Offline Mode Minecraft Server: What It Does and the Risks

An offline mode Minecraft server is a Java server with online-mode=false in server.properties. It stops checking players against Minecraft’s account servers, so anyone can join with any name they type, including yours as the admin. This guide explains what that switch does, the real risks, what Mojang’s rules say, and the one setup where offline mode is normal: backend servers behind a proxy that does the checking.

This is an explainer, not a tutorial for letting unpaid accounts in. If some friends do not own Java Edition, jump to the legitimate options; there are good ones.

What online-mode does

According to the Minecraft Wiki, online-mode controls “whether to only allow players verified with the Minecraft account database to join”. Its default is true.

The community calls these servers “cracked” or, in Spanish-speaking countries, “no premium”. The Wiki is clear that the setting should only be off when the server is not connected to the internet.

Why the name becomes the identity

Your server tracks players by UUID, not by name. With online mode on, the UUID belongs to the player’s Java account. In offline mode the server makes one up from the name itself (a hash of OfflinePlayer: plus the username), so the same name always gives the same UUID, for anybody who types it.

Inventories in world/playerdata, operator status in ops.json, the whitelist and bans are all tied to that UUID. Whoever types a name inherits everything attached to it. Switching an existing world between modes also changes every UUID, so players spawn as new players with empty inventories.

The real risks of an offline mode Minecraft server

1. Anyone can log in as the admin. Join with your name and they get your OP level: items, game mode, bans, world edits.
2. Inventories and builds are easy to steal. The same trick works on any player.
3. The whitelist stops being a lock. A Minecraft server whitelist checks UUIDs, and in offline mode those come from names. Bans by name are just as weak.
4. No skins. Skins are signed by Minecraft’s account services, so offline players get the default ones.
5. Easy to flood with bots. No account is needed to connect, so a script can join with endless invented names.
6. Login plugins are a patch. A plugin that asks for a password helps against name theft, but you now store passwords you must protect, and it changes nothing about the rules below.

What Mojang’s EULA and Usage Guidelines say

The Minecraft EULA lets you install the Java Edition server software and host online play. The Minecraft Usage Guidelines, in their servers section, say that access to your server “must only be granted to users who have a genuine paid-for version of Minecraft”. In plain words: hosting is fine; letting people in who have not bought the game is something the guidelines say a server must not do. Mojang can update these documents, so read the current text on minecraft.net.

That is why we do not give steps for letting non-premium accounts in. The only switch involved is the online-mode line above.

How to check online-mode on your server safely

Whatever you decide, do it with a backup and in the right place. On TheGameHosting the whole check takes a minute:

1. Make a backup first. In the panel, go to Backups → Create backup. Changing this setting changes every player’s UUID.
2. Open the file. In Files, open server.properties in the main folder.
3. Find the line online-mode=.
4. Public or friends server: keep it at true. This is the right value for almost everyone.
5. Backend behind Velocity: set it to false only if the proxy runs in online mode with forwarding on and the backend accepts connections only from the proxy (next section).
6. Save and restart from the panel so the server reads the file.

The legitimate use: backends behind a proxy

In a network with a proxy such as Velocity or BungeeCord, the proxy is the only public address. It checks every player with Minecraft’s account servers and forwards the verified name and UUID to the servers behind it, which run with online-mode=false because the check already happened. The PaperMC documentation recommends Velocity’s modern forwarding: in velocity.toml, then in config/paper-global.yml on each Paper backend:

player-info-forwarding-mode = "modern"

proxies:
  velocity:
    enabled: true
    online-mode: true
    secret: "the same secret as in forwarding.secret"

The secret must match the proxy’s forwarding.secret file. PaperMC calls BungeeCord’s older legacy forwarding “fundamentally insecure”. And the backend must only accept connections from the proxy; Velocity’s docs warn that otherwise someone could impersonate any player.

The other legitimate case is a test world on a machine with no internet connection, as the Wiki describes.

Safer ways to play with friends who do not own Java

If a friend asks how to connect, send them our guide on how to join an offline mode server with a legitimate account.

Run a safe online-mode server on TheGameHosting

Most people who look up offline mode want friends on different devices in one world, without hassle. You can have both with account checks on. On TheGameHosting your Java server runs 24/7 in Dallas or Amsterdam, with no ports to open. Leave online-mode=true, edit server.properties in Files, add friends in Console with whitelist add, add the Geyser and Floodgate plugins on Paper for Bedrock friends (crossplay is available on every plan), and take a backup before any change. DDoS protection is included and player slots are unlimited.

See Minecraft server hosting, compare RAM on plans and pricing from $1.90 USD/month, and use FULL2026 for 15% off for life.

FAQ

Hosting for these games

• Minecraft Java hostingPaper, Purpur, Fabric, Forge and more
• Minecraft Bedrock hostingPhones, consoles and Windows