Minecraft offline mode and its risks

Offline mode is the online-mode=false setting. With it off, your server stops asking Mojang whether a player is who they say they are, so anyone can join under any name, whether or not they own the game. This guide explains what changes and what to add if you still switch it off.

Checked against the Minecraft Wiki's server.properties page and AuthMeReloaded 6.0.1 on Modrinth, October 2026.

What online mode does

online-mode defaults to true. The Minecraft Wiki describes it as whether to only allow players verified with the Minecraft account database to join. When a player joins, your server checks with Mojang that this account really signed in. If Mojang's check does not confirm the account, the player is disconnected with Failed to verify username!, which our Failed to verify username guide explains.

What changes with it off

• The name is the identity. Nothing proves who is behind a name, so a player can type the name of an operator or a whitelisted player and join as them. The whitelist and operator list stop protecting you.
• Players get different IDs. The server builds an ID from the typed name. The Minecraft Wiki gives it as a version 3 UUID generated from the MD5 hash of OfflinePlayer: plus the username. A returning player's ID no longer matches the one their Mojang account had. The server keeps each player's data in a file named after their ID, so the same person can join with an empty inventory. The whitelist and ops.json identify players by ID too, and with online mode off the whitelist checks the offline ID, so entries recorded from Mojang accounts can stop matching.
• Lookups by ID do not match. Because the ID comes from the name, a tool that looks players up by Mojang ID will not find the same person. Find a player's UUID covers how to read these IDs.

Servers behind a proxy

Servers that sit behind a proxy are a special case. Velocity's own security page warns that a backend in offline mode lets someone impersonate any player, calls that extremely dangerous, and says to make sure only the proxy can connect to your servers. A server that players can reach directly has no such protection.

Should you turn it off?

For a plain public server, leave online mode on. If your problem is Bedrock players with no Java account, use the Crossplay tab instead: Let Bedrock players join your Java server explains how Floodgate lets them in without it.

Turn it off, if you must

1. Open the Config Editor tab. Under Players, switch Online mode off.
2. Click Save changes.
3. Restart the server from the Console tab.

To put it back, switch Online mode on, save and restart.

Add a login plugin

If players can join under any name, add a login system so each name needs a password. AuthMeReloaded describes itself as a way to secure an offline mode server, and it blocks unauthenticated players from moving, placing blocks and typing commands. Protecting the inventory and blocking tab-complete need the optional PacketEvents 2.x plugin, which you add separately.

1. Open the Plugins tab, select the Modrinth source button, and search for AuthMeReloaded.
2. Press Install and restart.
3. Open the Plugins tab's Installed view and read which jar went in. The plugin's page lists AuthMe-6.0.1-Paper.jar for Paper, and the store takes the newest release among the Paper, Spigot and Folia files. On our test Paper server it installed AuthMe-6.0.1-Folia.jar, and AuthMe enabled. If it installed the Folia jar, remove it, download AuthMe-6.0.1-Paper.jar from the plugin's Modrinth page and upload it to plugins with the File Manager.
4. Players register with the plugin's commands the first time they join. Its wiki on GitHub lists them.

Then add a second layer. Press Turn whitelist on in the Players tab, so only names you approved can try to join. In offline mode the Add to whitelist button accepts names that have no Mojang account too.