---
title: "Setting Up AuthMe for Offline-Mode Authentication | ZCS"
description: "Running offline-mode opens a server to anyone claiming any username. AuthMe is the long-standing plugin for adding a login/register layer back."
url: "https://www.zcraftstudios.com/blog/authme-offline-mode-authentication-setup"
updated: "2026-10-20T07:15:13.005688+00:00"
source: "ZCraft Studios"
---

> Site index for AI agents: https://www.zcraftstudios.com/llms.txt (full reference: https://www.zcraftstudios.com/llms-full.txt). Every page is available as Markdown by adding `.md` to its URL or sending `Accept: text/markdown`.

1. [Home](https://www.zcraftstudios.com/)
2. [Blog](https://www.zcraftstudios.com/blog)
3. Setting Up AuthMe for Offline-Mode Authentication

[ All posts](https://www.zcraftstudios.com/blog)

# Setting Up AuthMe for Offline-Mode Authentication

ZCraft StudiosOct 3, 2026Updated Oct 20, 2026

Running offline-mode opens a server to anyone claiming any username. AuthMe is the long-standing plugin for adding a login/register layer back.

## In this guide

- [Install AuthMe](#install-authme)
- [How Registration Works for Players](#how-registration-works-for-players)
- [Restricting Players Before Login](#restricting-players-before-login)
- [Setting a Session Timeout](#setting-a-session-timeout)
- [Changing or Resetting a Password](#changing-or-resetting-a-password)
- [Unregistering an Account](#unregistering-an-account)
- [Using AuthMe on a Proxy Network](#using-authme-on-a-proxy-network)
- [A Note on Security](#a-note-on-security)
- [A safer authentication decision](#a-safer-authentication-decision)
- [Review identity changes before recovering an account](#review-identity-changes-before-recovering-an-account)
- [Official documentation and links](#official-documentation-and-links)
- [AuthMeReloaded project examples](#authmereloaded-project-examples)
- [Authentication safety and account identity](#authentication-safety-and-account-identity)

## Setting Up AuthMe for Offline-Mode Authentication

_Offline-mode skips Mojang's authentication entirely, and AuthMe plugs that gap back in with its own login system._

Running a server in offline mode (`online-mode=false`), which is common for cracked servers, certain proxy setups, or testing, removes Mojang's built-in authentication. Without a replacement, anyone can join using any username they type, including impersonating another player. AuthMe adds a register/login system to cover that gap.

## Install AuthMe

[AuthMeReloadedThe best authentication plugin for the Bukkit/Spigot API!On Modrinth ](https://modrinth.com/plugin/authmereloaded)

Download AuthMeReloaded from the project linked above. Check the supported Minecraft version, server platform, Java requirement and dependencies for the selected release.

1. Back up the server files and any plugin database.
2. Stop the server before changing JAR files. Put the compatible plugin build and its required dependencies in the correct plugin folder.
3. Start the server and read the startup log. Resolve missing dependencies or version errors before editing the generated configuration.
4. Stop the server, make one small configuration change, then restart and test it with a non-operator account.

Test registration, reconnects and recovery with a separate account. Proxy forwarding and authentication must be configured together; a backend should not bypass the intended login route.

## How Registration Works for Players

On first join, a player is typically frozen or restricted until they register:

```
/register <password> <confirmpassword>
```

Subsequent joins require logging in:

```
/login <password>
```

Both commands' exact names are configurable in `config.yml` if different wording is preferred.

## Restricting Players Before Login

AuthMe's config controls what an unauthenticated player can do before logging in. By default, movement, chat, and interaction are typically blocked or heavily restricted until `/login` succeeds, preventing an unauthenticated session from doing anything meaningful.

## Setting a Session Timeout

```
settings:
  sessions:
    enabled: true
    timeout: 10
```

allows a returning player within the timeout window (in minutes) to skip re-entering their password. It balances security against the annoyance of logging in every single join.

## Changing or Resetting a Password

```
/changepassword <old> <new>
```

for a player changing their own password. For admin-forced resets:

```
/authme setpassword <player> <newpassword>
```

## Unregistering an Account

```
/unregister <player>
```

removes a player's registration entirely, requiring them to register again on next join. Useful if an account is compromised or abandoned.

## Using AuthMe on a Proxy Network

AuthMe needs to either run on the proxy itself (if a compatible version exists for Velocity/BungeeCord) or be configured consistently across every backend server with shared MySQL storage. Authenticating on one backend but not the others defeats the purpose (the same issue that affects any plugin managing per-player state on a multi-server network).

## A Note on Security

AuthMe adds a login layer, but offline-mode itself still carries tradeoffs beyond authentication. Skin/cosmetic systems tied to a real Mojang account, for instance, won't function the same way. Whether offline-mode plus a login plugin or staying on online-mode entirely is the better fit depends on what the server actually needs from player identity.

## A safer authentication decision

Online-mode authentication and plugin-based registration are not interchangeable. On a standard public Java Edition server, keeping official account verification enabled is the safer default. A registration plugin on an offline-mode server cannot prove ownership of the underlying Microsoft account. Evaluate that trust difference before choosing a setup.

If a legacy network has an explicit requirement for plugin-based logins, document the threat model and test the entire proxy/backend architecture on an isolated instance. Check whether backend connections bypass the proxy, whether accounts can be impersonated, and how forgotten passwords are recovered. Do not ask players to send passwords to staff or expose authentication databases publicly.

### Recovery plan

Write down who can authorize an account recovery, what evidence is acceptable, how suspicious recovery attempts are logged, and how access is restored without revealing existing credentials. Test the workflow with a disposable account before launching.

For plugin-specific behavior, consult the [AuthMeReloaded documentation](https://github.com/AuthMe/AuthMeReloaded) for the exact release installed. Avoid mixing authentication snippets from different major versions.

## Review identity changes before recovering an account

Use the current authentication documentation to establish how the installation records player identities. Compare the login record with permissions, inventories and punishment data. A matching display name does not guarantee the same stored account. Before changing registration or recovery settings, test the complete path on staging. Keep recovery actions restricted to authorized staff and avoid asking players to reveal existing passwords in a ticket or chat message.

Document what evidence staff need before helping with a lost account and where that evidence is stored. Check session expiry and reconnect behavior separately from password login. On a network, inspect whether a backend can be reached without going through the intended authentication route. Treat that route as part of the security design rather than a convenience setting. Back up identity-dependent records before migrations so an unsuccessful change does not also remove your recovery options.

### Troubleshooting paths

- Wrong player data appears: inspect the stored identity and forwarding path.
- Session remains active unexpectedly: review the configured expiry behavior.
- Recovery request is uncertain: preserve the account and escalate verification.

## Official documentation and links

- [Official project repository](https://github.com/AuthMe/AuthMeReloaded)
- [Cracked, Whitelisted, or Premium-Only: Picking a Minecraft Server Auth Model](https://www.zcraftstudios.com/blog/minecraft-server-authentication-methods)

## AuthMeReloaded project examples

These images come from the project’s official gallery. Use them to see the interface or gameplay; they show publisher examples rather than this server’s configuration.

[![AuthMeReloaded: official gallery example 1 ](https://cdn.modrinth.com/data/9js4IEHC/images/f8d47f045fe3c44e682052dd00332441adf3d409_350.webp)](https://modrinth.com/plugin/authmereloaded/gallery)

_Official AuthMeReloaded gallery example. [Image source](https://modrinth.com/plugin/authmereloaded/gallery)._

## Authentication safety and account identity

Offline-mode removes the normal Mojang/Microsoft identity verification, so a plugin password alone does not reproduce the protections of premium authentication. Prefer online-mode wherever it suits your server. If a proxy or special authentication design requires alternative handling, use the official documentation and isolate backend access appropriately.

Before making authentication changes, test returning players' identity and inventory behavior in staging. A mismatched UUID or forwarding configuration can look like lost player data.

## Continue reading

- [Minecraft Maintenance Mode Without Losing Players](https://www.zcraftstudios.com/blog/minecraft-server-maintenance-mode-without-losing-players)

[ Previous guide Run a Minecraft Server With Docker: Setup Guide](https://www.zcraftstudios.com/blog/docker-minecraft-server-setup)[ Next guide Setting Up Skript: Custom Mechanics Without Writing a Plugin](https://www.zcraftstudios.com/blog/skript-custom-mechanics-without-java)