Non-Premium Minecraft Server: Safe Offline Mode with AuthMe

To let non-premium players join a private Minecraft Java server, use a plugin-compatible server such as Paper, set online-mode=false, and protect every username with AuthMeReloaded before you share the address. Offline mode alone is not a complete setup: it stops official account verification, so another player can try to connect under someone else’s name.

This approach is best kept to a small, private group. For a public server, an economy, paid ranks, competitive play, or a community whose members you do not know personally, keep online-mode=true whenever possible.

Already using a verified account and only trying to solve a login error? Follow our Failed to verify username troubleshooting guide first. Do not switch to offline mode as a default fix.

What offline mode changes

With online-mode=true, the server asks the official account service to verify the player’s identity. With online-mode=false, the server accepts the name presented by the client without that check.

That affects more than login. Inventories, homes, claims, ranks, and operator access can be associated with a player name or UUID. After a mode change, an existing player may receive a different UUID and appear to have lost data or permissions. AuthMeReloaded adds a password gate, but it does not restore official account verification.

Step 1: Back up the server before changing identity mode

Stop the server and create a restorable backup of:

• every world folder;
• server.properties;
• the plugins folder and plugin configuration;
• permissions, whitelist, and operator data;
• the AuthMe database, if the plugin is already installed.

If this is an established server, test the change on a copy first. Do not assume that existing inventories, permissions, or whitelist entries will map cleanly after the UUID change.

Step 2: Install AuthMeReloaded on Paper

Stage the login plugin before opening offline access:

1. Confirm that your Paper and AuthMeReloaded versions are compatible.
2. While online-mode=true is still enabled, stop the server.
3. Upload the AuthMeReloaded JAR to the plugins folder.
4. Start the server once and check the console for a successful AuthMe startup.
5. Confirm that the plugin created its files under plugins/AuthMe, then stop the server again.

Do not continue if AuthMe fails to enable or reports a compatibility error. This staging step prevents you from deliberately reopening the server in offline mode with a broken or missing login layer.

Step 3: Enable offline mode and keep access private

Edit server.properties while the server is stopped:

online-mode=false
white-list=true

For a private server, the whitelist is a useful second layer, but it does not replace AuthMe. Rebuild or recheck the whitelist after changing modes because player identities may no longer match their earlier entries.

On a Mineando server, save the file change and start the server again. Before anyone joins, verify in the console that AuthMeReloaded is enabled without errors. Keep the server address private while you finish configuring and testing access.

Step 4: Lock down unauthenticated players

Review the current AuthMe configuration in plugins/AuthMe/config.yml; exact option names and defaults can change between releases. The effective setup should prevent a player who has not logged in from:

• moving, building, breaking, or interacting with blocks;
• using or moving inventory items;
• chatting or running commands other than the commands needed to authenticate;
• reaching portals or other mechanics that move the player;
• using plugin features that trust a username before authentication.

Also review registration limits, session behavior, password storage settings, and recovery options for the version you installed. After changes, restart the server and check the startup log rather than assuming the configuration loaded correctly.

Step 5: Register and test a player

A new player normally registers once and logs in on later sessions:

/register <strong-password> <same-password>
/login <strong-password>

Use a strong, unique password that is not the password for a Microsoft account or any other service. Do not expose it in screenshots, streams, support chats, or shared setup notes.

Before inviting the group, use a test name you control and confirm all of the following:

1. An unregistered player cannot move, chat, interact, use inventory, or run unrelated commands.
2. Registration unlocks only normal player actions.
3. A wrong password is rejected.
4. A registered player must authenticate again according to your configured session policy.
5. A second connection using the same registered name is rejected or handled by your configured duplicate-session policy without granting unverified access.
6. Restarting the server does not disable the restrictions or produce plugin errors.
7. The whitelist still admits only the names you intended.

Step 6: Protect OP and permissions

Offline mode makes administrator names especially sensitive. Register every administrator name before restoring OP or elevated roles, and never invite players while a privileged name is unclaimed.

• Remove OP from old test names and unused accounts.
• Give OP only to the smallest possible number of trusted administrators.
• Confirm that logged-out players cannot run administrative or plugin commands.
• Use scoped roles instead of broad OP access where possible.
• Back up the AuthMe database whenever you back up worlds and plugin data.

For role-based access, use the LuckPerms permissions guide to grant only the commands each group needs.

Proxy networks need a different design

Do not apply this single-server recipe blindly to Velocity or BungeeCord. Backend Paper servers in a proxy network often use online-mode=false so they can accept identities forwarded by the proxy; that is different from allowing players to connect directly in offline mode.

The proxy should be the only public entry point. Protect backend addresses with network controls, configure the correct secure forwarding method, and place player authentication at the network entry point using a proxy-aware design. A directly reachable offline backend can bypass protections on the proxy.

Skins and crossplay

Official skins may behave differently when account verification is disabled. Fix authentication first, then add a compatible skin plugin only if you need one.

Offline mode also does not add Java and Bedrock crossplay. Geyser and Floodgate solve a separate connection problem and require their own setup.

Safe baseline

For a private non-premium server, the minimum responsible setup is offline mode plus AuthMeReloaded, a tested whitelist, reserved administrator names, limited permissions, and recoverable backups. Test the entire registration and login flow before giving anyone the address, and keep official online mode enabled whenever non-premium access is not a real requirement.