Registration by medialab adds a public sign-up page to your Jellyfin server: visitors request an account themselves, and you decide who gets in. The account is created disabled, hidden from the sign-in screen and with minimal rights; you approve it from the Jellyfin dashboard.
What it does
- Public page at
https://<your server>/Registration/Page, in English and Romanian, made for phones first: username (checked as you type), name, e-mail, phone number in international format, password with a strength meter. - Modes: manual approval (default), invite code only, or automatic. E-mail confirmation can be switched on separately.
- Approval in Dashboard → Registration → Requests: pending and processed requests, search, approve or reject one by one or in bulk, CSV export.
- Minimal default rights: no administration, downloads, sync or deletion; the account does not appear on the sign-in screen. Libraries: all, or only the ones you choose; optional limits for simultaneous streams and remote bitrate.
- Invite codes: a single-use code that renews itself after use, and an optional family code for people living in the same home.
- One account per person: the same device, phone number or browser and network are blocked or flagged, rule by rule.
- Anti-bot: proof-of-work in the browser, optional Cloudflare Turnstile, a hidden trap field, signed one-time form tokens, rate limits per IP and network, disposable e-mail domains refused, and no access from data centres, commercial VPNs or Tor.
- Notifications in the Jellyfin activity log, by e-mail and on Telegram.
- Sign-in screen link: a Create an account link and QR code on the Jellyfin sign-in screen while registration is open.
- Works with Cashier to sell paid subscriptions to your server.
Requirements
- Jellyfin Server 12.2 or newer.
- The server reachable over HTTPS by the people who register (directly or through a reverse proxy).
Privacy
Requests (name, e-mail, phone, IP address) are stored only on your server, in the plugin's data folder; rejected or expired requests are removed after 30 days (configurable). Passwords are not kept by the plugin: the Jellyfin account is created disabled when the request arrives and approval only enables it. Leaked passwords are refused with the Have I Been Pwned range check (only 5 characters of the SHA-1 hash leave the server).
Frequently asked
How do I let users create their own account on Jellyfin? Install Registration, open Dashboard → Registration, choose the libraries and the mode, then switch on Registration open and share the page link (or the QR code from Send access). With approval on, each request waits for you in the Requests tab. See the guide.
Can bots create accounts? The page combines proof-of-work, optional Turnstile, rate limits and network checks; automated browsers are refused, and with approval on nothing becomes an account without you.
Licensing
The plugin is open source (GPL-3.0), like Jellyfin itself. What you buy is the subscription for builds, updates and support for one Jellyfin server: ready-to-install releases through your private plugin repository, every update while the subscription is active, and help when something does not work. The plugin checks the subscription key once a day; without a valid subscription it stops until you renew (nothing is deleted). Monthly, yearly or lifetime (lifetime includes one year of updates), or included in the Jellyfin bundle. 30-day free trial.
Source code. For every release, the complete corresponding source code is downloadable from your account (Account → Licences, Source code) next to the build, under the same rules as the build, and each archive contains the full GPL-3.0 text (LICENSE). If you need the source of a version you can no longer download, ask us and we send it. See section 10 of the EULA.