One Password Auth

Quick rating

Community listing page, reviews here may not be monitored by the author.

How listings work Are you the author?

One Password Auth

By bearcottOwner

No reviews yet

Authenticate your offline Fabric server with just one password for everyone. For small community servers!

Mod Loaders
Minecraft
26.2
Hosting Partner

Want to reach Minecraft players?

We're looking for a server hosting partner to feature here and other parts of the site. Interested? Send us a message!

Get in touch

About

Description

One Password Auth

A lightweight server-side mod/plugin that protects your offline (or online) server with a single shared password. Designed for small friend groups and private communities—no per-user accounts, no complex authentication schemes, just one password everyone shares!

✅ Core Features

  • Single shared password for entire server access
  • Secures all players/inventories before authenticating, even those with OP access
  • Disables all known attack vectors (see below) including block-breaking packets from hacked clients
  • Players authenticate once with /login <password> then they're IP whitelisted
  • Customizable login title and description
  • Discord webhook integration for event logging

🚀 Getting Started

Fabric: drop one-password-auth-fabric-*.jar into mods/. Needs Fabric API.

Paper: drop one-password-auth-paper-*.jar into plugins/. Nothing else needed.

That's it! Everything should work out of the box! The next time anyone logs in, they will be greeted with a login dialogue.

Note: On first boot a phonetic password (e.g. komipu42!) is generated and written to the config file — check your console or that file, or write the config file yourself beforehand to choose your own.

Where the files live

Fabric Paper
Config config/one_password_auth_config.properties plugins/OnePasswordAuth/one_password_auth_config.properties
IP + UUID whitelist config/one_password_auth_ip_whitelist.txt plugins/OnePasswordAuth/one_password_auth_ip_whitelist.txt
Pending sessions config/one_password_auth_sessions.json plugins/OnePasswordAuth/one_password_auth_sessions.json

⚙️ Customization

Upon first boot the plugin will generate a config file with a default password (such as komipu42!) and all additional customizable settings (see the table above for where it is).

All the lines except for password= are optional! The server will kick everyone if no password is set.

To change any settings, just edit the config file and restart the server.

Settings

Setting Default What it does
password generated The shared password everyone types with /login. The only required line.
webhook_url none Discord webhook for the player feed: joins, login attempts (including what was typed), successes, timeouts, and advancements earned after logging in.
admin_webhook_url none Discord webhook for security: server start, stop and crash, every connect and disconnect, and advancements earned while still unauthenticated.
login_title built in Big title on the lockdown screen. Supports § codes.
login_description built in Subtitle under it. Supports § codes.
timeout_seconds 180 Kick an unauthenticated player after this many seconds of inactivity.

Example

password=komipu42!
webhook_url=https://discord.com/api/webhooks/xxx/yyy
admin_webhook_url=https://discord.com/api/webhooks/xxx/zzz
login_title=§6Welcome to my server!
login_description=§7Type /login <password> to join
timeout_seconds=180

Use § followed by a color/format code in login_title or login_description for styling (e.g. §6 gold, §l bold). See https://minecraft.wiki/w/Formatting_codes for the full list.

🛡️ Attack Vectors Defended

Before they log in, players are frozen in place, made invincible, blinded, and put into spectator. On top of that, this mod also blocks:

  • Breaking blocks — via hacked clients that send fake packets
  • Moving or teleporting away — players are locked in position on every tick
  • External state drift & Mod interference — lockdown effects are re-asserted every tick
  • Admin commands & OP powers — all op permissions are taken away on lockdown
  • Minimized IP-spoofing — successful logins are saved as a user UUID and IP pair
  • Same-account session hijacking — if they're already logged in, a second login gets denied instead of kicking them
  • Bruteforcing — 1-second cooldown, kicked after 7 tries, kicked if idle too long

🔨 Future Development

Upon request I may add features to this mod. It runs on Fabric and Paper; other platforms may follow if others are interested.