---
title: "MQTT Security: TLS, Authentication & Access Control | ConnectMQ"
description: "How ConnectMQ secures MQTT: TLS and secure WebSockets, username/password authentication, per-topic access control and private, isolated broker instances."
url: "https://connectmq.com/security/"
language: "en"
---

Security

# MQTT that is secure by default

Encryption, authentication, access control and isolation are part of every ConnectMQ broker — the layers you would otherwise have to build into a self-hosted broker yourself.

[Try it free](https://app.connectmq.com/signup) [See pricing](https://connectmq.com/pricing/)

No card required

## Encryption in transit

Connect over MQTT/TLS (port 8883) or secure WebSockets (port 8084) so credentials and payloads are never sent in clear text.

## Authentication

Every client identifies itself with a username and password. Give each device or service its own credentials so you can revoke one without touching the rest.

## Per-topic access control

Grant publish and subscribe rights per topic. A sensor can write its own telemetry without being able to read anyone else’s.

## Isolation

Your broker is a private instance. Unlike public test brokers, no other tenant can subscribe to your topics.

Access control

## Give every client exactly the topics it needs

Design your topic tree around devices and directions — telemetry up, commands down — and grant each credential only its own branch. A compromised device can then only affect itself.

permissions

```
# Example permissions
sensor-17   publish    devices/sensor-17/telemetry
sensor-17   subscribe  devices/sensor-17/commands
dashboard   subscribe  devices/+/telemetry
backend     publish    devices/+/commands
```

Checklist

## Production security checklist

| Practice | Why |
| --- | --- |
| Use TLS or WSS for every production client | Plain TCP (1883) and ws (8083) are for local tests only. |
| One credential per device or service | Revoke a single client without rotating the whole fleet. |
| Least-privilege topics | Devices write to their own topic branch and read only their command topic. |
| Never put secrets in topic names or client IDs | They appear in logs and dashboards. |
| Keep test traffic off public brokers | Anyone can read topics on public sandboxes. |

## Security FAQ

Is MQTT traffic to ConnectMQ encrypted?

Yes, when you connect with TLS (mqtts, port 8883) or secure WebSockets (wss, port 8084). The plain TCP and WebSocket ports exist for quick tests and environments that cannot use TLS.

Can I restrict what each device can do?

Yes. ConnectMQ supports per-topic access control, so you can allow a device to publish to its telemetry topic and subscribe to its command topic — and nothing else.

Why not just use a free public MQTT broker?

Public brokers have no authentication and no isolation: anyone can subscribe to your topics or publish fake data. They are fine for learning, not for real devices.

## Get a private, secured MQTT broker

Create an account, get your broker credentials and connect your first device — no servers to install, patch or scale.

[Get started](https://app.connectmq.com/signup) [See pricing](https://connectmq.com/pricing/)

## Articles

[All articles](https://connectmq.com/blog/)

MQTT Security

### [MQTT Security Best Practices: A 12-Point Checklist for IoT Teams](https://connectmq.com/blog/mqtt-security-best-practices/)

A hands-on MQTT security checklist covering TLS, credentials, client IDs, topic design, payload validation, rate limits and certificate checks, plus how ConnectMQ handles each point.

September 28, 202611 min read

Managed MQTT Cloud

### [How to Choose an IoT MQTT Broker: 12 Criteria and the Questions to Ask Your Vendor](https://connectmq.com/blog/how-to-choose-an-iot-mqtt-broker/)

A practical 12-point checklist for choosing an IoT MQTT broker, a table of questions to ask every vendor, and a five-minute hands-on test you can run against broker.connectmq.com.

September 21, 20269 min read

MQTT Security

### [ESP32 Certificate Pinning and CA Validation for MQTT](https://connectmq.com/blog/esp32-certificate-pinning/)

Three ways to validate a broker certificate on an ESP32: embed a root CA, use the ESP-IDF certificate bundle, or pin. Learn the trade-offs and get working MQTT code for each.

September 4, 20267 min read