Minecraft Server Password: How to Lock Your Server

There is no built-in Minecraft server password on Java Edition: server.properties has no setting that asks players for a password when they join. The right way to lock a server is a whitelist, so only the accounts you add can get in (whitelist add Name, then whitelist on). If you also want a typed password, a login plugin can add one on top. This guide explains each option and the passwords that really matter: your panel account and RCON.

Why there is no Minecraft server password on Java

On a server with online-mode=true (the default), every player is verified against Minecraft's account servers before they join. The server already knows exactly who each player is, so it decides access by account, not by a shared secret. A shared password would also leak the moment one friend passes it on, while a whitelist entry belongs to one account only.

Lock your Minecraft server with a whitelist

This is what most people mean when they ask for a password: "only my friends can join". It takes two minutes.

1. Open your server in the TheGameHosting panel and click Console.
2. Add yourself first: whitelist add YourName.
3. Add each friend with their exact Java username: whitelist add FriendName.
4. Turn the list on: whitelist on.
5. Open Files, check that server.properties has white-list=true and add enforce-whitelist=true, so anyone removed is kicked.
6. Restart the server and ask a friend who is not on the list to try joining. They should see "You are not white-listed on this server!".

whitelist add YourName
whitelist add FriendName
whitelist on

Our full guide on the Minecraft server whitelist covers whitelist.json, the not-whitelisted error and Bedrock players joining through Geyser.

Adding a password with a login plugin

Some owners still want players to type a password, for example on a server where staff accounts need a second lock. A login plugin such as AuthMe Reloaded does that on Paper and Spigot: new players register a password with /register password password, and on every join they must type /login password before they can move or chat.

Use it only as an extra layer on a server with online-mode=true. It does not replace the whitelist: anyone can still connect and see the login prompt. Install it from the Plugins tab, restart, and read its config file in Files before going live.

Keep your server address private

Bots scan the internet for Minecraft servers, so a hidden address is not protection on its own. It still helps:

1. Share the address and port only in private chats, not on public lists.
2. Set enable-status=false in server.properties if you want the server to appear offline in the server list. Players who know the address can still join.
3. Set hide-online-players=true to hide player names in the server list.

The passwords that really matter

The biggest risk is not a stranger joining, it is someone getting into your hosting account.

1. Your panel account. Use a long, unique password and turn on two-factor authentication in your account settings if your panel offers it.
2. Co-admins. Do not share your login. On TheGameHosting, invite them in the Users tab and give each person only the permissions they need, such as Console or Files.
3. RCON. If you enable enable-rcon=true, set a long rcon.password. RCON is not encrypted, and anyone with that password controls the server. If you only need commands, the panel Console already does that.
4. SFTP. It uses your panel password, so the same rules apply. See how to use SFTP on a Minecraft server.

Common questions about server access

1. A friend cannot join after you turned on the whitelist. Their name is misspelled or they were not added. Run whitelist list.
2. An operator can join without being on the list. That is normal on Java: operators always get in. Remove OP from accounts that should not have it.
3. Bedrock friends through Geyser cannot join. They need fwhitelist add Gamertag from Floodgate.
4. Someone griefed with a friend's account. Remove them with whitelist remove Name and kick Name, then restore the world from Backups.

A private server that stays private, on TheGameHosting

A private server only works if it is online when your friends want to play, and safe when you are not watching. On TheGameHosting it runs 24/7 on AMD 9950X or 7950X3D CPUs in Dallas or Amsterdam with DDoS protection on every plan, so attacks on your address do not take it down. You turn on the whitelist in Console, control co-admins in Users, and roll back griefing from Backups.

Java plans start at 2 GB for $1.90 USD per month, ready about 60 seconds after payment. Choose yours on Pricing or read about our Minecraft server hosting.

FAQ

Hosting for this game

• Minecraft server hostingOne plan, 60+ games · from $1.90 USD/month