How to Password-Protect Your Minecraft Server

Why Minecraft doesn't ask for a password to join

In Minecraft Java there's no server key you type when connecting. Each player already proves who they are with their Microsoft account: with online-mode on (the normal setting, and how NapNodes servers come), the server asks Mojang whether that account really is the one with that name. Nobody can get in pretending to be you.

What's missing is saying who can get in. That's the whitelist: it's better than a shared password, because it doesn't get passed from one friend to another and you don't have to change it when someone leaves the group; you remove them from the list and that's it.

The server's address isn't secret: anyone who has it or guesses it can try to join. That's why, if the server is only for your group, the whitelist comes first.

The whitelist: the real password

With the whitelist on, only the people on it can join, plus the admins (op), who get in even if they aren't on it. Everyone else is told they aren't on the list and can't get through.

1. Turn it on

   In the NapNodes panel, open your server and go to “Settings”: the “Whitelist” setting. From the console it's whitelist on, which applies straight away.

2. Add your friends

   In “Settings”, further down, “Players” → the “Whitelist” tab: type the exact name of their Minecraft account and “Add”. It works with the server running or stopped. From the console, whitelist add Name (and whitelist list to see who's on it).

3. Kick anyone already inside

   Also turn on “Kick anyone not on the list” (enforce-whitelist): when you turn on the list or remove someone from it, they're removed even if they're playing.

4. Console and phone players, separately

   If Bedrock players join with Geyser and Floodgate (Java and Bedrock together), they're added with fwhitelist add Name in the console: whitelist add looks up Java accounts and can't find them.

Removing someone and not letting them back

To stop a friend from being able to join, remove them from the list: “Remove” next to their name in “Players” → “Whitelist”, or whitelist remove Name in the console.

If you also want them kept out even if you turn the whitelist off one day, ban them: the “Banned” tab in the same place, or ban Name. The rest of the moderation commands are in the admin commands guide, and what to do if they've already wrecked something, in the one on protecting the server from griefers.

Watch out with admins: an op gets in even if they aren't on the list and can use every command. Only give it to people you trust completely; for moderators with less power, LuckPerms.

If your server is cracked: a login plugin

Here you do need a password, and for a different reason. A cracked server has online-mode turned off (in the panel, the “Official Minecraft accounts only” setting off): nobody checks accounts any more and anyone can join with any name, yours included, with your op permissions. The whitelist is useless, because it's enough to pick a name that's on it.

The recommendation is not to turn it off. If you do, each player needs their own password inside the game, and that's what login plugins provide (the best known is AuthMe Reloaded). They're plugins, so they run on Paper, not on modded servers; and before installing one, check on its page that it works with your Minecraft version.

1. Install it

   In the panel's “Mods & plugins”, search for it by name; if it doesn't show up, upload its .jar to the plugins folder from “Files”. Restart the server.

2. Register yourself first

   Join with your name and type /register password password. From then on, when you join, /login password. Do it before giving the address to anyone: if someone else registers with your name first, they own it.

3. Explain it to your friends

   Each of them registers the first time with their own password. They shouldn't use the same one as on other websites: the server stores it.

The other passwords you might have been looking for

Your NapNodes account's: it's what you use to sign in to the panel. If you've forgotten it, “Forgot your password?” on the sign-in screen and you get a link by email.

The SFTP one: for transferring files with FileZilla or WinSCP. It isn't the account's: it's created in “My account” → “SFTP password” (or in each server's “Advanced settings” → “SFTP”) and it's shown only once; if you lose it, you create another (SFTP guide).

If what you want is for a friend to start the server or use the console when you're not around, don't give them your password: with “Friends” they sign in with their own account and do only what you allow (give a friend access).

Frequently asked questions