SHIELDAUTH - Advanced Authentication Plugin for Minecraft
Compatible with Spigot, Paper and forks from version 1.16.5 to 1.21
Java 21 required
FEATURES
Authentication
- Password-based authentication with /register and /login
- Configurable password requirements (min/max: 6-32 by default)
- Multiple encryption algorithms: ARGON2 (recommended), BCRYPT, SHA256, SHA512
- Configurable session system (remember login) - Disabled by default
PIN System
- GUI-based PIN entry with clickable number heads
- Configurable PIN length (default: 4 digits)
- Extra security layer after password authentication
- Brute force protection with rate limiting
Rate Limiting and Temporary IP Blocking
- Per-account login attempt limiting
- Per-account PIN attempt limiting
- Per-IP login attempt limiting (protects against distributed attacks)
- Per-IP PIN attempt limiting
- Temporary IP blocking when limits are exceeded
- Configurable block durations
- Automatic unlock after timeout
- Configurable kick on block (enabled by default)
Authentication Timeouts
- Auto-kick if player doesnt register in time
- Auto-kick if player doesnt login in time
- Auto-kick if player doesnt enter PIN in time
- Fully configurable times
- Customizable kick messages
Update Checker
- Automatically checks for new versions on GitHub
- Displays console message if update is available
- Configurable (enable/disable)
Database
- SQLite (local) - Zero configuration required
- MySQL (cloud) - For networks and multiple servers
- HikariCP connection pooling for optimal performance
Notifications
- Discord Webhooks - Get notified of logins/registrations
- Customizable embed colors (RGB)
- IP spoiler protection in Discord
Email Verification
- SMTP email support (Gmail, custom SMTP)
- Verification codes
- Recovery options
Customization
- ALL messages configurable in config.yml
- Title messages with fade effects
- Custom command aliases
- Fully configurable permissions
USER COMMANDS
/register (aliases: /reg, /r, /signup, /crear, /registrar)
- Description: Register new account
- Usage: /register password confirmpassword
- Permission: None
/login (aliases: /l, /log, /signin, /entrar, /iniciar)
- Description: Login to account
- Usage: /login password
- Permission: None
/changepassword (aliases: /changepass, /cp, /cambiarpass, /newpass, /chpass)
- Description: Change password
- Usage: /changepassword currentpassword newpassword
- Permission: shieldauth.changepassword
/unregister (aliases: /unreg, /deleteaccount, /borrar)
- Description: Delete your account
- Usage: /unregister password
- Permission: shieldauth.unregister
/setpin (aliases: /pin, /addpin, /createpin)
- Description: Set security PIN
- Usage: /setpin pin
- Permission: shieldauth.pin
/removepin (aliases: /delpin, /deletepin, /rmpin)
- Description: Remove your PIN
- Usage: /removepin pin
- Permission: shieldauth.pin
/unsetpin (aliases: /nopin, /clearpin)
- Description: Remove your PIN (alias)
- Usage: /unsetpin pin
- Permission: shieldauth.pin
/setemail (aliases: /email, /mail, /addemail)
- Description: Set recovery email
- Usage: /setemail email
- Permission: shieldauth.email
/verifyemail (aliases: /verify, /confirmemail, /vmail)
- Description: Verify your email
- Usage: /verifyemail code
- Permission: None
ADMIN COMMANDS
/shieldauth reload
- Description: Reload configuration
- Permission: shieldauth.admin
/shieldauth addadmin player
- Description: Add player to admin list
- Permission: shieldauth.admin
/shieldauth removeadmin player
- Description: Remove player from admin list
- Permission: shieldauth.admin
/shieldauth list
- Description: List all admins
- Permission: shieldauth.admin
/shieldauth info player
- Description: View player authentication info
- Permission: shieldauth.admin
/shieldauth forcelogin player
- Description: Force login a player
- Permission: shieldauth.forcelogin
/shieldauth forceunregister player
- Description: Force unregister a player
- Permission: shieldauth.forceunregister
/shieldauth forcesetpin player pin
- Description: Force set PIN for a player
- Permission: shieldauth.forcesetpin
/shieldauth forceremovepin player
- Description: Force remove PIN from a player
- Permission: shieldauth.forceremovepin
/shieldauth help
- Description: Show help menu
- Permission: shieldauth.admin
Admin command aliases: /sa, /sh, /auth, /shield
PERMISSIONS
shieldauth.admin
- Description: Access to all admin commands
- Default: OP
shieldauth.forcelogin
- Description: Force login players
- Default: OP
shieldauth.forceunregister
- Description: Force unregister players
- Default: OP
shieldauth.forcesetpin
- Description: Force set PIN on players
- Default: OP
shieldauth.forceremovepin
- Description: Force remove PIN from players
- Default: OP
shieldauth.changepassword
- Description: Change own password
- Default: true
shieldauth.unregister
- Description: Unregister own account
- Default: true
shieldauth.pin
- Description: Set/remove own PIN
- Default: true
shieldauth.email
- Description: Set own email
- Default: true
CONFIGURATION OPTIONS
Database Settings
- type: sqlite or mysql
- host: Database host (for MySQL)
- port: Database port (default 3306)
- database: Database name
- username: Database username
- password: Database password
- pool-size: Connection pool size (default 10)
Update Checker Settings
- enabled: true or false
- github-url: URL to your GitHub repository
- github-api-url: GitHub API URL for releases
Security Settings
- encryption: ARGON2, BCRYPT, SHA256 or SHA512
- password-min-length: Minimum password length (default 6)
- password-max-length: Maximum password length (default 32)
- pin-length: PIN length (default 4)
- max-login-attempts: Login attempts per account (default 5)
- lock-duration: Account lock duration in seconds (default 300)
- max-pin-attempts: PIN attempts per account (default 3)
- pin-lock-duration: PIN lock duration in seconds (default 300)
- max-ip-login-attempts: Login attempts per IP (default 10)
- ip-lock-duration: IP block duration for login in seconds (default 600)
- max-ip-pin-attempts: PIN attempts per IP (default 6)
- ip-pin-lock-duration: IP block duration for PIN in seconds (default 600)
- ip-block-kick-enabled: Kick player when IP is blocked (default true)
- session-timeout: Session timeout in seconds (default 1800)
- session-enabled: Remember login (default false)
- auth-timeout-enabled: Enable timeouts (default true)
- register-timeout: Seconds to register (default 60)
- login-timeout: Seconds to login (default 60)
- pin-timeout: Seconds to enter PIN (default 30)
Discord Settings
- enabled: true or false
- webhook-url: Discord webhook URL
- embed-color-red: Red value 0-255
- embed-color-green: Green value 0-255
- embed-color-blue: Blue value 0-255
Email Settings
- enabled: true or false
- smtp-host: SMTP server host
- smtp-port: SMTP server port
- smtp-username: SMTP username
- smtp-password: SMTP password
- smtp-ssl: Enable SSL (true or false)
- from-address: Email sender address
IP BLOCK BEHAVIOR
When ip-block-kick-enabled is true (default):
- Player is kicked when IP block limit is reached
- Player cannot reconnect until block expires
- Shows block message with remaining time
When ip-block-kick-enabled is false:
- Player is NOT kicked
- Player stays connected but cannot use login/PIN commands
- Shows warning message in chat
- Commands are blocked for that IP until timeout expires
SECURITY FEATURES
Multi-Layer Protection
- Password Encryption: Industry-standard algorithms (ARGON2 recommended)
- Salted Hashes: All passwords and PINs use unique random salts
- Timing Attack Prevention: Constant-time comparison for all sensitive operations
- Rate Limiting: Prevents brute force attacks at account and IP level
- Session Management: Secure session tokens with IP validation
- Temporary IP Blocking: Blocked IPs cannot authenticate until block expires
- Authentication Timeouts: Auto-kick if not authenticated in time
Rate Limiting Details
- Per-Account Login: 5 attempts, 5 min lock, results in account lock
- Per-Account PIN: 3 attempts, 5 min lock, results in PIN lock
- Per-IP Login: 10 attempts, 10 min block, results in IP block
- Per-IP PIN: 6 attempts, 10 min block, results in IP block
AUTHENTICATION FLOW
1. Player tries to connect
2. Check if IP is blocked - if yes and kick enabled, connection refused
3. If IP blocked but kick disabled, allow connection but block commands
4. Player joins the server
5. Check for valid session (if session-enabled is true)
6. If session valid and player has PIN, verify PIN then authenticated
7. If session valid and no PIN, authenticated
8. If no session, check if registered
9. If registered, require login then check for PIN
10. If not registered, require registration
11. After login/register, if has PIN, verify PIN
12. Once all steps complete, player is authenticated
INSTALLATION
1. Download ShieldAuth-1.0.0.jar
2. Place it in your server plugins folder
3. Start or restart the server
4. Configure plugins/ShieldAuth/config.yml as needed
5. Use /shieldauth reload to apply changes
CONFIGURABLE MESSAGES
The plugin includes 65+ configurable messages including:
- Registration messages (success, already registered, password mismatch, etc.)
- Login messages (success, wrong password, locked, etc.)
- PIN messages (set, removed, wrong, locked, etc.)
- Email messages (set, verified, invalid, etc.)
- Admin messages (all admin command responses)
- IP block messages (connection refused, commands blocked)
- Timeout messages (kick for taking too long)
- Session messages (session restored)
- Update available message
- Title messages (register, login, PIN, success)
- GUI messages (PIN interface)
All messages support color codes and placeholders like {time}, {player}, {attempts}, {current}, {latest}, {url}, etc.
LICENSE
All Rights Reserved 2026
ShieldAuth - Secure your Minecraft server with confidence
Compatible with Spigot, Paper and forks from version 1.16.5 to 1.21
Java 21 required
FEATURES
Authentication
- Password-based authentication with /register and /login
- Configurable password requirements (min/max: 6-32 by default)
- Multiple encryption algorithms: ARGON2 (recommended), BCRYPT, SHA256, SHA512
- Configurable session system (remember login) - Disabled by default
PIN System
- GUI-based PIN entry with clickable number heads
- Configurable PIN length (default: 4 digits)
- Extra security layer after password authentication
- Brute force protection with rate limiting
Rate Limiting and Temporary IP Blocking
- Per-account login attempt limiting
- Per-account PIN attempt limiting
- Per-IP login attempt limiting (protects against distributed attacks)
- Per-IP PIN attempt limiting
- Temporary IP blocking when limits are exceeded
- Configurable block durations
- Automatic unlock after timeout
- Configurable kick on block (enabled by default)
Authentication Timeouts
- Auto-kick if player doesnt register in time
- Auto-kick if player doesnt login in time
- Auto-kick if player doesnt enter PIN in time
- Fully configurable times
- Customizable kick messages
Update Checker
- Automatically checks for new versions on GitHub
- Displays console message if update is available
- Configurable (enable/disable)
Database
- SQLite (local) - Zero configuration required
- MySQL (cloud) - For networks and multiple servers
- HikariCP connection pooling for optimal performance
Notifications
- Discord Webhooks - Get notified of logins/registrations
- Customizable embed colors (RGB)
- IP spoiler protection in Discord
Email Verification
- SMTP email support (Gmail, custom SMTP)
- Verification codes
- Recovery options
Customization
- ALL messages configurable in config.yml
- Title messages with fade effects
- Custom command aliases
- Fully configurable permissions
USER COMMANDS
/register (aliases: /reg, /r, /signup, /crear, /registrar)
- Description: Register new account
- Usage: /register password confirmpassword
- Permission: None
/login (aliases: /l, /log, /signin, /entrar, /iniciar)
- Description: Login to account
- Usage: /login password
- Permission: None
/changepassword (aliases: /changepass, /cp, /cambiarpass, /newpass, /chpass)
- Description: Change password
- Usage: /changepassword currentpassword newpassword
- Permission: shieldauth.changepassword
/unregister (aliases: /unreg, /deleteaccount, /borrar)
- Description: Delete your account
- Usage: /unregister password
- Permission: shieldauth.unregister
/setpin (aliases: /pin, /addpin, /createpin)
- Description: Set security PIN
- Usage: /setpin pin
- Permission: shieldauth.pin
/removepin (aliases: /delpin, /deletepin, /rmpin)
- Description: Remove your PIN
- Usage: /removepin pin
- Permission: shieldauth.pin
/unsetpin (aliases: /nopin, /clearpin)
- Description: Remove your PIN (alias)
- Usage: /unsetpin pin
- Permission: shieldauth.pin
/setemail (aliases: /email, /mail, /addemail)
- Description: Set recovery email
- Usage: /setemail email
- Permission: shieldauth.email
/verifyemail (aliases: /verify, /confirmemail, /vmail)
- Description: Verify your email
- Usage: /verifyemail code
- Permission: None
ADMIN COMMANDS
/shieldauth reload
- Description: Reload configuration
- Permission: shieldauth.admin
/shieldauth addadmin player
- Description: Add player to admin list
- Permission: shieldauth.admin
/shieldauth removeadmin player
- Description: Remove player from admin list
- Permission: shieldauth.admin
/shieldauth list
- Description: List all admins
- Permission: shieldauth.admin
/shieldauth info player
- Description: View player authentication info
- Permission: shieldauth.admin
/shieldauth forcelogin player
- Description: Force login a player
- Permission: shieldauth.forcelogin
/shieldauth forceunregister player
- Description: Force unregister a player
- Permission: shieldauth.forceunregister
/shieldauth forcesetpin player pin
- Description: Force set PIN for a player
- Permission: shieldauth.forcesetpin
/shieldauth forceremovepin player
- Description: Force remove PIN from a player
- Permission: shieldauth.forceremovepin
/shieldauth help
- Description: Show help menu
- Permission: shieldauth.admin
Admin command aliases: /sa, /sh, /auth, /shield
PERMISSIONS
shieldauth.admin
- Description: Access to all admin commands
- Default: OP
shieldauth.forcelogin
- Description: Force login players
- Default: OP
shieldauth.forceunregister
- Description: Force unregister players
- Default: OP
shieldauth.forcesetpin
- Description: Force set PIN on players
- Default: OP
shieldauth.forceremovepin
- Description: Force remove PIN from players
- Default: OP
shieldauth.changepassword
- Description: Change own password
- Default: true
shieldauth.unregister
- Description: Unregister own account
- Default: true
shieldauth.pin
- Description: Set/remove own PIN
- Default: true
shieldauth.email
- Description: Set own email
- Default: true
CONFIGURATION OPTIONS
Database Settings
- type: sqlite or mysql
- host: Database host (for MySQL)
- port: Database port (default 3306)
- database: Database name
- username: Database username
- password: Database password
- pool-size: Connection pool size (default 10)
Update Checker Settings
- enabled: true or false
- github-url: URL to your GitHub repository
- github-api-url: GitHub API URL for releases
Security Settings
- encryption: ARGON2, BCRYPT, SHA256 or SHA512
- password-min-length: Minimum password length (default 6)
- password-max-length: Maximum password length (default 32)
- pin-length: PIN length (default 4)
- max-login-attempts: Login attempts per account (default 5)
- lock-duration: Account lock duration in seconds (default 300)
- max-pin-attempts: PIN attempts per account (default 3)
- pin-lock-duration: PIN lock duration in seconds (default 300)
- max-ip-login-attempts: Login attempts per IP (default 10)
- ip-lock-duration: IP block duration for login in seconds (default 600)
- max-ip-pin-attempts: PIN attempts per IP (default 6)
- ip-pin-lock-duration: IP block duration for PIN in seconds (default 600)
- ip-block-kick-enabled: Kick player when IP is blocked (default true)
- session-timeout: Session timeout in seconds (default 1800)
- session-enabled: Remember login (default false)
- auth-timeout-enabled: Enable timeouts (default true)
- register-timeout: Seconds to register (default 60)
- login-timeout: Seconds to login (default 60)
- pin-timeout: Seconds to enter PIN (default 30)
Discord Settings
- enabled: true or false
- webhook-url: Discord webhook URL
- embed-color-red: Red value 0-255
- embed-color-green: Green value 0-255
- embed-color-blue: Blue value 0-255
Email Settings
- enabled: true or false
- smtp-host: SMTP server host
- smtp-port: SMTP server port
- smtp-username: SMTP username
- smtp-password: SMTP password
- smtp-ssl: Enable SSL (true or false)
- from-address: Email sender address
IP BLOCK BEHAVIOR
When ip-block-kick-enabled is true (default):
- Player is kicked when IP block limit is reached
- Player cannot reconnect until block expires
- Shows block message with remaining time
When ip-block-kick-enabled is false:
- Player is NOT kicked
- Player stays connected but cannot use login/PIN commands
- Shows warning message in chat
- Commands are blocked for that IP until timeout expires
SECURITY FEATURES
Multi-Layer Protection
- Password Encryption: Industry-standard algorithms (ARGON2 recommended)
- Salted Hashes: All passwords and PINs use unique random salts
- Timing Attack Prevention: Constant-time comparison for all sensitive operations
- Rate Limiting: Prevents brute force attacks at account and IP level
- Session Management: Secure session tokens with IP validation
- Temporary IP Blocking: Blocked IPs cannot authenticate until block expires
- Authentication Timeouts: Auto-kick if not authenticated in time
Rate Limiting Details
- Per-Account Login: 5 attempts, 5 min lock, results in account lock
- Per-Account PIN: 3 attempts, 5 min lock, results in PIN lock
- Per-IP Login: 10 attempts, 10 min block, results in IP block
- Per-IP PIN: 6 attempts, 10 min block, results in IP block
AUTHENTICATION FLOW
1. Player tries to connect
2. Check if IP is blocked - if yes and kick enabled, connection refused
3. If IP blocked but kick disabled, allow connection but block commands
4. Player joins the server
5. Check for valid session (if session-enabled is true)
6. If session valid and player has PIN, verify PIN then authenticated
7. If session valid and no PIN, authenticated
8. If no session, check if registered
9. If registered, require login then check for PIN
10. If not registered, require registration
11. After login/register, if has PIN, verify PIN
12. Once all steps complete, player is authenticated
INSTALLATION
1. Download ShieldAuth-1.0.0.jar
2. Place it in your server plugins folder
3. Start or restart the server
4. Configure plugins/ShieldAuth/config.yml as needed
5. Use /shieldauth reload to apply changes
CONFIGURABLE MESSAGES
The plugin includes 65+ configurable messages including:
- Registration messages (success, already registered, password mismatch, etc.)
- Login messages (success, wrong password, locked, etc.)
- PIN messages (set, removed, wrong, locked, etc.)
- Email messages (set, verified, invalid, etc.)
- Admin messages (all admin command responses)
- IP block messages (connection refused, commands blocked)
- Timeout messages (kick for taking too long)
- Session messages (session restored)
- Update available message
- Title messages (register, login, PIN, success)
- GUI messages (PIN interface)
All messages support color codes and placeholders like {time}, {player}, {attempts}, {current}, {latest}, {url}, etc.
LICENSE
All Rights Reserved 2026
ShieldAuth - Secure your Minecraft server with confidence
Quick facts
- Edition: Minecraft Java
- File type: .jar
- Minecraft versions listed: 1.16, 1.17, 1.18
- How to install: Install the matching mod loader (Forge, Fabric or NeoForge) for your Minecraft version. → Download the .jar. → Put it in the .minecraft/mods folder and launch that loader profile.
- Where to get it: Opens on Spigot — not every file is mirrored on our own servers.
Install steps are the general flow for this file type — How to install Minecraft Java mods & modpacks walks through it step by step.
ShieldAuth is a free Minecraft Java mod. Compatible with Minecraft 1.16, 1.17, 1.18, 1.19 and newer. Downloaded 80 times (via Spigot). Download it and open it directly in the game.