Originally published at: How to Install TVLok IPTV Player - Firestick/Android/Google TV
In this guide, we are installing the TVLok IPTV Player on popular media devices including Android/Android TV, Google TV, and Fire TV systems. TVLok is a feature-rich IPTV Player with tons of settings and configurations for watching live television on your preferred device. It is considered a Premium player because you must purchase a subscription…
TV Lok is a new IPTV player app that just might be the player to dethrone TiviMate as the best out there. It has recording, timeshift, multi screen, along with all the other bells and whistles. Even though it is still in beta release mode, updates are continuing and the staffers/programmers are very responsive to customer support requests and inquiries. Currently, TV Lok is offering a lifetime premium subscription for $39 for up to 10 devices. Based on my experience so far with the app, I’d recommend Troy try this out and give us a review.
7 day FREE TRIAL too. Good to see you @sim_bill!
I might need to give this a trial.
U2! I took advantage of the special premium app sale and am glad I did. They are only giving it to the first 1,000 subscribers before going up on the price.
Thanks for sharing we’ll add to the list!
Just saw an announcement on their Telegram page that IOS, Windows and Mac versions will be activated in the future and once those versions drop and the 1,000 premium subscription limit is reached, subscription prices will definitely increase. This will probably be dictated by product demand.
Vibecoded app. AI generated.
Man, why is there suddenly such a huge influx of iptv players? I’m just not comfortable shelling out money to some new player on the block, without some major backing of troypoint members. For now I’ll stick to tivimate. sparkle, mytvonline3. It’s getting a bit overwhelming with so many choices here of late. But thanks for sharing sim_bill
Because, it’s a market that until recently hadn’t really became popular.
There’s a few good ones in the works right now. But like all things on the high seas people should always use caution.
Looks like they took features from other apps and gave them to AI trying to copy another app. The most likely aren’t dev’s but trying to get in on some money. Just be careful with your info .
Thanks for checking into it Ted!
Hi Ted, I’m the developer of TVLok. Thanks for taking the time to examine it.
I’d like to touch base with you directly and discuss your concerns in more
detail. If you’re willing, please message me or I can message you. I’d also be
happy for you to verify the fixes afterward. A safer app is better for
everyone who uses it. Also, TVLok is being rewritten from scratch right now,
so there’s a lot of opportunities to close these gaps.
One important distinction: the backend request returned a 401. That means the
server rejected an unauthenticated request exactly as intended. Nothing shown
here indicates that another user’s credentials were accessed or that the
backend exposed them.
Your local inspection did uncover some legitimate hardening work, but the
statement that TVLok’s complete database is plaintext is incorrect. Provider
credentials stored locally use Android’s Keystore-backed encrypted storage,
and the main catalog databases use SQLCipher.
You’re right about cloud sync. If a playlist is synced we upload the
connection details: server, username, password, URL, EPG URL, and the
Stalker MAC. That’s what makes a playlist show up on your other devices, 5
of them on an annual plan. It goes over HTTPS and it’s encrypted at rest
with AES-256-GCM, and only the authenticated account that owns it can pull
it back. But it isn’t end-to-end encrypted, because we have to be able to
restore it to your other devices. We hold the key, so we can decrypt it.
Nobody should have to decompile an app to find that out. That part is my
fault and I’m fixing it.
The EPG database is unencrypted because it contains guide listings rather
than provider credentials. The temporary import database is also unencrypted
and can briefly contain M3U URLs or headers. That is a fair finding, and I’m
going to remove or encrypt that sensitive temporary data.
The database-key concern is also a real tradeoff. Some Fire TV devices
invalidated Keystore keys during updates and caused users to lose their local
data, so the catalog key is currently kept in app-private storage. I chose
reliability over stronger protection against a complete rooted-device
extraction, but I’ll document that properly and continue improving it.
One thing I want to be clear about, because I think people reading this are
coming away more worried than the findings warrant. Everything in that
device list needs root or physical extraction of the device. Those files are
in app-private storage, Android backup is off in our manifest, and release
builds aren’t debuggable, so no other app on the phone and nothing remote
can reach them. For what it’s worth, keeping provider credentials in
plaintext locally is pretty normal in this category. Ours are encrypted.
None of that makes the temporary database okay.
For context, not as an attack on another application, the specific TiviMate
version I inspected stored IPTV credentials locally in readable plaintext.
TVLok already encrypts those credentials locally. I can’t speak for every
TiviMate release, but that was true of the version tested.
TVLok’s own services are HTTPS-only. Some IPTV providers still use plain
HTTP, and every player connecting to those providers inherits that risk.
I’ll add a clear warning when a provider is not using HTTPS.
TVLok is still early, and this is exactly the kind of useful beta finding I
want. That isn’t an excuse, it’s an opportunity to fix a real gap before the
app grows. I appreciate the technical review and would genuinely like to
follow up with you.
Anyway, I appreciate the review. If you find anything else I want to hear it.
I can only post once a day for now, so had to add this:
One clarification worth making, because I think it’s the crux of this.
What you inspected was local data on a device you control, with extraction access. That’s a different category from another user’s data being exposed. I checked whether the finding was actually unusual by running the same method against another established player, and the version of TiviMate I looked at kept provider URLs, usernames and passwords in readable form on the device(this is common in this space). I’m not raising that as a knock on them, and it doesn’t mean their users are exposed, because it isn’t that kind of finding. The same applies to what you found here.
Some history on that temp file, since it’s the fair finding here. It wasn’t always plain. It started encrypted and I changed it, because encrypting a scratch file that gets wiped after every import was costing real time on big playlists, 162 seconds on the VOD stage and 206 on EPG in my own measurements. The catalog database is still encrypted. Looking at how other players handled it told me the tradeoff was normal. Where I got it wrong is M3U playlists, where those rows can still hold URLs, and that’s the part I’m fixing.
Worth separating two things as well: the local files you read, and the synced record. You read the first. The second you didn’t, which is what that 401 was, the server refusing an unauthenticated request. You were right about what the sync contains anyway, because I told you rather than leaving you to guess.But reading decompiled code tells you what a function can do, not what the app actually does at runtime. That gap is where “the complete database is plaintext” came from, when in fact it was one temporary file, and one that needs root or physical possession of the box to reach at all. At that point every app on the device is readable.
I’d rather find common ground here. If you’re up for comparing notes on other players in this space, I think that makes things better for IPTV users generally, and I’d welcome it.
One last thing I would say, there’s nothing wrong with AI. A vibe coder with zero dev experience can’t build TVLok. Nobody builds anything without AI in 2026. I have been a dev for 5-7 years and work in a reputable company that I will not disclose.
Fable, Codex Sol 5.6 Ultra + another security systems check + my experience in programming all give TVLok a pass on security. All the things Ted called out have explanations that are fairly reasonable and industry practice. Some claims are just false!
Thanks for reading my Ted talk.
Use ai to figure out the problems you missed.
Now that’s funny right there. There’s other things I didn’t mention but with your experience you should be able to find and fix them on your own .
Would be nice to know where to send an invoice .
On a different note, Welcome to this great community 
On an even differenter note, I think you hold the record for longest first post ever, here on the Insider. 
At least the developer took the time and effort to reply and provide a detailed response. He also offered an olive branch. That shows integrity and class. My own experience is that he is very responsive with customer support when they have issues and is doing ongoing updates to improve the app. In fact, on Reddit, he is asking for people to try and break TV Lok and let him know about it. I’d like to know who else is doing that.
Just to be truthful the app can be broke and rebranded in just a few minutes. That is because of the lack of security . All of those features are already in another app that has a lot of security and the rebranders gave up on it . The features is what drew my attention because I knew each one of them .
There are a lot of very good IPTV apps, including TiviMate that can be branded.