MQTT

MQTT is the group chat for machines: nobody addresses anybody, everyone just posts to a topic and the broker plays postman.

The short answer

MQTT is an OASIS standard messaging protocol for the Internet of Things. It is a very lightweight publish/subscribe transport made for small devices and thin network links [1][2]. Clients never talk to each other directly. They connect to a broker, publish messages to topics and subscribe to topics they care about [1][3]. In a home lab, MQTT is the glue between sensors, Zigbee bridges and Home Assistant [6].

How it works

1. Broker and clients. A broker such as Eclipse Mosquitto receives every message and forwards it to matching subscribers. Home Assistant's documentation calls running your own broker the easiest and most private option and recommends the Mosquitto app [6].
2. Topics and filters. A topic is a label such as home/livingroom/temperature. A subscription uses a topic filter that can include wildcards: + matches one level and # matches several levels [3].
3. Quality of service. MQTT defines three levels: 0 at most once, 1 at least once, 2 exactly once [1]. Higher levels cost more traffic, so choose per use case.
4. Retain and will. A retained message is stored on the broker for future subscribers, which is handy for the last known state. A will message is published by the broker if a client's connection closes abnormally, which can signal that a device went offline [3][6].
5. Versions and ports. The standard exists as MQTT 5 and as the older MQTT 3.1.1, which is an ISO and OASIS standard [2]. The 3.1.1 text notes in a non-normative comment that TCP ports 1883 (plain) and 8883 (TLS) are registered with IANA [4].
6. Secure defaults. Since Mosquitto 2.0, a broker started without configured listeners binds only to loopback, so only the local machine can connect [5]. Once you define a listener, allow_anonymous defaults to false, so clients need credentials [7]. In 1.6.x and earlier, it defaulted to true unless another security option was set [7].

A home example

Our inventory (as of 14 to 16 Oct 2026) records no MQTT broker, so this is an invented set-up. A Docker VM in our homelab runs Portainer, n8n and Homarr (as of 1 Oct 2026); nothing there is an MQTT broker. Imagine you add a Mosquitto container next to them. A temperature sensor publishes home/livingroom/temperature and Home Assistant subscribes via MQTT discovery. If you expose port 1883 to the LAN, you must configure a listener, and with it comes the authentication requirement [5][7]. For anything beyond the LAN, use TLS on 8883 [4].

Checklist

• Run one broker and note which clients connect to it [6].
• Name topics in a pattern, such as place/room/measurement (our assessment).
• Create user accounts and keep allow_anonymous at false on any exposed listener [7].
• Use retained messages for state, not for events (our assessment).
• Turn on TLS before you let traffic cross untrusted networks [4].
• Test with a second client that subscribes to # on a lab broker, never on a production one (our assessment).