Jellyfin Parental Controls

Q: Does Jellyfin have parental controls?

Yes, per user, on the server dashboard. You can set a maximum allowed parental rating, block items with no or unrecognized rating information, block or allow items by tag, restrict which libraries a user sees, and set an access schedule naming the hours they may watch. What Jellyfin does not have is a daily time limit, a playtime report per child, or a notification when somebody starts watching.

Q: How do I set up a kids account in Jellyfin?

Create a separate user for the child rather than sharing yours, then on that user set a maximum allowed parental rating, turn on blocking for items with no or unrecognized rating information, and limit which libraries they can see. Ratings alone are not enough, because anything your server has no rating for is unrated rather than safe.

Q: Why are Jellyfin parental controls not filtering anything?

Almost always because the items carry no rating. Jellyfin filters on the rating attached to each item by its metadata provider, so anything that arrived without one is invisible to the filter unless you also turn on blocking for items with no or unrecognized rating information. That single setting is the most common reason the controls appear not to work.

Q: Can I stop my child seeing what is in my library?

Yes. Turn off access to all libraries on their user and pick only the ones they should see. This is stronger than a rating filter because it works on where something lives rather than on metadata that may be missing, and the two are usually best used together. Note that the separate device approval setting does not cover browser access, so it is not a complete allowlist for every screen.

Four questions tend to come up together: what can my child see, what can't they see, how long have they been watching, and how do I know when they are.

Jellyfin answers the first two properly. It does not really answer the other two. Below is the map of which is which, along with the single setting behind most of the "these controls don't work" complaints.

What Jellyfin gives you natively

All of it is per user, under Dashboard, Users, and none of it applies until the child has an account of their own instead of borrowing yours.

Maximum allowed parental rating. The highest certification that user may play. Anything rated above it is hidden.
Block items with no or unrecognized rating information. Covers the gap the rating limit leaves. More on this below, because it is the important one.
Block items with tags and Allow items with tags. Rules keyed on tags instead of certificates, so you can carve out exceptions by hand.
Enable access to all libraries. Turn it off and pick which libraries the user sees. It works on where a thing lives, not on what a metadata provider said about it, which makes it the most reliable control here.
Enable access from all devices. Turn it off and approve devices one at a time. Note Jellyfin's own caveat on this one: it applies to devices it can identify uniquely and will not prevent browser access, so it is not a complete allowlist for every screen.
Access Schedule. The days and hours the user may sign in and play. The server stops serving once the window closes.

That is a decent set, and more than most people expect to find. What it never becomes is a daily allowance or a report.

The setting that catches nearly everyone

A rating limit only filters things that have a rating. Anything your server holds no certification for counts as unknown, not safe, and an unknown item sails straight past a limit of PG.

So turn on Block items with no or unrecognized rating information too. Left by itself, a maximum rating has a hole in it shaped exactly like everything your metadata provider failed to recognise.

What Jellyfin does not do

There is no daily time limit. The Access Schedule is a window, not a budget: it controls when, not how much. A child watching from four until eight has used four hours without breaking the rule. This has been an open feature request for years, and it is covered properly in Jellyfin screen time limits for children.

There is no playtime report. Jellyfin records playback, but nothing in the server shows you a per-child "here is this week". People reach for the Playback Reporting plugin or build a dashboard. Both work. Both are one more thing to run.

There are no notifications. Nothing tells you somebody started watching. Webhook plugins can be made to do it with some assembly.

The same thing shapes all three, and it shapes Minecraft's server controls too. Jellyfin was written for whoever administers the server, who is normally also the person watching it. A parent running one for other people in the house, and never using it themselves, was not who anybody had in mind.

The gap that appears on virtual catalogues

This one stays invisible until it bites. It does not apply to an ordinary library of files, nor to every streaming setup, so start by working out which kind you have.

Jellyfin's rating filter reads metadata attached to items your server has stored. With a folder of files, those got scanned, a metadata provider handed each one a certificate, and the filter has something to bite on.

Plenty of setups that stream from elsewhere are no different. A plugin importing a catalogue into real Jellyfin items, or a library of .strm files pointing at remote sources, still leaves you with stored items that get scanned and rated as usual. Jellyfin's own controls work properly on those, so use them.

Where it breaks down is a virtual catalogue: browse and search results assembled on demand and handed straight to the app, with no stored item behind them. There is nothing carrying a certificate, so a rating filter applied at the Jellyfin layer has nothing to act on. Whatever appears in a child's list appeared because the catalogue produced it.

Which means the filtering has to happen where that catalogue is produced, not where it gets displayed. A rating limit on the user account is simply the wrong layer, and setting one can leave you believing you are covered when you are not. Establish which kind you have before you trust either.

What we do instead

JellyStreams, included with the AIOMagic Bundle, started from the household case instead of arriving at it later. It uses Jellyfin's own user model, so every app already knows what to do with it, and fills in the pieces a house full of people needs.

Kids' libraries filtered where it counts

A kids profile is bound to an age capped AIOMetadata install, and AIOMetadata does the filtering on catalogs and search by certification, including its policy for unrated titles. JellyStreams writes no rating logic of its own.

That is deliberate, and it answers the gap above. The rules live in one place, so there is only one place to get them wrong. The cap can be tightened but never loosened, which stops a child's profile being widened by accident.

The PIN goes on the parent, not the child

Signing in with the account password enrols that device. After that, a profile with no PIN opens with a tap, and a profile with a PIN asks every time, on every device, with no exceptions.

The owner profile is never tappable, since it sees the unfiltered library and reaches the admin panel. People find that backwards until they think about it: the parent needs a PIN, the child doesn't.

A device that was never enrolled is shown nothing at all, not even the names of your household.

Friction, not a vault

Device identity is supplied by the app, and a four digit PIN is a four digit PIN. What this buys is that an outsider needs your address and an enrolled device, while your family needs neither. It is not a cryptographic boundary and we won't pretend otherwise.

The parts Jellyfin leaves out

A daily screen time cap per profile, with a warning before it runs out. See Jellyfin screen time limits for exactly what it can and cannot enforce.
Playback notices on your phone when somebody starts watching, delivered as push through Sam. Add Sam to your home screen first, which on iPhone and iPad is not optional, because Apple only permits web push from an installed app.
A panel at a separate address behind your ElfHosted login, so the children's app cannot reach it.

Two deliberate omissions. Notices never announce the owner's own watching. And there is no chat, history export or activity feed letting one person read up on another, because knowing somebody started watching is how you run a household rule, and a transcript is a different thing entirely.

See the AIOMagic Bundle Read the JellyStreams app page

Frequently asked questions

Does Jellyfin have parental controls?

Yes. Per user: maximum allowed parental rating, blocking of unrated items, tag rules, per library access and an access schedule. It has no daily limit, no playtime report and no alerts.

How do I set up a kids account in Jellyfin?

Give them their own user, set a maximum allowed parental rating, turn on blocking for items with no or unrecognized rating information, and restrict which libraries they can see. That last one holds up best of the four, since it does not depend on any metadata being there.

Why is my rating limit letting things through?

Because those items carry no rating at all, and unrated does not mean allowed. Turn on Block items with no or unrecognized rating information.

Is a filtered profile the same as a safe profile?

No, and it would be dishonest to suggest otherwise. A filter acts on the certificate a title carries, which is a rough summary written by somebody else for another purpose. Useful, and a sensible default. It has no opinion about any particular film and never will.

Can my child just use my account?

If they know the password, yes. That is exactly why the owner profile asks for a PIN and theirs does not. Shared passwords are how most household setups fall over in practice.

What is the single most useful thing I can do?

Give the child their own user, then restrict which libraries it can see. Everything else here is refinement.