Xtream Codes Checker: Test Your Login Credentials Online

A Xtream Codes checker tests whether a portal address, username, and password actually work. Used correctly — on your own account — it’s the fastest way to find out whether a login failure is your credentials or your player. Used on other people’s credentials, it’s credential abuse. This guide covers the legitimate use.

Scope of this page. A Xtream Codes checker verifies the login: are the credentials accepted, and what is the account status? If you need the full-service health check — portal reachability, channel and VOD counts, and whether streams actually play — use the IPTV Checker instead. For connection speed or stutter diagnosis, see the IPTV buffering test.

What a checker actually does

A checker performs the same request a player does at login. It calls the portal’s API and reads the reply:

GET /player_api.php?username=USERNAME&password=PASSWORD

The response includes a user_info object with two key fields:

Field	Meaning
auth	1 = credentials accepted, 0 = rejected
status	Active, Expired, Disabled, or Trial

That’s the whole job: confirm the login and report the account status. Everything else — connection speed, channel counts, EPG health — is extra.

Checking your own account without installing anything

You don’t need a dedicated app. Use a browser or curl:

1. Open your portal’s API URL in a browser: http://PORTAL/player_api.php?username=YOURUSER&password=YOURPASS
2. Look for the user_info block in the JSON response.
3. If auth is 1 and status is Active, your credentials work.

With curl:

curl "http://portal.example:8080/player_api.php?username=USER&password=PASS"

If you’d rather not expose the URL in a browser history, paste it into a private note, run the request, and clear it. The full endpoint details are in the API reference.

What the results tell you

• auth: 1 and status: Active — your login is fine. If a player still fails, the problem is the app or the device, not the credentials.
• auth: 0 — the username or password is wrong. Re-check for typos, capitalization, and trailing spaces.
• status: Expired or Disabled — your password is accepted but the account is blocked. Renew or contact your provider.
• auth: 1 but channels are empty — the account may be a content-limited trial, or the portal is mid-refresh.

See Xtream Codes authentication for how these fields work.

Choosing a checker tool

If you want a purpose-built tool, prefer one that:

• Checks one account at a time — single-account checkers are for personal use; multi-account “list” checkers are almost always built for credential abuse.
• Is open source — inspectable code you can read before running.
• Runs locally — a web-based checker means sending your credentials to a stranger’s server. Avoid that.

Red flags: tools that ask for “username:password:host lists”, promise to find “working accounts”, or share results with a community. Those are credential-theft operations, not utilities. See Xtream Codes security for the full threat model.

The safe way to check, in short

1. Only check your own credentials.
2. Only check against portals you are authorized to access.
3. Prefer a browser or curl over third-party checkers.
4. Never paste credentials into a website or tool you don’t control.
5. When in doubt, log in with a normal player instead — it does the same thing.

Related reading

• Xtream Codes Authentication — what the check actually verifies.
• The Xtream Codes API — the raw endpoint behind every checker.
• Xtream Codes Security — keep credentials safe while testing.
• IPTV Checker — the full-service health check, beyond the login.