A free public MQTT broker is the fastest way to try MQTT: no account, no installation, just a hostname and a port. In this tutorial you will connect to broker.connectmq.com, learn the rules of its anonymous public area and its limits, and run working examples with the Mosquitto CLI, Python, Node.js and the browser. At the end you will know exactly when it is time to move to a private broker.
If you are new to the protocol, start with What Is an MQTT Broker? and come back here for the hands-on part.
What Is a Free Public MQTT Broker?
A public MQTT broker is a broker that anyone on the internet can connect to without credentials. It is meant for learning, demos, quick prototypes and debugging client code. You get a real broker that speaks MQTT 3.1.1 and MQTT 5.0, but you share it with everyone else who is testing at the same moment.
That sharing has one important consequence: anything you publish in the public area can be read by anyone. Treat it like a public whiteboard. It is perfect for "hello world", sensor simulations and protocol experiments, and completely wrong for passwords, personal data or production traffic.
broker.connectmq.com Connection Details
The ConnectMQ public broker listens on four endpoints. Pick the one that matches your client and network.
| Protocol | Port | URL | Typical use |
|---|---|---|---|
| MQTT (TCP) | 1883 | mqtt://broker.connectmq.com:1883 | CLI tools, microcontrollers, quick tests |
| MQTT over TLS | 8883 | mqtts://broker.connectmq.com:8883 | Encrypted connections from servers and devices |
| WebSocket | 8083 | ws://broker.connectmq.com:8083/mqtt | Local web experiments |
| Secure WebSocket | 8084 | wss://broker.connectmq.com:8084/mqtt | Browsers and HTTPS pages |
Ports 8883 and 8084 use a Let's Encrypt certificate, so standard operating system CA bundles verify it without extra files. If your network blocks unusual ports, WSS on 8084 is often the easiest path because it looks like regular HTTPS-style traffic to most proxies.
Anonymous Access Rules
You do not need a username or password. Three simple rules apply:
- Use a non-empty client ID. Connect without username and password but with a client ID such as
demo-7f3a91. An empty client ID is rejected. Make it unique — under the MQTT specification, a second connection with the same ID takes over the session and the first client is disconnected. - Use a unique topic prefix. Put everything under a prefix nobody else will guess, for example
connectmq/demo/<your-random-id>/.... This avoids collisions with other testers and keeps your topic tree tidy. - Assume everything is public. Anonymous clients land in a shared public area. Public clients only see other public clients' topics — they are isolated from paying tenants — but inside the public area any client can subscribe to
#and read your messages.
A handy trick is to generate a random ID once and reuse it as both client ID base and topic prefix:
export ID=demo-$(openssl rand -hex 3)
echo $ID # e.g. demo-7f3a91
Public Area Limits
The public area is generous for testing but intentionally bounded so it stays healthy for everyone.
| Limit | Value |
|---|---|
| Maximum message size | 64 KB |
| Publish rate | 10 messages per second per client |
| Subscriptions | 10 per client |
| Topic depth | Maximum 8 levels |
| QoS levels | 0, 1 and 2 |
| Retained messages | Supported |
Wildcard subscriptions (+, #) |
Supported |
Shared subscriptions ($share/{group}/{filter}) |
Supported |
| Session expiry | Up to 30 minutes |
If you exceed a quota, MQTT 5 clients receive a reason code such as 0x97 (Quota exceeded) instead of a silent failure, which makes debugging much easier. Not sure which QoS to pick? See MQTT QoS Levels Explained.
Try the Free Public MQTT Broker with the Mosquitto CLI
The Eclipse Mosquitto command-line tools are the quickest way to see messages flow. Open two terminals.
Terminal 1 — subscribe to your prefix:
mosquitto_sub -h broker.connectmq.com -p 1883 -i $ID-sub -t "connectmq/demo/$ID/#" -v
Terminal 2 — publish a message:
mosquitto_pub -h broker.connectmq.com -p 1883 -i $ID-pub -t "connectmq/demo/$ID/temperature" -m '{"value": 22.5, "unit": "C"}'
Terminal 1 prints the topic followed by the payload. To use the encrypted port, add your system CA bundle (path shown for most Linux distributions):
mosquitto_pub -h broker.connectmq.com -p 8883 --capath /etc/ssl/certs -i $ID-tls -t "connectmq/demo/$ID/tls" -m "hello over TLS" -V mqttv5
On Windows or macOS, point --cafile at a PEM CA bundle instead (for example the one shipped with Git for Windows). The -V mqttv5 flag switches the client to MQTT 5.0.
Retained Message Demo
A retained message is stored by the broker and delivered immediately to every new subscriber of that topic. It is ideal for "last known state" values such as device status.
# Publish a retained status
mosquitto_pub -h broker.connectmq.com -p 1883 -i $ID-pub -t "connectmq/demo/$ID/status" -m "online" -r -q 1
# A brand-new subscriber receives it instantly, even though it was published earlier
mosquitto_sub -h broker.connectmq.com -p 1883 -i $ID-late -t "connectmq/demo/$ID/status" -v -C 1 -W 5
# Clear the retained message by publishing an empty retained payload
mosquitto_pub -h broker.connectmq.com -p 1883 -i $ID-pub -t "connectmq/demo/$ID/status" -n -r
Always clear retained test messages when you are done — it keeps the public area clean.
Last Will and Testament Demo
A Last Will is a message the broker publishes on your behalf if your client disconnects unexpectedly. Keep the subscriber from Terminal 1 running, then start a "device" with a will:
mosquitto_sub -h broker.connectmq.com -p 1883 -i $ID-device -t "connectmq/demo/$ID/cmd" -k 5 --will-topic "connectmq/demo/$ID/status" --will-payload "offline" --will-qos 1
Now kill that terminal or the process (closing the window works; a clean Ctrl+C disconnect may not trigger the will in every client). Within a few seconds — after the keep-alive expires — Terminal 1 shows:
connectmq/demo/demo-7f3a91/status offline
We verified these commands against broker.connectmq.com while writing this guide.
Python Example (paho-mqtt 2.x)
Install the client with pip install "paho-mqtt>=2.0". The script below connects over TLS, subscribes to its prefix and publishes one reading.
import json
import ssl
import uuid
import paho.mqtt.client as mqtt
DEVICE_ID = f"demo-{uuid.uuid4().hex[:6]}"
PREFIX = f"connectmq/demo/{DEVICE_ID}"
def on_connect(client, userdata, flags, reason_code, properties):
print(f"Connected: {reason_code}")
client.subscribe(f"{PREFIX}/#", qos=1)
client.publish(f"{PREFIX}/temperature", json.dumps({"value": 21.8}), qos=1)
def on_message(client, userdata, msg):
print(f"{msg.topic} -> {msg.payload.decode()}")
client = mqtt.Client(
mqtt.CallbackAPIVersion.VERSION2,
client_id=DEVICE_ID,
protocol=mqtt.MQTTv5,
)
client.tls_set(cert_reqs=ssl.CERT_REQUIRED) # uses the system CA store
client.on_connect = on_connect
client.on_message = on_message
client.connect("broker.connectmq.com", 8883, keepalive=30)
client.loop_forever()
Note that no username_pw_set() call is needed in the public area. For plain TCP, remove tls_set() and use port 1883.
Node.js Example (MQTT.js over mqtts and wss)
Install MQTT.js v5 with npm install mqtt. The same code works over TLS or Secure WebSocket — only the URL changes.
import mqtt from "mqtt";
import { randomBytes } from "node:crypto";
const clientId = `demo-${randomBytes(3).toString("hex")}`;
const prefix = `connectmq/demo/${clientId}`;
// Option A: MQTT over TLS
const url = "mqtts://broker.connectmq.com:8883";
// Option B: MQTT over Secure WebSocket
// const url = "wss://broker.connectmq.com:8084/mqtt";
const client = mqtt.connect(url, { clientId, protocolVersion: 5 });
client.on("connect", () => {
console.log("Connected as", clientId);
client.subscribe(`${prefix}/#`, { qos: 1 });
client.publish(`${prefix}/humidity`, JSON.stringify({ value: 48 }), { qos: 1 });
});
client.on("message", (topic, payload) => {
console.log(topic, payload.toString());
});
client.on("error", (err) => console.error(err.message));
Browser Example over WSS
Browsers cannot open raw TCP sockets, so they use MQTT over WebSocket. Pages served over HTTPS must use wss:// on port 8084. Bundle the code below with your favourite tool (Vite, webpack, esbuild):
import mqtt from "mqtt";
const clientId = "web-" + Math.random().toString(16).slice(2, 8);
const prefix = `connectmq/demo/${clientId}`;
const client = mqtt.connect("wss://broker.connectmq.com:8084/mqtt", {
clientId,
protocolVersion: 5,
});
client.on("connect", () => {
client.subscribe(`${prefix}/#`);
client.publish(`${prefix}/hello`, "Hello from the browser");
});
client.on("message", (topic, payload) => {
const line = document.createElement("div");
line.textContent = `${topic}: ${payload.toString()}`;
document.body.appendChild(line);
});
For a deeper look at paths, ports and proxies, read MQTT over WebSocket.
Free Public MQTT Broker vs. a Private Broker
The public broker is a sandbox. Move to a private broker as soon as any of these is true:
| You need... | Public broker | Private broker on app.connectmq.com |
|---|---|---|
| Privacy | Anyone in the public area can read your topics | Tenant topics are isolated from other tenants and from the public area |
| Authentication | Anonymous, client ID only | Username, password and client ID issued per broker |
| Message size | 64 KB | 256 KB on Serverless (Free), 1 MB on Serverless (Paid) |
| Connections | For testing | Up to 25 (Free), up to 1,000 (Paid), or a Dedicated cluster |
| Tooling | Your own clients | Portal with in-browser MQTT client, live topic explorer, dashboard and alert rules |
Typical signals that you have outgrown the public area: you are sending real customer or device data, you want to stop other people from seeing your topic names, you need stable credentials for a fleet of devices, or you want a dashboard and alerts on your data. Switching is mostly a configuration change — keep the same code, add the username, password and client ID from the portal:
client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2, client_id="YOUR_CLIENT_ID", protocol=mqtt.MQTTv5)
client.username_pw_set("YOUR_USERNAME", "YOUR_PASSWORD")
client.tls_set()
client.connect("broker.connectmq.com", 8883)
Before going live, go through our MQTT security best practices.
Get Started with ConnectMQ
Ready to keep your data private? Create a free account on app.connectmq.com — the Serverless (Free) plan needs no credit card. Choose a plan, create a broker and copy the generated username, password and client ID. Your first private message is a few minutes away.
Frequently Asked Questions
Is broker.connectmq.com really free?
Yes. The public area of broker.connectmq.com is free to use for testing, learning and demos, with no sign-up. It has fair-use limits such as 64 KB per message and 10 messages per second per client.
Do I need a username and password for the public MQTT broker?
No. Connect without credentials and with a non-empty, unique client ID. An empty client ID is rejected.
Can other people see my messages on a public MQTT broker?
Yes. Everything published in the public area can be read by any other public client, so use a unique topic prefix and never send personal or sensitive data. For private data, create a broker on app.connectmq.com.
Which MQTT versions and ports does the public broker support?
It supports MQTT 3.1.1 and MQTT 5.0 on TCP 1883, TLS 8883, WebSocket 8083 and Secure WebSocket 8084 (path /mqtt).
Can I use the free public MQTT broker in production?
It is not designed for production. Use a private ConnectMQ broker with credentials, tenant isolation and higher limits for any real deployment.



