Minecraft Offline Mode Server: Setup and Security Guide

What is a Minecraft offline mode server?

An offline mode server is a Minecraft Java server with online-mode=false in server.properties, which means it doesn't check whether a player owns a Microsoft account. It accepts whatever username the player types into their launcher and never asks Mojang's session servers who that name belongs to.

A normal server (online-mode=true) verifies every player on join: the game proves to Mojang that you're signed in to the account that owns your username. That's what stops impersonation and what makes skins load automatically.

Players with a Microsoft account get full protection only on an online mode server. On an offline mode server, their safety depends on how well the owner secures it. Also keep in mind that making sure the server complies with Mojang's terms (the Minecraft EULA) is the server owner's responsibility.

Why is an unprotected offline mode server dangerous?

Because anyone can join under any username – including an operator's – and get that player's permissions. All it takes is knowing the admin's name: type it into a launcher, connect, and the server treats you as the admin. From there you can spawn items, change game modes, ban players or wipe out the world.

What typically goes wrong on an unprotected offline server:

• admin takeover – someone joins as an OP and has full control,
• inventory theft – someone joins as another player and empties their chests and inventory,
• framing – someone griefs under another player's name and the wrong person gets banned,
• the whitelist doesn't help – it only checks usernames, so joining with a whitelisted name is enough.

There's one real fix: a login plugin (or mod) with password authentication. Every player registers their username with a password on first join and has to log in on every later join before they can move, open chests or run commands. No password, no access.

On Spot.gg you can see the state at a glance: the lock icon in the server bar shows either "Player authentication: enabled" or "No player authentication". Click the open lock and the panel walks you through the options – online mode or a login plugin.

How do you set up an offline mode server step by step?

Set "Who can join" to "All players" in the server configuration (that's online-mode=false), install a login plugin and restart. On Spot.gg it looks like this:

1. Pick a plugin-capable engine. Paper (or Purpur) is the natural choice because it runs login plugins. Vanilla doesn't support add-ons, so password login isn't possible on it. Already on Vanilla? Switch under Information → Profile → Modify → Change engine.
2. Change the mode. Open Configuration → Most popular, and in the "Joining" section set "Who can join" to "All players". This writes online-mode=false to server.properties.
3. Decide what happens to player data. If people have already played on the server, the panel asks "Convert player accounts?" – more on that below.
4. Install a login plugin. In the Addons tab, search for AuthMe Reloaded or LibreLogin and click "Install".
5. Restart the server and check that the lock in the server bar is closed.
6. Register first. Join with your own username and set a password straight away (in AuthMe: /register password password, then /login password on later joins). Do this before you share the address so nobody claims your name first.
7. Give OP only after registering, and only to trusted players who have also set a password.

What happens to player data when you change online-mode?

Switching modes changes every player's UUID, so without a conversion players lose their inventory, position and progress. In online mode the UUID comes from the Mojang account; in offline mode it's calculated from the username – two different IDs for the same person.

That's why changing "Who can join" on Spot.gg opens a "Convert player accounts?" dialog with two options:

• "Save and convert accounts" – moves player data to the new UUIDs: inventory, position, statistics, advancements, OP, whitelist and bans. The server is stopped for the conversion, and if backups are available, a "Before account conversion" backup is made first.
• "Save without conversion" – only flips the setting. Fine for a fresh server nobody has played on yet.

Plugin and mod data (Essentials, LuckPerms, land claims and so on) isn't converted. When going from offline back to online mode, players without a premium account are skipped, since they have no Mojang UUID.

How do you let non-premium players join alongside premium players?

Keep the server in offline mode and add a plugin that recognises premium players and logs them in automatically. Non-premium players register with a password as usual, while players with a Microsoft account don't need yet another password.

Common setups:

FastLogin isn't in the Spot.gg add-on catalog, so download the .jar from the project's official page and upload it to the plugins folder in the Files tab or over SFTP. On Paper, FastLogin also needs ProtocolLib, which you can install from the catalog.

One caveat: automatic premium login relies on checking the account with Mojang, but a non-premium player can still try any username nobody has registered yet. So "admin registers first, OP comes after" still applies.

How do you run an offline mode server with mods (Forge, Fabric, NeoForge)?

Modded servers can't run plugins, so instead of AuthMe you install a login mod for your loader. The mode itself is changed the same way: Configuration → Most popular → "Who can join".

Login mods in the Spot.gg catalog:

• Fabric: EasyAuth,
• NeoForge: EasyAuth, Basic Login,
• Forge: Simple Login – this one must also be installed by every player (the password is stored on the client and sent automatically on join).

Adding a server-side login mod to a modpack rarely breaks anything, but check the mod's requirements on its page. For installing mods in general, see How to Make a Modded Minecraft Server.

The panel also suggests mods for your loader: click the open lock in the server bar, and the "No authentication" window lists "Login mod (non-premium)" options with install buttons.

Does offline mode work behind a Velocity or BungeeCord proxy?

Yes – in a proxy network, authentication is handled by the proxy, not by each server. Players connect to the proxy (Velocity or BungeeCord), while the backend servers run in offline mode and should only accept connections from the proxy. Login plugins such as LibreLogin or FastLogin are then installed on the proxy, often on the backends too. FastLogin behind a proxy also needs a separate MySQL/MariaDB database.

That's a setup for multi-server networks (lobby, minigames, survival). Spot.gg doesn't offer Velocity or BungeeCord as a selectable engine, so for a single server with friends, Paper with a login plugin as described above is the way to go.

What else should you configure on an offline mode server?

A skin plugin, permissions instead of OP, and regular backups. A few practical tips:

• Skins. In offline mode the server can't fetch skins from Mojang, so everyone shows up with default skins. SkinsRestorer fixes that.
• Fewer OPs. Instead of handing out OP, grant specific permissions with a ranks plugin like LuckPerms. The fewer people with full control, the less damage a leaked password can do.
• Strong passwords. Ask players not to reuse their email or Microsoft account password on your server.
• Backups. On a paid Spot.gg server you make backups in the Backups tab, so you can roll the world back if someone causes damage.
• Don't leave the server unprotected. Backups only go back a few days, and griefing on an unprotected server is often noticed too late.

Is it legal to run an offline mode server?

online-mode=false is a built-in option of the official Minecraft server, but how you use it has to comply with Mojang's EULA – and that's on the server owner. We don't encourage playing on non-genuine copies of the game. If you and your friends all have Microsoft accounts, the simplest and safest option is an online mode server ("Original accounts only"): no passwords, working skins and usernames nobody can fake.

Offline mode also has legitimate technical uses, such as testing on a local network or running backend servers behind a proxy that does the authentication.

FAQ

How do I set online-mode to false?

Set online-mode=false in server.properties and restart the server. On Spot.gg, go to Configuration → Most popular and set "Who can join" to "All players". Then install a login plugin such as AuthMe Reloaded right away.

Which login plugin is best for an offline mode server?

On Paper, AuthMe Reloaded is the most widely used. If you want premium players to log in automatically, use LibreLogin or AuthMe combined with FastLogin. On modded servers use a mod instead: EasyAuth (Fabric, NeoForge) or Simple Login (Forge).

Can premium players join an offline mode server?

Yes. Players with a Microsoft account can join without issues; like everyone else, they register with the login plugin. With FastLogin or LibreLogin they can be logged in automatically, without a password.

Is a whitelist enough to protect an offline mode server?

No. A whitelist only checks usernames, and on an offline server anyone can claim any username. Keep the whitelist as an extra layer if you like, but a password login plugin or mod is what actually protects the server.

Will I lose my world or inventories when switching to offline mode?

The world stays, but inventories and positions are tied to UUIDs, which change with the mode. On Spot.gg choose "Save and convert accounts" and the panel moves player data to the new UUIDs. Plugin data (claims, ranks) has to be migrated separately.

Can I run an offline mode server for free?

Yes, for a trial. Every Spot.gg server starts with 24 hours free, no card required, and the "Who can join" setting and login plugins work on the free server too. After the trial, plans start at $3.90 per month – see Minecraft server hosting.