Configure SRT URL Passphrase in FFmpeg

This article explains how to secure your Secure Reliable Transport (SRT) streams by configuring an encryption passphrase in FFmpeg. You will learn the specific URL parameters required to enable AES encryption, how to define the key length, and see practical command-line examples for both sending and receiving encrypted SRT streams.

To configure encryption for an SRT stream in FFmpeg, you must append the encryption parameters directly to the SRT destination or source URL as query string parameters. The two key parameters required are passphrase and pbkeylen.

The SRT Encryption Parameters

• passphrase: This is the password used to encrypt the stream. The passphrase must be between 10 and 79 characters long.
• pbkeylen: This defines the crypto key length in bytes. FFmpeg supports three values:
  • 16 for AES-128 encryption (default)
  • 24 for AES-192 encryption
  • 32 for AES-256 encryption

URL Syntax

The standard format for an encrypted SRT URL in FFmpeg is:

srt://<IP_ADDRESS>:<PORT>?passphrase=<YOUR_PASSPHRASE>&pbkeylen=<KEY_LENGTH>

Note: Always enclose the SRT URL in quotation marks in your command line to prevent the shell from misinterpreting the ? and & characters.

Examples

1. Streaming (Caller Mode) with 256-bit Encryption

To stream a local video file to a remote SRT receiver with AES-256 encryption, use the following command:

ffmpeg -re -i input.mp4 -f mpegts "srt://192.168.1.100:9000?passphrase=MyVerySecurePassword123&pbkeylen=32"

2. Receiving (Listener Mode) with 256-bit Encryption

To set up FFmpeg to listen for an incoming encrypted SRT stream, match the passphrase and key length configured on the sender’s side:

ffmpeg -i "srt://0.0.0.0:9000?mode=listener&passphrase=MyVerySecurePassword123&pbkeylen=32" -c copy output.mp4

Troubleshooting Tips

• Connection Drops: If the connection drops immediately after initiating, verify that both the sender and receiver are using the exact same passphrase and pbkeylen.
• Passphrase Length: Ensure your passphrase is at least 10 characters long; otherwise, the SRT library will reject the connection and fail to initialize encryption.