# Server Login

> **This is a beta release.** The mod works and is tested, but it is new and has not yet been

> through many different servers and modpacks. Back up your world before installing, and please

> report anything that breaks — bug reports at this stage are what make the next version solid.

undefined

If your server runs in offline mode, anyone can join using anyone else's name. There is nothing

stopping a stranger from connecting as you, walking into your base and emptying your chests.

Server Login fixes that. Players pick a password the first time they join, and type it every time

after. Until they do, they cannot move, chat, attack, open chests, or touch anything in the world.

undefined

**Your players do not need to install anything.** The mod lives on the server. Everyone connects

with the normal Minecraft launcher, exactly as before.

## What players see

undefined

They join and land right where they left off — no lobby, no teleport, no dark room. A message

appears telling them what to type:

```

/login mypassword

```

undefined

First time on the server, they type it twice to set it:

```

/login mypassword mypassword

```

undefined

That's the whole thing. One command, and they're playing.

## Setting it up

undefined

1. You need a Minecraft **1.20.1** server running **Forge 47.4.10** or newer.

2. Put the mod file into your server's `mods` folder.

3. Open `server.properties` and set `online-mode=false`.

4. Start the server.

That's it. Passwords are saved with your world, in `world/serverlogin/users.json`. Back that file up

along with the world — losing it means everyone has to register again.

undefined

## Commands

For players:

undefined

| Command | What it does |

| --- | --- |

| `/login <password>` | Log in |

| `/login <password> <password>` | Register, the first time |

| `/changepassword` | Change your password |

| `/logout` | Log out |

`/l` works as a shortcut for `/login`.

undefined

For admins (needs permission level 3):

| Command | What it does |

| --- | --- |

| `/auth count` | How many players are registered |

| `/auth status <player>` | Check if someone is registered |

| `/auth remove <player>` | Delete an account, so they can register again |

| `/auth queue` | Who is still sitting at the login screen |

| `/auth kick <player> [reason]` | Kick someone who never logged in |

undefined

`/auth remove` is what you use when a player forgets their password.

## Language

undefined

The mod comes in English and Russian. Open `config/serverlogin-common.toml` and set:

```toml

[general]

language = "ru_ru"

```

undefined

You can also rewrite any message yourself — greetings, error messages, the kick text — without

touching the mod file. There is a short guide in the

[README](https://github.com/iwosw/server-login#language).

## Good to know

undefined

**Passwords are stored safely.** They are never written down as plain text, not in the account file

and not in your server log. Even you cannot read them — which is also why a forgotten password can

only be reset with `/auth remove`, never recovered.

**Guessing is slow going.** After a handful of wrong tries the account locks for a minute, and the

server limits how fast password attempts can be made overall.

undefined

**If you run a modpack with Simple Voice Chat,** voice needs one small exception to work, and it is

already allowed by default. If some other mod misbehaves before players log in, the `[gate]` section

of the config is where you fix it — the [README](https://github.com/iwosw/server-login#authentication-gate)

explains how to find out exactly what to add.

**This protects names on your server, nothing more.** It is not a firewall, not DDoS protection, and

it does not encrypt the connection. It stops impersonation, which on an offline server is the thing

that actually ruins bases.

undefined

## Something broken?

Tell me in the comments, or open an issue on

[GitHub](https://github.com/iwosw/server-login/issues). If you find an actual security hole, please

report it privately through

[GitHub Security Advisories](https://github.com/iwosw/server-login/security/advisories/new) instead

of posting it publicly.

undefined

- [Source code](https://github.com/iwosw/server-login)

- [Changelog](https://github.com/iwosw/server-login/blob/main/CHANGELOG.md)

Free and open source, MIT licensed.

IWOSS_