Direct answer
Keep credentials in the client’s protected credential fields or secret store, not in copied URLs. Use a unique view-only account and rotate it if a working URI was exposed.
Why this happens
User information embedded in a URI can be captured by shell history, process arguments, logs, crash reports, screenshots and pasted tickets. Reserved characters also make parsing fragile.
Keep camera services private, minimize credential exposure and document every trust boundary.
A controlled test
Search only the systems you administer for the known account name or sanitized pattern, then remove or rotate exposed secrets according to policy.
Change one variable at a time. Keep the camera model, firmware, endpoint and account recorded; then test network reachability, protocol response, media transport and decoding as separate layers.
Use a dedicated view-only account and a trusted local diagnostic tool. Redact credentials, private addresses and identifying data before sharing output.
Diagnostic sequence
| Check | Action | Evidence of progress |
|---|---|---|
| Client | Move credentials out of the URI where supported. | Saved endpoints contain no reusable password. |
| Privileges | Use a dedicated view-only account. | The stream credential cannot change device settings. |
| Telemetry | Review logs, history and diagnostics. | Sensitive fields are redacted before export. |
| Rotation | Replace credentials after confirmed exposure. | Old URLs no longer authenticate. |
Evidence to keep
Document the leak locations and rotation time without copying the secret into the incident record.
Boundary and safety note
Do not upload private camera URLs to public stream testers or AI tools, even when the camera is temporarily unreachable.
For remote viewing, use a managed VPN instead of exposing RTSP or camera administration ports directly to the public internet.
SmartRTSP
SmartRTSP is a camera-focused RTSP and ONVIF viewer for Apple devices, Windows and Android. It fits direct viewing, discovery and multi-camera checks; keep a dedicated NVR or VMS when continuous recording, evidence export or centralized enterprise controls are required.
Frequently asked questions
Is rtsp://user:pass@host safe?
It is widely recognized by clients but raises exposure risk in logs, history and copied text.
What if the viewer requires an embedded password?
Use a unique least-privilege account and keep the URI inside a protected configuration store.
Should I rotate after sharing a screenshot?
If the screenshot contained a usable credential or token, rotate it and review where the image was shared.
Primary references
- IETF RFC 3986 — URI generic syntax
- U.S. FTC — How to secure home security cameras
- CISA — Secure by Design guidance
Related SmartRTSP guide
Open related guideTrace camera passwords through logs, browser history, process lists, screenshots and support tools before sharing a stream.