewhere around $8–$15 on Amazon, lets a Firestick read and write to a regular USB stick. The Onn 4K Pro and many other Android TV boxes have a full-size USB port already, so you can skip the adapter.

Offline USB is the safest option on the list. Nothing on the internet can reach it. Label it clearly and keep it somewhere sensible, though, because a stick sitting in a junk drawer is still a credential file to anyone who picks it up.

Running three or four devices? A NAS or a shared folder on your PC is the most convenient choice. Kodi writes directly to SMB shares, and file managers like X-plore or Solid Explorer can push TiviMate exports across the network.

Password-protect the share, and don’t expose it to the internet through port forwarding (yes, people still do this). If you already run a home media server, the same share you use for IPTV in Plex can hold backups, ideally in a separate folder with tighter permissions.

Encrypted Cloud Storage Using an Encrypted Container

Cloud storage is fine. The rule is that the file gets encrypted before it ever leaves your PC. Two free tools handle this well:

7-Zip: create a .7z archive, choose AES-256, set a strong passphrase, and tick “Encrypt file names” so even the file list stays hidden.
Cryptomator: create a vault inside your Google Drive or Dropbox folder. Anything you drop in gets encrypted locally before it syncs.

Keep the passphrase in a password manager like Bitwarden or 1Password. Not in a text file sitting next to the archive. Do that, and you’ve only added one extra step for the attacker.

Emailing a backup to yourself feels harmless. It isn’t. The file sits in your inbox indefinitely, and on the mail provider’s servers too. Telegram “Saved Messages” has the same issue, and Telegram’s regular cloud chats aren’t end-to-end encrypted by default.

Worst habit of all: “anyone with the link” sharing. That one setting turns your backup into a public credential dump, and links get forwarded, scraped, and indexed far more often than people assume. Need to move the file to your own second device? Use restricted sharing tied to your account instead.

How to Back Up IPTV and Kodi Settings in Popular Apps

Every app handles exports its own way. Below, you’ll find where the file lands, how to get it off the device, and when to encrypt it. Menu names drift a little between versions, so if a label doesn’t match exactly, go with what’s on your screen.

TiviMate Backup and Restore

TiviMate’s backup feature needs a Premium subscription. The process:

Open TiviMate and go to Settings > General > Backup data.
Choose a folder (internal storage, a USB drive, or a network location if your file picker supports it) and confirm.
Note the file path TiviMate shows; the default TiviMate backup file location varies by device and version, but it’s commonly the Download folder or the root of internal storage.
Copy the file to a PC using a file manager or a USB stick, then wrap it in a 7-Zip AES-256 archive before uploading anywhere.
Delete the unencrypted copy from the Firestick once it’s safely stored.

To restore, use Settings > General > Restore data and point it at the decrypted file. Whatever format it’s saved in, treat the backup as holding your playlist credentials.

IPTV Smarters and Other Xtream-Based Players

Many Xtream-based players, including several IPTV Smarters builds, don’t offer a full settings export at all. Your real “backup,” then, is the login itself: server URL, username, password. Put those three values in a password manager, not Google Keep or Apple Notes.

Honestly, that’s more secure than a file, since there’s nothing extra lying around to leak. Re-entering a profile takes maybe a minute. Afterward, reapply your tweaks with guides like IPTV Smarters Pro settings worth changing or player settings that affect performance. Players with their own export option, like TVLok, should get the same treatment as TiviMate; our TVLok settings guide shows where those options live.

Kodi: Backup Addon vs Copying the Userdata Folder

Kodi gives you two realistic paths. The Backup addon (program.backup) from the official repository creates scheduled ZIP backups to local storage, a network share, Dropbox, or Google Drive. Handy. But its cloud destinations upload the archive as-is, completely unencrypted.

The manual route means copying the userdata folder. On Android devices, a Kodi userdata backup on Firestick means grabbing Android/data/org.xbmc.kodi/files/.kodi/userdata. Newer Fire OS versions block many file managers from reading Android/data (frustratingly), so pointing the Backup addon at a USB drive or SMB share is usually the easier move.

Whichever you pick, encrypt before uploading. If you want to encrypt a Kodi backup automatically, have the addon write to a Cryptomator vault folder on a PC share. For version upgrades and rollbacks, use our Kodi 21.3 Firestick upgrade guide; this article sticks to the security side. The official Kodi wiki on userdata explains what each file does.

Stremio: Account Sync and What It Means for Security

Stremio barely uses file backups. Installed addons, your library, and watch progress all sync to your Stremio account, so signing in on a new device brings everything back automatically.

Here’s the catch, and it’s a big one. Many configured addons embed your debrid API key directly in the addon URL, and that URL gets saved to your account. Whoever gets your Stremio password gets your debrid key along with it. A unique Stremio password matters more than any file backup ever could.

Never Restore Someone Else’s Backup or Build

Forum “builds” and shared backups are tempting. One click, fully configured setup. They’re also one of the easiest ways to compromise a streaming device.

Shared Builds Can Contain Leaked or Planted Credentials

A downloaded build might ship with someone else’s stolen debrid key. Use it, and you risk getting the original account banned while dragging your own IP into the mess. Worse still, builds often bundle unknown repositories that push updates you never approved.

Some go further. Altered addons can redirect traffic or quietly harvest any logins you add later. Apply the same caution to APKs: install only from official sources, and check signatures where you can.

Checking a Backup Before Restoring It

Even your own old backups deserve a quick look. Before restoring, run through these checks on a PC:

Search for credentials (the findstr or grep method above) and confirm they’re yours.
Open sources.xml and list the repo URLs; remove anything you don’t recognize.
Look in addons for repositories you never installed.
Scan the extracted folder with your antivirus or upload individual APKs to VirusTotal.

Good backup hygiene pairs well with network privacy. Our piece on using IPTV with a VPN covers the traffic side of the same problem.

Your Backup Leaked: Rotate These Credentials Now

Maybe a backup got shared publicly. Maybe it sat unencrypted in an account that was breached, or stayed on a Firestick you sold on eBay. Either way, move fast. Work through this list in order, starting with whatever costs you money.

Change Your IPTV Provider Password or Request New Line Credentials

Log in to your provider’s customer panel and change the line password, if that option exists. Keep in mind that IPTV credentials in an M3U URL stay valid until the password changes, so every old link has to be replaced.

Plenty of services sold through resellers don’t give customers a panel at all. In that case, open a support ticket asking for new line credentials. Then update every device, plus any Plex or Threadfin setup still pointing at the old M3U.

Revoke and Regenerate Debrid API Keys

For Real-Debrid, change your account password first, then go to the API token page and use the reset option to generate a fresh private token. AllDebrid and Premiumize have similar key management in their account settings.

Next, re-authorize each Kodi resolver (ResolveURL and similar) and reconfigure your Stremio addons with the new key. Old addon URLs containing the leaked key need to come off your Stremio account entirely.

Remove Trakt App Authorizations

On Trakt, go to Settings > Connected Apps and revoke every authorization. Then re-link only the apps you still use. Any token copied from your backup stops working.

Secure the Cloud Account That Held the File

Last step: lock down the storage account itself. Checklist:

Change the password to a unique one from your password manager.
Enable two-factor authentication, preferably with an authenticator app or passkey.
Review active sessions and connected apps, and sign out anything unfamiliar.
Delete the leaked file, empty the trash, and revoke any share links.

A Simple Backup Routine for Cord-Cutters

The safest way to back up IPTV and Kodi settings is a routine you’ll actually stick with. Back up after major changes. Daily is overkill. Encrypt every copy, keep two (one of them offline), and prune old versions so stale credentials don’t quietly pile up across your drives.

Here’s a short checklist to print and tape near your setup:

☐ Back up after adding playlists, addons, or changing providers
☐ Encrypt with 7-Zip AES-256 or Cryptomator before uploading
☐ Keep one copy on USB or NAS, one in encrypted cloud storage
☐ Delete unencrypted copies from the device and Downloads folder
☐ Remove backups older than your last two versions
☐ Rotate IPTV, debrid, and Trakt credentials once a year
☐ Enable 2FA on every cloud account holding backups

My take is simple: a backup should save you time without costing you control. Back up IPTV and Kodi settings with encryption and sensible storage, and a breached cloud account becomes an annoyance. Not a full streaming lockout.

⚖️ Legal Disclaimer: IPTV Wire does not own or operate any streaming service, application, or website mentioned in this article. We do not verify whether third-party services carry proper licensing. Users are responsible for ensuring they comply with copyright laws in their jurisdiction.

Frequently Asked Questions

Does a TiviMate backup file contain my IPTV password?

Assume it does. TiviMate backups include your playlists, which means Xtream logins or M3U URLs with credentials embedded in them. Encrypt the file before it goes anywhere online.

Is it safe to store Kodi backups on Google Drive?

Only if you encrypt the backup first. An unencrypted Kodi backup exposes addon settings, debrid tokens, and saved network passwords to anyone who gets into your Google account. Use a 7-Zip AES-256 archive or a Cryptomator vault.

What should I do if my Real-Debrid API key was exposed?

Change your Real-Debrid password, reset your private API token from the account’s API page, and re-authorize your Kodi resolvers and Stremio addons. Then remove any old addon URLs that contained the leaked key.

Can I restore a Kodi backup from one Firestick to another?

Usually, yes, as long as both devices run the same major Kodi version. Restoring across major versions (say, 20 to 21) can break addons, so update first. Our Kodi 21.3 upgrade guide covers the migration details.

How do I encrypt a streaming app backup before uploading it?

Copy the backup to a PC, right-click it, and use 7-Zip to create a .7z archive with AES-256 and “Encrypt file names” turned on. Or drop it into a Cryptomator vault inside your cloud-synced folder.