Keychain
Switch Minecraft accounts in-game without restarting. A Keychain button is added to your title screen and pause menu. Click it, pick Add Online, and the real Microsoft sign-in page opens in your browser. Sign in normally — email, password, 2FA — and your account appears in the list. Click any saved account to switch to it instantly.
Features
- 🔑 One-click account switching — click any saved account in the list, you're switched. No restart.
- 🌐 Real Microsoft login — opens
login.microsoftonline.comin your browser. Same form Microsoft uses everywhere. Email, password, 2FA, all official. - 👤 Offline accounts — pick a username, switch immediately. Same
OfflinePlayer:UUID derivation vanilla uses. - 🔒 Encrypted at rest — your saved tokens are AES-GCM-encrypted with a key tied to your machine. Anyone who copies your
.minecraftfolder gets unreadable data. - 🚫 Zero telemetry — only talks to Microsoft and Mojang's official endpoints. No phoning home, no analytics.
- ⚡ Tiny — ~50 KB jar. No bundled browser, no native libs.
- 🧹 Clean UI — top-left button, two big actions, click-to-switch, right-click-to-remove.
How it works
Keychain uses the OAuth 2.0 Authorization Code flow with PKCE — the same flow MultiMC, Prism Launcher, and Auth Me use. When you click Add Online:
- Keychain starts a tiny local HTTP server bound to
127.0.0.1on a random free port. - Your default browser opens to the official Microsoft sign-in page.
- You sign in with your real credentials. 2FA and security keys work normally.
- Microsoft redirects back to
http://localhost:<port>/callback. - Keychain captures the auth code, exchanges it through the standard Microsoft → Xbox Live → XSTS → Minecraft Services chain.
- Your account appears in the list, encrypted to disk.
The local server only exists during the ~5-minute sign-in window and shuts down immediately afterwards.
Privacy
- 🔐 AES-GCM encryption of
<gamedir>/config/account-switcher.jsonusing a key derived from your OS user + machine name. Tokens are unreadable on any other machine. - 🚷 No tokens in logs.
latest.logand crash reports never contain access tokens, refresh tokens, or auth codes. - 🛡️ PKCE + state parameter — protects against code interception and CSRF.
- 🌐 HTTPS-only outbound traffic to:
login.microsoftonline.com,user.auth.xboxlive.com,xsts.auth.xboxlive.com,api.minecraftservices.com. Nothing else. - 🔒 Loopback-only local callback server (
127.0.0.1, never reachable over your network).
Installation
- Install Fabric Loader for Minecraft 26.1.x.
- Download Fabric API and drop it into
%APPDATA%\.minecraft\mods(Windows) /~/Library/Application Support/minecraft/mods(macOS) /~/.minecraft/mods(Linux). - Drop the Keychain jar into the same folder.
- Launch Minecraft. Keychain button is at the top-left of the title screen and pause menu.
Compatibility
- ✅ Minecraft 26.1, 26.1.1, 26.1.2 (Fabric)
- ✅ Java 25
- ✅ Client-side only (don't put it on your server)
- ⚠️ Mid-server account switching may kick you — switch from the title screen for cleanest behaviour.
- ⚠️ Skin doesn't refresh on a server you're already connected to. Disconnect and reconnect after switching.
FAQ
Why does the Microsoft consent screen say "Auth Me for Minecraft"? Keychain ships with a public Azure App ID registered by Auth Me (axieum), used by ~9.6 million players. If that ever gets revoked, Keychain has a built-in Use custom Azure ID fallback to paste your own.
Is this safe for my Microsoft account?
Yes. The mod opens the real login.microsoftonline.com — you're signing in to Microsoft directly, not to me. Verify the URL bar. Same flow as the official Minecraft launcher and every major third-party launcher.
Will my token file leak if I share my .minecraft folder? No. The file is AES-GCM-encrypted with a per-machine key. Unreadable elsewhere.
Can I sign in to multiple accounts and switch? Yes — that's the entire point. Add as many as you want, click any one to switch.
Does it work on servers? Yes for switching from the title screen / pause menu before joining. Switching mid-game on a server will likely get you kicked because the protocol session changes.
Source & support
Made by Domsimus.
