How to Disable Online Mode for your Minecraft Server (Cracked Clients)

By default, Minecraft servers run in online mode. This means the server authenticates connecting players with Mojang/Microsoft to verify they own the game. If you want to allow players with cracked clients (non‑premium accounts) to join, you must disable online mode. This guide explains how to do so and how to secure your server when authentication checks are removed.

Important Security Considerations

Disabling online mode removes Mojang authentication, which exposes your server to several risks:

• Unauthorized access. Anyone can join using any username, including impersonating operators or existing players.
• Loss of skins and profile data. Without authentication, players will not see their official skins and may have blank default skins.
• Incompatible services. Some services, such as Realms integration or certain plugins, require online mode and will not function offline.

To mitigate these risks, you should install an authentication plugin such as AuthMe Reloaded or FastLogin and enable a whitelist so only approved players can join.

Disabling Online Mode

1. Navigate to the Wabbanode Control Panel and Stop your server.
2. Open Files and locate the server.properties file. Click to edit it.
3. Find the line online-mode=true and change it to online-mode=false.
4. Save the file and Start your server. Players with cracked clients can now join using the server address.

Securing an Offline‑Mode Server

Once online mode is disabled, follow these steps to secure your server:

1. Install an authentication plugin. Download an authentication plugin jar (for example, AuthMe Reloaded or FastLogin) and upload it to your plugins folder following the same process described in our plugin installation guide. Start your server so the plugin generates its configuration. Configure the plugin to require players to register and log in with a password when they join.
2. Enable whitelist. In the Console or in‑game, run /whitelist on to enable the whitelist. Add each player you want to allow using /whitelist add <playername>. This prevents unknown users from joining.
3. Maintain operator security. Do not give operator status lightly. Since usernames are not verified, an imposter can claim an OP’s name if the OP is not whitelisted.
4. Re‑enable online mode when possible. If your players later purchase the game, you can revert to online mode by setting online-mode=true and restarting the server. Remove authentication plugins if they are no longer needed.