Authisator
Authisator is a server-side mod/plugin that adds premium authentication protection for offline-mode Minecraft servers.
Features
- Allows Mojang-authenticated players to join normally
- Detects offline players using premium usernames and assigns visible aliases like
Steve_4821 - Checks offline names for proxy/VPN/Tor/datacenter risk via
proxycheck.io - Requires offline players to register a backup password with
/auth register <password> - Stores the last known IP in
world/authisator/players.json - Automatically logs in returning players from the same IP
- Requires
/auth login <password>if the IP changes - Blocks chat, commands, block interactions, attacks, item drops, and movement until login is complete
Commands
/auth register <backupPassword>
/auth login <backupPassword>
/login <backupPassword>
/register <backupPassword>
/auth changepassword <oldPassword> <newPassword>
/auth status
Security
Passwords are stored securely using PBKDF2-HMAC-SHA256 with a random salt, not in plain text.
Configuration
Creates:
config/authisator.properties
Important defaults:
blockPremiumNamesInOfflineMode=true
trustClientProfileIdForPremiumPass=true
premiumNameMismatchAction=rename_and_allow
failClosedOnMojangError=true
proxyCheckEnabled=true
failClosedOnProxyError=false
proxyRiskThreshold=90
minimumPasswordLength=6
maxPasswordAttempts=5
Note: On a purely offline server, Authisator uses the client-supplied profile UUID as a practical premium signal. Full protection still requires online-mode or a proxy setup that forwards Mojang-authenticated UUIDs.
