MQTT Security: TLS and Authentication

Quick answer

MQTT security has three layers: transport encryption with TLS (port 8883), client authentication (username/password, client certificates, or tokens), and authorization that controls which topics a client may publish to or subscribe from.

An MQTT broker usually sits right at the boundary between the public internet and a fleet of devices, which makes it a high-value target. Securing it is not one setting but three layers working together: encrypt the connection, verify who is connecting, and control what they are allowed to do.

The three layers of MQTT security

Transport (TLS) — encrypt the connection so credentials and payloads are never sent in the clear. Secure MQTT (MQTTS) runs on port 8883; plaintext MQTT on 1883 should not face the internet.

Authentication — verify a client's identity on connect using a username/password, an X.509 client certificate, or a signed token, and reject anything that fails.

Authorization — once authenticated, restrict which topics each client may publish to or subscribe from, so a compromised device can't read or write topics it has no business touching.

Those three cover most deployments. For especially sensitive data you can add a fourth, independent layer — payload encryption — encrypting the message body in your clients so it stays private even from the broker.

Every connection passes through encryption, authentication, then authorization

Authentication methods at a glance

Method	How it identifies a client
Basic	Client ID, username and password in the `CONNECT` packet
X.509 certificate chain	The client's certificate presented during the TLS handshake (mutual TLS)
JWT	A signed JSON Web Token carried in the password field
SCRAM	A salted challenge-response — the password never crosses the wire (MQTT 5.0)
HTTP	Credentials validated by an external HTTP service you control

Security in TBMQ

TBMQ implements all three layers. Its listeners support TCP, TLS, and WebSocket (including secure WSS), and it ships five pluggable authentication providers — Basic, X.509, JWT, SCRAM, and HTTP — that you can enable, disable, and order from the UI without restarting the broker. SCRAM is the exception — the broker handles it automatically per the MQTT 5.0 spec, so it isn’t part of that configurable order.

For authorization, TBMQ applies regular-expression topic patterns per client credentials, so you scope each client to exactly the topics it needs. Start with the security concepts guide — the same three-layer model, mapped to TBMQ — then the security overview and the MQTTS setup guide for configuration details.

Frequently asked questions

Is MQTT secure by default?

The MQTT protocol itself carries no encryption or access control — plain MQTT on port 1883 is unencrypted. Security is added around it: TLS for transport encryption, an authentication method to verify each client, and topic authorization to limit what each client can do.

What port does secure MQTT use?

MQTT over TLS (MQTTS) uses port 8883 by default, versus 1883 for plaintext MQTT. Over WebSocket, TBMQ uses 8084 for WS and 8085 for secure WSS.

How do you authenticate MQTT clients?

Common methods are username/password, X.509 client certificates (mutual TLS), and signed tokens such as JWT. The broker validates the chosen credential on CONNECT and rejects the connection if it fails.

What is the difference between authentication and authorization in MQTT?

Authentication proves who a client is when it connects. Authorization decides what an authenticated client may do — specifically which topics it can publish to or subscribe from. A client can be authenticated yet still denied a topic.

Does TLS slow down MQTT?

TLS adds a one-time handshake cost when the connection opens, but MQTT reuses one long-lived connection, so that cost is amortized across every message that follows. The per-message overhead of encryption is small.

Run it yourself

TBMQ is a free, open-source MQTT broker built to scale. Spin it up in minutes or try the live demo — no install required.

Try it now Live demo