Cracked Minecraft Server (online-mode=false): What It Is, the Risks and How to Protect It with AuthMe

What a cracked server is

When someone joins a Minecraft Java server, the server asks Mojang whether that account really owns that name. That's the online-mode option in server.properties, and it's on (true) by default.

With online-mode=false the server stops asking: anyone who types a name gets in, whether they've bought the game or not. That's a cracked server. Paid accounts can still join, but the server no longer knows who's who.

Before going on, the important part: Mojang only allows people who have bought Minecraft to play it (that's its EULA, which you accept to start any server). Setting up a server to play without buying the game goes against those terms, and on NapNodes, as on any host, you also can't use the server to distribute pirated games or launchers.

What breaks when you remove the check

Anyone can be you. If your name is an operator (op), another player can join by typing your name and they'll have your permissions: they can give items, change the game mode or delete builds. It's the most common way cracked servers get wrecked.

UUIDs change. Each player is saved in the world by an identifier (UUID). With online-mode=true it's their Mojang account's; with false, one calculated from the name (the UUID tool shows you both). If you switch a server that already had a game going, everyone's inventory, bed, permissions and whitelist entry stop being found: it's as if everyone were joining for the first time.

Skins don't show. Without a verified account, the server doesn't know which skin each person has and everyone appears with the default ones (there are plugins that fix it, like SkinsRestorer).

Changing your name is enough to become someone else. A banned player comes back under another name, and anyone who changes their name loses what they had.

If you turn it on anyway: protect it with AuthMe

What working cracked servers do is add a login plugin: the first time, each player picks a password for their name, and from then on nobody can join with that name without it. The most used is AuthMe Reloaded. It's a plugin, so your server has to be Paper or similar (on NapNodes, Minecraft is delivered on Paper).

1. Make a backup

   Before anything else, a backup of the server: in the panel, “Backups” (how to make and restore one), or download the world folder from “Files”. If there was already a game going, the UUID change is hard to undo by hand.

2. Install AuthMe

   In “Mods & plugins”, search for AuthMe and install the version that matches your Minecraft. If yours doesn't show up, download the .jar from its official page and upload it to the plugins folder from “Files”.

3. Remove the check

   In “Settings”, “Joining and players” section, turn off “Official Minecraft accounts only” (that's online-mode). It saves automatically and applies when the server restarts.

4. Register yourself first

   Join with your name and type /register password password. From then on, every time you join, /login password. Do it before giving the address to anyone: if someone else registers your name first, the name is theirs.

5. Review your admins

   Remove op from anyone who doesn't need it and, if you use LuckPerms, give moderators only the permissions they use. With unverified names, the fewer admins the better.

The whitelist on a cracked server

The whitelist stores each player's UUID, not just the name. On a cracked server, add players with the server running (from “Settings” → “Players” or with whitelist add Name in the console): that way it saves the identifier the server uses in that mode. Entries added with online-mode=true don't work and have to be added again (all about the whitelist).

Even with a whitelist, the name isn't verified: anyone who knows the name of someone on the list can join as them. The whitelist doesn't replace AuthMe; they complement each other.

Alternatives without those problems

If your friend plays on mobile, console or Windows, they already have a valid account: it's Minecraft Bedrock. With Geyser and Floodgate they join your Java server without removing the check for anyone (it's in the guide to Java and Bedrock together).

If the problem is that someone doesn't want to pay to play with you, a server with online-mode=true and a whitelist is safer and doesn't force you to manage passwords. Minecraft is bought once and it's yours for good.

And the legitimate exception: if you run a network with a proxy like Velocity, the servers behind it use online-mode=false because the proxy already checks the accounts. There you don't need AuthMe, but only if the proxy is set up properly and nobody can reach the servers behind it without going through it.

Frequently asked questions