Minecraft login plugins: AuthMe, nLogin and more

In short: for a single Paper server the most direct choice is AuthMe Reloaded (open source, builds up to 26.3, SQLite, MySQL, MariaDB and PostgreSQL, TOTP login). nLogin runs on servers and proxies alike, but password-free premium login and sessions are features of its paid edition. LimboAuth is Velocity-only and logs players in inside a virtual world before they reach a server. LibreLogin is open source and handy on a proxy, but its latest release, 0.24.0, came out in January 2025 with support up to 1.21.4. Whichever plugin you pick, use a slow hash, limit login attempts and never leave game servers reachable around the proxy.

Why you need a login plugin#

With online-mode=false the server doesn't check the account with Mojang, and a player's UUID is derived from the name. Whoever joins under an admin's name gets the admin's UUID — with the inventory, permissions and OP. A login plugin locks the name with a password: on first join the player registers (/register), afterwards logs in with /login, and until then can't move, place blocks, run commands or open the inventory. The mode itself is covered in offline-mode servers.

A server with online-mode=true usually doesn't need one: Mojang checks the account. Neither do game servers behind a Velocity proxy that checks accounts itself: they're protected by player info forwarding and a closed port — see Velocity setup.

Login plugins compared#

Each plugin in brief#

AuthMe Reloaded

The most complete option for a single server: separate builds for Paper, Folia and Spigot, proxy plugins, a built-in AntiBot, e-mail recovery, binding a name to an IP (restricted users), a captcha and a temporary IP ban after failed attempts. On Paper and Folia 1.21.11+ it can show a login dialog before the player even enters the world. A premium player turns on password-free login with /premium; without a proxy that needs PacketEvents 2.x — without it the feature simply stays off. It can import accounts from LibreLogin, LimboAuth, nLogin, OpeNLogin and others.

LibreLogin

An open-source plugin usually installed on the proxy — Velocity or BungeeCord — with a port for Paper. TOTP, sessions, Bedrock support through Floodgate, migration from AuthMe, JPremium, nLogin and others. Players enable password-free login themselves with /premium <password> — after which they can't join from a non-premium client until an admin turns it off. On a proxy, LibreLogin needs a separate limbo server for logging in, and that limbo has to be secured. The main drawback is freshness: the latest release, 0.24.0 of 27 January 2025, lists support for 1.21.1–1.21.4.

LimboAuth

A Velocity plugin by Elytrium built on LimboAPI: the player logs in inside a virtual world on the proxy itself and reaches the game servers already authenticated. BCrypt hashing, H2, MySQL and PostgreSQL, TOTP, Floodgate, weak-password blocking, migration from AuthMe-like plugins. In hybrid mode (online-mode-need-auth: false) a premium account's name can only join with that premium account and without a password; by default everyone registers. Built for networks — no use for a single server without a proxy.

nLogin

A plugin by nickuc for servers and proxies. On a network it goes on the proxy and on the authentication servers, not on the game-mode servers. By default it hashes with BCRYPT2A and punishes for 15 minutes after a single wrong attempt (max-login-tries: 1, punishment-duration: 15). It migrates accounts with /nlogin converter <plugin> from AuthMe, LibreLogin, LimboAuth, JPremium and dozens of others. Password-free premium login, Bedrock login without authentication, sessions and linking e-mail and Discord as a second factor are listed as features of the paid nLogin Premium.

A safe setup, using AuthMe as the example#

1. 1

   A slow hash

   By default AuthMe stores passwords as SHA256. It also lists BCRYPT and ARGON2 as recommended, and LibreLogin, nLogin and LimboAuth use BCrypt by default. When you switch algorithms on a live server, put the old one in legacyHashes: AuthMe checks the password the old way and rehashes it with the new one. ARGON2 needs the argon2 library on the system.

2. 2

   Limit attempts

   Turn on a captcha after failed attempts (useCaptcha, after 5 by default) and a temporary IP ban (enableTempban: 480 minutes after 10 attempts). Both are off by default in AuthMe.

3. 3

   Longer passwords

   minPasswordLength defaults to 5 — raise it. The unsafePasswords list already bans 123456, password and qwerty; add your own.

4. 4

   Lock down staff accounts

   For admin names turn on AllowRestrictedUser and bind them to IPs in AllowedRestrictedUser, and have the admins enable TOTP (/totp add). Grant permissions through groups in LuckPerms, not OP.

5. 5

   Keep passwords out of logs

   AuthMe itself strips lines with /login, /register, /changepassword and 2FA codes from the console. If you add plugins that log every player command to a file or to Discord, make sure passwords don't end up there.

settings:
    security:
        minPasswordLength: 8
        passwordHash: BCRYPT
        legacyHashes:
        - SHA256
Security:
    captcha:
        useCaptcha: true
        maxLoginTry: 5
    tempban:
        enableTempban: true
        maxLoginTries: 10
        tempbanLength: 480

Login on a server network#

• The proxy checks accounts (online-mode=true on Velocity): you don't need a login plugin at all. If you still run AuthMe on the game servers, set Hooks.bungeecord: true so the proxy confirms premium accounts.
• The proxy runs in offline mode: put AuthMe on the servers and authme-velocity or authme-bungee on the proxy with the same proxySharedSecret; or use a proxy-level plugin — LibreLogin, LimboAuth or nLogin with its own layout.
• Game server ports are for the proxy only. The Velocity docs warn that anyone who connects to a game server around the proxy can pose as any player. No login plugin on the proxy fixes that — close the ports in the firewall, see server IP and port.
• Against bots — AuthMe's built-in AntiBot (on by default) and measures at the proxy and host level, see bots and DDoS.

How to choose#

• One server on Paper or Folia — AuthMe Reloaded: current builds, open source, every safeguard in one config.
• A Velocity network, login before reaching the servers — LimboAuth or nLogin; AuthMe if you'd rather keep it on the servers with the proxy plugin.
• Free password-free premium login — AuthMe (/premium), LibreLogin or LimboAuth; in nLogin it's a paid feature.
• Moving from another plugin — AuthMe imports from LibreLogin, LimboAuth, nLogin and OpeNLogin, nLogin has /nlogin converter, LibreLogin migrates from AuthMe, JPremium and nLogin. Back up the database before you move.

Login and the anticheat#

A login plugin decides who is behind a name, not what that player does after /login. DGuard — the best anticheat for a modern Minecraft server — checks behaviour and packets rather than the account, so on an online-mode=false server it works exactly as on a premium one: every client goes through the same combat, movement, building, inventory and packet checks. A fresh name after a ban doesn't make a cheater invisible — the same checks catch them on the new account.

DGuard works behind Velocity and BungeeCord and makes exceptions for Bedrock players joining through Floodgate. And PacketEvents, which AuthMe needs to let premium players in without a password on a server without a proxy, is already installed: DGuard always runs next to its latest release.

FAQ#