AuthSmith

Password protection for offline-mode servers with a real login form instead of chat commands.

When a server runs with online-mode=false, anyone can join under any name, including yours. AuthSmith puts a password in front of the world so a name alone is never enough.

AuthSmith was built for Anvil-MC, the Android app that hosts Minecraft servers directly on your phone, where offline mode is common and every megabyte of RAM counts. It runs on any Paper, Spigot or Fabric server, and contains no native libraries, so it works on ARM devices out of the box.

Two ways to protect your server

Use one, or both:

• Server password: one shared password for the whole server, like an invite key. Hand it to friends; strangers can't get in.
• Player accounts: every player registers their own password and logs in with it on each visit.

With both enabled, the server password is asked only once, in the registration form. After that players use their own password.

A proper login screen

On Paper 1.21.6+ and Fabric, AuthSmith uses Minecraft's built-in dialogs. The password form appears on the loading screen, before the player enters the world. No frozen player standing at spawn, no typing /login on a phone keyboard, no password in the chat history.

On Spigot and older Paper (1.17+) it falls back to classic /register <password> <confirm> and /login <password> commands, with the player frozen in place until they log in.

What it protects against

• Name takeover: if you are online and someone joins with your name, they are refused. (Vanilla would kick you and let them in.)
• Look-alike names: steve cannot register while Steve exists.
• Password guessing: wrong passwords are counted per address and per account, across reconnects. Too many and the player is kicked and their address locked out for a while.
• Idling at the prompt: players who don't log in within the time limit are kicked.
• Doing anything before logging in: movement, breaking, building, inventory, chat, commands, damage, hunger and item pickup are all blocked until authenticated.

Convenience

• Sessions: rejoining from the same address within a configurable window logs you in automatically.
• Bedrock players: joining through Geyser + Floodgate are already Xbox-verified and skip the prompt (verified through Floodgate's API, never by name).
• /authsmith reload, status, unregister <name>, setpassword <name> <password>, setserverpassword <password> for admins.
• Everything is configurable in config.yml; every message in messages.yml.

Lightweight by design

• Pure Java: bcrypt password hashing and a small users.json file, no SQLite, no native .so files, nothing that can crash on ARM.
• Password hashing runs off the main thread; idle cost is effectively zero.
• Under 1 MB.

Installation

Start the server once, then edit plugins/AuthSmith/config.yml (Bukkit) or config/authsmith/config.yml (Fabric). By default player accounts are enabled and the server password is off.

AuthSmith does nothing on online-mode=true servers, Mojang already verifies those accounts.