This whitepaper comparing MQTT and AMQP says that MQTT's username/password restrictions make it far less secure than AMQP:

MQTT requires short user names and short passwords that do not provide enough entropy in the modern world.

Section of the MQTT specification says that passwords can be up to 65535 bytes of binary data. A quick calculation shows that this produces a ludicrously large number:

Wolfram Alpha Calculation = 1 x 10^157824

To put that into scale, if you could try one hundred trillion passwords a second, it would take approximately 1 x 1014 million years to exhaust the search space of any password between 1 and 65535 bytes.

Therefore, I can only assume that the author is either incorrect, or that they were talking about a restriction that occurred previously but has now been lifted.

Why would the author of that whitepaper say MQTT's passwords have insufficient entropy, and is it still the case, or are my calculations correct?

  • 1
    It might be noted that the author of the paper not only appears to have mis-characterized MQTT in saying that it "requires" something the current version does not, but signs himself as the "Chief Architect" of a competing offering. Commented Jan 15, 2017 at 22:40
  • 1
    It seems the paper is pretty old and not current. It's worth noting author was a co-chair for the MQTT TC for MQTT 3.1.1. Probably things have changed the last years. MQTT Versions before 3.1.1 had recommendations for smaller password lengths, this isn't true nowadays. Commented Jan 16, 2017 at 12:12
  • 1
    It's the mis-characterization of "it is recommended" as "requirement" which looks improper. Commented Jan 18, 2017 at 15:45

1 Answer 1


Version 3.1 of the spec suggested some unreasonably low username/password lengths:

It is recommended that user names are kept to 12 characters or fewer, but it is not required.

It is recommended that passwords are kept to 12 characters or fewer, but it is not required.

I imagine that any sensible broker didn't implement this recommendation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.