Encryption, authentication, access control and isolation are part of every ConnectMQ broker — the layers you would otherwise have to build into a self-hosted broker yourself.
No card required
Connect over MQTT/TLS (port 8883) or secure WebSockets (port 8084) so credentials and payloads are never sent in clear text.
Every client identifies itself with a username and password. Give each device or service its own credentials so you can revoke one without touching the rest.
Grant publish and subscribe rights per topic. A sensor can write its own telemetry without being able to read anyone else’s.
Your broker is a private instance. Unlike public test brokers, no other tenant can subscribe to your topics.
Design your topic tree around devices and directions — telemetry up, commands down — and grant each credential only its own branch. A compromised device can then only affect itself.
# Example permissions
sensor-17 publish devices/sensor-17/telemetry
sensor-17 subscribe devices/sensor-17/commands
dashboard subscribe devices/+/telemetry
backend publish devices/+/commands| Practice | Why |
|---|---|
| Use TLS or WSS for every production client | Plain TCP (1883) and ws (8083) are for local tests only. |
| One credential per device or service | Revoke a single client without rotating the whole fleet. |
| Least-privilege topics | Devices write to their own topic branch and read only their command topic. |
| Never put secrets in topic names or client IDs | They appear in logs and dashboards. |
| Keep test traffic off public brokers | Anyone can read topics on public sandboxes. |
Yes, when you connect with TLS (mqtts, port 8883) or secure WebSockets (wss, port 8084). The plain TCP and WebSocket ports exist for quick tests and environments that cannot use TLS.
Yes. ConnectMQ supports per-topic access control, so you can allow a device to publish to its telemetry topic and subscribe to its command topic — and nothing else.
Public brokers have no authentication and no isolation: anyone can subscribe to your topics or publish fake data. They are fine for learning, not for real devices.
Create an account, get your broker credentials and connect your first device — no servers to install, patch or scale.
