Jellyfin Parental Controls

Q: Does Jellyfin have parental controls?

Yes, per user, on the server dashboard. You can set a maximum allowed parental rating, block items with no or unrecognized rating information, block or allow items by tag, restrict which libraries a user sees, and set an access schedule naming the hours they may watch. What Jellyfin does not have is a daily time limit, a playtime report per child, or a notification when somebody starts watching.

Q: How do I set up a kids account in Jellyfin?

Create a separate user for the child rather than sharing yours, then on that user set a maximum allowed parental rating, turn on blocking for items with no or unrecognized rating information, and limit which libraries they can see. Ratings alone are not enough, because anything your server has no rating for is unrated rather than safe.

Q: Why are Jellyfin parental controls not filtering anything?

Almost always because the items carry no rating. Jellyfin filters on the rating attached to each item by its metadata provider, so anything that arrived without one is invisible to the filter unless you also turn on blocking for items with no or unrecognized rating information. That single setting is the most common reason the controls appear not to work.

Q: Can Jellyfin block violence but allow other things at the same rating?

Not natively. Jellyfin filters on the certificate, which lumps violence, sex, swearing and frightening scenes into one number. JellyStreams, included with the ElfHosted AIOMagic Bundle, sets a separate limit per category on each profile from crowd-sourced parents' guide ratings, and when a title is blocked the child can ask and a parent can allow it from their phone.

Q: Can I stop my child seeing what is in my library?

Yes. Turn off access to all libraries on their user and pick only the ones they should see. This is stronger than a rating filter because it works on where something lives rather than on metadata that may be missing, and the two are usually best used together. Note that the separate device approval setting does not cover browser access, so it is not a complete allowlist for every screen.

Four questions tend to come up together: what can my child see, what can't they see, how long have they been watching, and how do I know when they are.

Jellyfin answers the first two properly. It does not really answer the other two. Below is the map of which is which, along with the single setting behind most of the "these controls don't work" complaints.

What Jellyfin gives you natively

All of it is per user, under Dashboard, Users, and none of it applies until the child has an account of their own instead of borrowing yours.

Maximum allowed parental rating. The highest certification that user may play. Anything rated above it is hidden.
Block items with no or unrecognized rating information. Covers the gap the rating limit leaves. More on this below, because it is the important one.
Block items with tags and Allow items with tags. Rules keyed on tags instead of certificates, so you can carve out exceptions by hand.
Enable access to all libraries. Turn it off and pick which libraries the user sees. It works on where a thing lives, not on what a metadata provider said about it, which makes it the most reliable control here.
Enable access from all devices. Turn it off and approve devices one at a time. Note Jellyfin's own caveat on this one: it applies to devices it can identify uniquely and will not prevent browser access, so it is not a complete allowlist for every screen.
Access Schedule. The days and hours the user may sign in and play. The server stops serving once the window closes.

That is a decent set, and more than most people expect to find. What it never becomes is a daily allowance or a report.

The setting that catches nearly everyone

A rating limit only filters things that have a rating. Anything your server holds no certification for counts as unknown, not safe, and an unknown item sails straight past a limit of PG.

So turn on Block items with no or unrecognized rating information too. Left by itself, a maximum rating has a hole in it shaped exactly like everything your metadata provider failed to recognise.

What Jellyfin does not do

There is no daily time limit. The Access Schedule is a window, not a budget: it controls when, not how much. A child watching from four until eight has used four hours without breaking the rule. This has been an open feature request for years, and it is covered properly in Jellyfin screen time limits for children.

There is no playtime report. Jellyfin records playback, but nothing in the server shows you a per-child "here is this week". People reach for the Playback Reporting plugin or build a dashboard. Both work. Both are one more thing to run.

There are no notifications. Nothing tells you somebody started watching. Webhook plugins can be made to do it with some assembly.

There is no limit by what is in a title. A certificate is one number for everything that earned it, so a limit of 12 lets through the 12 with a fight scene along with the 12 with a few swear words. A parent who is fine with one and not the other has no setting for it.

There is no way to ask. A blocked title is simply absent, or refuses to play. The child cannot say "I want to watch this one", and the parent never finds out it was wanted, so the only fix is for the grown-up to go and loosen the whole limit.

The same thing shapes all three, and it shapes Minecraft's server controls too. Jellyfin was written for whoever administers the server, who is normally also the person watching it. A parent running one for other people in the house, and never using it themselves, was not who anybody had in mind.

The gap that appears on virtual catalogues

This one stays invisible until it bites. It does not apply to an ordinary library of files, nor to every streaming setup, so start by working out which kind you have.

Jellyfin's rating filter reads metadata attached to items your server has stored. With a folder of files, those got scanned, a metadata provider handed each one a certificate, and the filter has something to bite on.

Plenty of setups that stream from elsewhere are no different. A plugin importing a catalogue into real Jellyfin items, or a library of .strm files pointing at remote sources, still leaves you with stored items that get scanned and rated as usual. Jellyfin's own controls work properly on those, so use them.

Where it breaks down is a virtual catalogue: browse and search results assembled on demand and handed straight to the app, with no stored item behind them. There is nothing carrying a certificate, so a rating filter applied at the Jellyfin layer has nothing to act on. Whatever appears in a child's list appeared because the catalogue produced it.

Which means the filtering has to happen where that catalogue is produced, not where it gets displayed. A rating limit on the user account is simply the wrong layer, and setting one can leave you believing you are covered when you are not. Establish which kind you have before you trust either.

What we do instead

JellyStreams, included with the AIOMagic Bundle, started from the household case instead of arriving at it later. It uses Jellyfin's own user model, so every app already knows what to do with it, and fills in the pieces a house full of people needs.

Kids' libraries filtered where it counts

A kids profile is bound to an age capped AIOMetadata install, and AIOMetadata does the filtering on catalogs and search by certification, including its policy for unrated titles. JellyStreams writes no rating logic of its own.

That is deliberate, and it answers the gap above. The rules live in one place, so there is only one place to get them wrong. The cap can be tightened but never loosened, which stops a child's profile being widened by accident.

Limits by what is in a title

Each profile also gets a limit per category: sex and nudity, violence and gore, swearing, alcohol, drugs and smoking, and frightening or intense scenes, each set to None, Mild, Moderate or Any. They are judged from crowd-sourced parents' guide ratings for the title, so "fine with action, not with sex" is a setting rather than a compromise.

Where a title has been graded in the categories you limit, the grades decide. Where it has not, the limit falls back to a certificate age you choose, and for a title nothing is known about at all, you choose what happens. The check runs when something is played, on the title that is really about to play, in every app.

When something is blocked, they can ask

A blocked title shows a screen saying it is blocked by the parental settings on this profile, based on its ratings, and that a request has been sent to a parent. You get a push on your phone saying who asked, for what, and why it was blocked, once per title rather than once per press of play.

On the child's Family tab you see the request with its reasons and, for your eyes only, a few spoiler-free descriptions of what is in it. Allow and that title plays on that profile from then on. Dismiss and it stays blocked. Anything you allowed is listed there too, with a Remove that puts the limits back.

This is the part that changes the conversation at home. The limit can stay where you want it, because the exceptions come to you one title at a time instead of forcing a choice between too strict and too loose.

The PIN goes on the parent, not the child

Signing in with the account password enrolls that device. After that, a profile with no PIN opens with a tap, and a profile with a PIN asks every time, on every device, with no exceptions.

The owner profile is never tappable, since it sees the unfiltered library and reaches the admin panel. People find that backwards until they think about it: the parent needs a PIN, the child doesn't.

A device that was never enrolled is shown nothing at all, not even the names of your household.

Friction, not a vault

Device identity is supplied by the app, and a four digit PIN is a four digit PIN. What this buys is that an outsider needs your address and an enrolled device, while your family needs neither. It is not a cryptographic boundary and we won't pretend otherwise.

The parts Jellyfin leaves out

A daily screen time cap per profile, with a warning before it runs out. See Jellyfin screen time limits for exactly what it can and cannot enforce.
Playback notices on your phone when somebody starts watching, delivered as push through Sam. Add Sam to your home screen first, which on iPhone and iPad is not optional, because Apple only permits web push from an installed app.
A panel at a separate address behind your ElfHosted login, so the children's app cannot reach it.

Notices never announce the owner's own watching, because a feed that reports you to yourself is one you stop reading. The panel keeps a day of the household's activity and a few weeks of each profile's viewing, for the account holder behind the ElfHosted login and nobody else.

See the AIOMagic Bundle Read the JellyStreams app page

Frequently asked questions

Does Jellyfin have parental controls?

Yes. Per user: maximum allowed parental rating, blocking of unrated items, tag rules, per library access and an access schedule. It has no daily limit, no playtime report and no alerts.

How do I set up a kids account in Jellyfin?

Give them their own user, set a maximum allowed parental rating, turn on blocking for items with no or unrecognized rating information, and restrict which libraries they can see. That last one holds up best of the four, since it does not depend on any metadata being there.

Why is my rating limit letting things through?

Because those items carry no rating at all, and unrated does not mean allowed. Turn on Block items with no or unrecognized rating information.

Is a filtered profile the same as a safe profile?

No, and it would be dishonest to suggest otherwise. A filter acts on the certificate a title carries, which is a rough summary written by somebody else for another purpose. Useful, and a sensible default. Limits by category get closer, because they read what is actually in a title rather than one number for all of it, but they are still other people's grades. Neither replaces knowing what your child is watching.

Can my child ask to watch something that is blocked?

Not in Jellyfin itself: a blocked title is simply absent. With JellyStreams, yes. The blocked screen tells them a parent has been asked, you get a push with the reasons, and you allow that one title for that profile without loosening anything else.

Can my child just use my account?

If they know the password, yes. That is exactly why the owner profile asks for a PIN and theirs does not. Shared passwords are how most household setups fall over in practice.

What is the single most useful thing I can do?

Give the child their own user, then restrict which libraries it can see. Everything else here is refinement.