How to Allow Cracked Versions on Your Minecraft Server in 2026

You set online-mode to false, restart the server, and your cracked-client players connect. Ten minutes later, someone joins with your admin's username, gets OP rights, and destroys the spawn. Allowing cracked versions on a Minecraft server is technically simple: one line in server.properties. The real work starts afterwards, when you have to secure a server that no longer does any identity verification.

Key takeaways

• Two settings to change: online-mode=false and enforce-secure-profile=false (required since 1.19).
• Without an authentication plugin, anyone can connect with any username, including the username of your OP admins. This is the number one security hole.
• UUIDs change in offline mode. Existing players' inventories, ranks and land claims will no longer be linked to their account.
• Install AuthMe Reloaded before making the server public. Not after.

What online-mode=false actually does

When a player connects to a Minecraft server in normal mode (online-mode=true), the server contacts the Mojang/Microsoft authentication servers to check that the player really owns the account tied to their username. That's what stops someone from connecting as "Notch" without being Notch.

Setting online-mode to false turns that check off. The server accepts any username without contacting Mojang. Players without a premium account (cracked clients) can connect, but so can premium players, and above all anyone can take anyone else's username. The server can no longer tell the difference.

This isn't a hack, a mod or an exploit. It's an official setting that Mojang put in the vanilla server from day one. It's intended for local networks without internet access and for test servers. Using it to welcome cracked players is common, but it requires extra security measures.

Configuration: the two settings to change

Stop your server before changing anything. If you edit server.properties while the server is running, your changes will be overwritten when it shuts down.

Open server.properties (at the root of the server folder) and change these two lines:

online-mode=false

enforce-secure-profile=false

The first setting disables Mojang authentication. The second disables the verification of signed chat profiles, added in 1.19. If you only set online-mode to false without touching enforce-secure-profile, cracked players will be rejected on connection with an error related to the signed profile. This is the most common trap and the reason many people think "it doesn't work".

Save the file and restart the server. Cracked players can now connect with the usual address and port.

With a server host, the online-mode setting is often available directly in the panel ("Settings" or "Properties" tab). Look for "Online Mode" and set it to false. For enforce-secure-profile, you may have to edit the server.properties file manually through the file manager or FTP.

Why it's dangerous without protection

The risk isn't theoretical. It's the most common way offline servers get wrecked.

Username spoofing

Without Mojang authentication, anyone can connect with the username of their choice. If your admin account is called "Alex" and a stranger connects with the username "Alex", the server treats them as if they were you: same permissions, same inventory, same access to OP commands. One /stop, one /op Griefer, one destructive /fill, and your server is compromised.

And this risk exists even if you don't share your server's IP publicly. Bots constantly scan IP address ranges looking for offline-mode Minecraft servers with no authentication plugin. Your server can be compromised a few hours after opening, without you having given the address to anyone.

UUID changes

In online mode, Minecraft identifies each player by a UUID tied to their Mojang account. In offline mode, the server generates a different UUID based on the username. The result: if you switch an existing server from online to offline, all players lose their inventory, their ender chest, their ranks (LuckPerms), their protected land (WorldGuard, GriefPrevention) and their homes (EssentialsX). The server treats them as new players.

Make a full backup of the world and the player data before changing this setting. Migrating UUIDs is possible but technical.

Incompatibilities

Some plugins and services don't work in offline mode: official skins no longer show up (cracked players appear with the default Steve/Alex skin), the signed chat of 1.19+ is disabled, and features tied to Realms or Xbox Live are unavailable.

Securing the server with an authentication plugin

An authentication plugin forces every player to create a password on their first connection, then to log in on every visit. Even if someone connects with another player's username, they can't interact until they enter the right password.

AuthMe Reloaded

AuthMe Reloaded is the most widely used authentication plugin on offline Minecraft servers, with more than 1.6 million downloads on SpigotMC. It's compatible with Paper, Spigot, Purpur and Folia. The player is frozen on connection until they type /login Password (existing player) or /register Password Password (first connection). Passwords are hashed in the database (bcrypt by default).

AuthMe blocks all interactions (movement, chat, commands, damage) until the player is authenticated. It's the absolute minimum protection for an offline server.

Version 6.0 (released in May 2026) brings dedicated builds per platform (Spigot 1.16-1.19, Spigot 1.20-1.21+, Paper 1.21+, Folia 1.21+), native proxy plugins for BungeeCord and Velocity, graphical login dialogs (on Paper 1.21.11+), and a built-in premium bypass that automatically detects premium accounts and lets them connect without a password.

FastLogin (mixed premium + cracked servers)

FastLogin automatically detects whether a player owns a premium Mojang account. If so, it authenticates them automatically without asking for a password. If not (cracked player), it redirects them to AuthMe for password authentication. It's the classic combination for a mixed server.

FastLogin requires AuthMe (or a compatible authentication plugin) installed alongside it. It doesn't work on its own. Note that with AuthMe 6.0 and its native premium bypass, FastLogin becomes optional for new installations. If you're starting from scratch, AuthMe 6.0 alone may be enough.

Recommended configuration

• Install AuthMe Reloaded 6.0+ in the plugins/ folder. Enable the built-in premium bypass if your server welcomes both premium and cracked players.
• Enable the whitelist (white-list=true and enforce-whitelist=true in server.properties) if your server is private or semi-private.
• Never grant OP rights by username. Use a permissions plugin (LuckPerms) that ties rights to the authenticated player's offline UUID.
• Configure AuthMe to limit login attempts (anti-bruteforce) and to block usernames with special characters.

One trap specific to the whitelist in offline mode: the server generates a cracked player's UUID at the time of their first connection. If you add a username to the whitelist before the player has ever connected, the UUID will be wrong and the player will be rejected. The correct procedure: temporarily disable the whitelist, let the player connect once (their offline UUID is generated), add them to the whitelist while they're online with /whitelist add PlayerName, then re-enable the whitelist.

Configuration for a proxy network (BungeeCord / Velocity)

If you use a proxy (BungeeCord or Velocity) in front of several backend servers, the configuration is different and safer.

• The proxy stays on online-mode=true (or false, depending on your choice). It handles authentication.
• The backend servers switch to online-mode=false and trust the proxy for player identity.
• On Spigot/Paper, enable bungeecord: true in spigot.yml (for BungeeCord) or configure the Velocity secret in paper-global.yml.
• Backend servers must never be directly reachable from the outside. Only the proxy should be exposed. If a player can connect directly to an offline-mode backend without going through the proxy, the entire security chain collapses.

This architecture is the one used by most medium to large Minecraft networks (lobby + survival + minigames). The proxy handles authentication once, and the backends trust that authentication. AuthMe 6.0 has native proxy plugins for BungeeCord and Velocity that automatically sync the authentication state between the proxy and the backend servers.

Frequently Asked Questions

Can premium players still connect in offline mode?

Yes. Offline mode doesn't block anyone. Premium players connect normally, but their account is no longer verified by Mojang. With AuthMe 6.0 and its premium bypass enabled, premium players are authenticated automatically (fully transparent), while cracked players have to enter a password.

Do skins work in offline mode?

Premium players' skins no longer show up by default because the server no longer communicates with the Mojang servers. Plugins like SkinsRestorer let you restore premium skins and assign skins to cracked players. It's a cosmetic add-on, not a security requirement.

Is it legal?

The online-mode=false setting is an official feature of the vanilla Minecraft server, present since the earliest versions. Using it doesn't violate any law. Mojang has never officially endorsed it for welcoming cracked players, but hasn't blocked it either. The ethical question is more about welcoming players who use copies of the game they haven't bought. Each administrator makes their own choice with full knowledge of the facts.

How do I migrate UUIDs if I switch from online to offline?

The migration is technical. UUIDs in online mode (tied to the Mojang account) and in offline mode (generated from the username) are different. Dedicated scripts can convert player data files (playerdata, advancements) from one format to the other. Make a full backup before any migration, and test on a copy of the server.

Do I also need to change enforce-whitelist?

If you enable the whitelist (white-list=true), also enable enforce-whitelist=true. Without this option, a player who is already connected when you enable the whitelist stays in game even if they aren't on it. With enforce-whitelist=true, the server automatically kicks any non-whitelisted player, even mid-session.

Does my host allow offline mode?

Most Minecraft server hosts allow offline mode. Some show the option directly in their panel (an "Online Mode" toggle), others require you to edit server.properties manually. No mainstream host technically blocks this feature. If in doubt, check your host's terms of service.