Minecraft offline mode (online-mode=false): risks and how to secure it

Setting online-mode=false in server.properties stops the server from verifying accounts with Mojang, so anyone can join under any name. That is insecure by default, and if you use it you need an authentication plugin such as AuthMe. We do not encourage piracy; Minecraft is a paid game and you should own it.

Why people turn it off

• Running behind a proxy such as Velocity or BungeeCord, where the proxy does the verification and backend servers are set to offline mode. This is a legitimate use.
• Some legacy or private test setups.

The risk

With online mode off, a player can type the name of your operator and join as them. Without protection, that hands over admin rights, items and builds.

If you must use offline mode

1. Install an authentication plugin such as AuthMe on a Paper-based server.
2. Make players register and log in with a password.
3. Use the whitelist, and keep op lists tight.
4. Block direct access to backend servers behind a proxy, so only the proxy can connect.
5. Check the plugin's own documentation for current setup steps.

What changes

• Player UUIDs are generated differently, so inventories and permissions do not carry over from online mode.
• Skins may not display.

Better alternatives

Keep online-mode=true and use the whitelist. If friends cannot join because of account trouble, solve it with their Microsoft account rather than disabling verification.

Common mistakes

• Disabling online mode on a public server with no auth plugin.
• Leaving a proxy backend reachable from the internet.
• Switching modes on an existing world and losing player data.
• Assuming a whitelist by name is secure in offline mode, since names can be faked.