Authisator

Authisator is a server-side mod/plugin that adds premium authentication protection for offline-mode Minecraft servers.

Features

• Allows Mojang-authenticated players to join normally
• Detects offline players using premium usernames and assigns visible aliases like Steve_4821
• Checks offline names for proxy/VPN/Tor/datacenter risk via proxycheck.io
• Requires offline players to register a backup password with /auth register <password>
• Stores the last known IP in world/authisator/players.json
• Automatically logs in returning players from the same IP
• Requires /auth login <password> if the IP changes
• Blocks chat, commands, block interactions, attacks, item drops, and movement until login is complete

Commands

/auth register <backupPassword>
/auth login <backupPassword>
/login <backupPassword>
/register <backupPassword>
/auth changepassword <oldPassword> <newPassword>
/auth status

Security

Passwords are stored securely using PBKDF2-HMAC-SHA256 with a random salt, not in plain text.

Configuration

Creates:

config/authisator.properties

Important defaults:

blockPremiumNamesInOfflineMode=true
trustClientProfileIdForPremiumPass=true
premiumNameMismatchAction=rename_and_allow
failClosedOnMojangError=true
proxyCheckEnabled=true
failClosedOnProxyError=false
proxyRiskThreshold=90
minimumPasswordLength=6
maxPasswordAttempts=5

Note: On a purely offline server, Authisator uses the client-supplied profile UUID as a practical premium signal. Full protection still requires online-mode or a proxy setup that forwards Mojang-authenticated UUIDs.