How to Set SRT Latency and Encryption in FFmpeg

This article provides a direct guide on how to configure latency and AES encryption for Secure Reliable Transport (SRT) streams using FFmpeg. Setting appropriate latency ensures smooth playback over unstable networks by allowing time for packet retransmission, while enabling SRT's built-in encryption secures your video feed against unauthorized interception.

Setting SRT Latency

Latency in the SRT protocol defines the time window allocated to buffer packets and retransmit lost data. In FFmpeg, the latency parameter is appended to the SRT URL query string and is measured in microseconds (1 second = 1,000,000 microseconds).

To set a 2-second (2000 ms) buffer, specify latency=2000000:

ffmpeg -re -i input.mp4 -c copy -f mpegts "srt://192.168.1.50:9000?latency=2000000"

You can also control latency independently for the receiver and sender using:

  • rcvlatency: Receiver-side latency in microseconds.
  • peerlatency: Sender-side latency advertised to the receiver in microseconds.

If only latency is defined, it sets both rcvlatency and peerlatency to that value.

Setting SRT Encryption

SRT utilizes pre-shared keys and AES encryption. To enable encryption in FFmpeg, use the passphrase and pbkeylen parameters:

  • passphrase: The shared secret key. It must be between 10 and 79 characters long.
  • pbkeylen: The encryption key length in bytes. Accepted values are:
    • 16 for AES-128
    • 24 for AES-192
    • 32 for AES-256 (recommended)

Example with AES-256 encryption:

ffmpeg -re -i input.mp4 -c copy -f mpegts "srt://192.168.1.50:9000?passphrase=YourSecretPassword123&pbkeylen=32"

Combined Example: Latency and Encryption

Parameters are separated by an ampersand (&) within the URL query string. Always wrap the entire URL in quotation marks to prevent the shell from interpreting the ? and & characters.

Sender (Caller Mode)

Stream a local file to a remote SRT listener with a 1.5-second buffer and AES-256 encryption:

ffmpeg -re -i input.mp4 -c:v libx264 -c:a aac -f mpegts "srt://receiver_ip:9000?mode=caller&latency=1500000&passphrase=SecureStreamPass123&pbkeylen=32"

Receiver (Listener Mode)

Listen for the incoming stream on port 9000 with matching latency and decryption parameters:

ffmpeg -i "srt://0.0.0.0:9000?mode=listener&latency=1500000&passphrase=SecureStreamPass123&pbkeylen=32" -c copy output.mp4

Both endpoints must use identical passphrase and pbkeylen values to establish the connection, and setting identical latency values ensures reliable synchronization.