Direct answer
Prefer separate username and password fields. If a client requires credentials inside the RTSP URI, percent-encode reserved characters in the user-information component and test with a non-administrator account.
Why this happens
Characters such as @, :, #, %, ? and / have structural meanings in a URI. An unencoded password can therefore change where the host or path appears to begin.
Treat the URL, credentials, address family and RTP transport as separate variables that can fail independently.
A controlled test
First prove the endpoint with a temporary test account that uses unreserved characters, then restore a strong password and verify the client’s documented encoding behavior.
Change one variable at a time. Keep the camera model, firmware, endpoint and account recorded; then test network reachability, protocol response, media transport and decoding as separate layers.
Use a dedicated view-only account and a trusted local diagnostic tool. Redact credentials, private addresses and identifying data before sharing output.
Diagnostic sequence
| Check | Action | Evidence of progress |
|---|---|---|
| Fields | Use dedicated credential fields when available. | The URL contains no secret and parses consistently. |
| Encoding | Encode only the credential component, not the whole URL. | Host, port and path remain readable. |
| Logs | Review screenshots and debug output for exposed secrets. | Credentials are redacted before sharing. |
| Account | Use a unique view-only camera account. | Compromise does not grant administration rights. |
Evidence to keep
Document the raw character class and the encoded form without recording the real password. A synthetic example is enough to reproduce parsing behavior.
Boundary and safety note
Never paste a real credential-bearing RTSP URL into a public online player, search box, issue tracker or analytics tool.
For remote viewing, use a managed VPN instead of exposing RTSP or camera administration ports directly to the public internet.
SmartRTSP
SmartRTSP is a camera-focused RTSP and ONVIF viewer for Apple devices, Windows and Android. It fits direct viewing, discovery and multi-camera checks; keep a dedicated NVR or VMS when continuous recording, evidence export or centralized enterprise controls are required.
Frequently asked questions
What should I do if my password contains @?
Use a separate password field or percent-encode the @ within the credential component as %40.
Should I encode the entire RTSP URL?
No. Encoding the whole URL can also hide required separators; encode only the component that needs it.
Is putting credentials in a URL safe?
It increases the chance of leaks through logs, history and screenshots, so separate credential storage is preferable.
Primary references
- IETF RFC 3986 — URI generic syntax
- IETF RFC 7826 — Real-Time Streaming Protocol 2.0
- U.S. FTC — How to secure home security cameras
Related SmartRTSP guide
Open related guidePrevent reserved password characters from being misread as RTSP URI separators while avoiding credential leaks.