LegendLogin

# LegendLogin

## Secure, Lightweight and Powerful Authentication Plugin for Paper Servers

**LegendLogin** is a secure and easy-to-use authentication plugin designed for Paper servers running in Cracked/Offline mode. It provides a clean login experience, strong password protection, account management tools, and essential security features to protect your players from unauthorized access.

Built with compatibility and performance in mind, LegendLogin uses **BCrypt password hashing**, an embedded **SQLite database**, asynchronous database operations, and a simple configuration system that makes setup fast for both small servers and large communities.

## Features

### Secure Authentication

LegendLogin protects player accounts using BCrypt hashing instead of storing passwords in plain text. Players can register, log in, and change their passwords through simple commands.

### Pre-Login Protection

Unauthenticated players are prevented from moving, chatting, taking damage, and using unauthorized commands until they successfully log in. This helps protect accounts from abuse immediately after joining the server.

### Brute-Force Protection

The plugin includes a configurable limit for failed login attempts. When the limit is reached, the player is automatically kicked to reduce password-guessing attacks.

### Administrator Tools

Server staff receive dedicated commands for managing accounts and player sessions. Administrators can reset passwords, force a login, delete accounts, inspect authentication status, log players out, and reload the configuration without restarting the server.

### Lightweight Storage

Account data is stored in a local SQLite database inside the plugin folder. No external database setup is required, making LegendLogin simple to install and maintain.

### Fully Configurable

Messages, password requirements, BCrypt cost, maximum login attempts, and other settings can be customized through `config.yml`.

### Modern Compatibility

LegendLogin is built on the Paper API without NMS dependencies and is designed for Paper servers from **Minecraft 1.20.1 and newer versions**. The current release was tested successfully on Paper 1.20.1 and Paper 26.2.

## Commands

| Command | Description |
|---|---|
| `/register <password> <confirm>` | Register a new account. |
| `/login <password>` | Log in to an existing account. |
| `/changepassword <old> <new>` | Change your current password. |
| `/resetpassword <player> <newPassword>` | Reset a player's password. |
| `/forcelogin <player>` | Force-authenticate a player for the current session. |
| `/unregister <player>` | Delete a player's account. |
| `/authinfo <player>` | Display the player's authentication status and failed attempts. |
| `/logout <player>` | End a player's current session. |
| `/legendlogin reload` | Reload the plugin configuration. |

## Command Aliases

The following aliases are available:

`/reg` for `/register`, `/l` and `/log` for `/login`, `/cp` and `/changepass` for `/changepassword`, and `/ll` for `/legendlogin`.

## Permissions

| Permission | Default | Description |
|---|---:|---|
| `legendlogin.admin` | Operator | Use `/legendlogin reload`. |
| `legendlogin.resetpassword` | Operator | Use `/resetpassword`. |
| `legendlogin.forcelogin` | Operator | Use `/forcelogin`. |
| `legendlogin.unregister` | Operator | Use `/unregister`. |
| `legendlogin.authinfo` | Operator | Use `/authinfo`. |
| `legendlogin.logout` | Operator | Use `/logout`. |
| `legendlogin.bypass` | Operator | Bypass authentication restrictions. |

## Installation

1. Download the latest `LegendLogin.jar` file.
2. Place it inside your server's `plugins` folder.
3. Start or restart your Paper server.
4. Edit `plugins/LegendLogin/config.yml` if you want to customize the settings.
5. Players can use `/register` on their first join and `/login` on future joins.

## Recommended Server Setup

For Cracked/Offline servers, set `online-mode=false` in `server.properties` and always use a properly secured Proxy configuration if your server is connected to BungeeCord or Velocity. Never rely on player names alone to identify Premium accounts when online-mode is disabled.

## Password Requirements

Passwords must contain between **6 and 64 non-space characters**. BCrypt is used to hash passwords, and the default BCrypt cost is 12. Administrators should encourage players to use unique passwords that they do not share with other servers.

## Why LegendLogin?

LegendLogin focuses on the features most servers need: reliable authentication, strong password security, useful administrator commands, low setup requirements, and a clean player experience. It is an excellent foundation for Cracked/Offline Paper servers that need a practical alternative to heavier authentication solutions.

## Support and Suggestions

If you find a bug or have a feature suggestion, please include your server software, Minecraft version, Java version, LegendLogin version, and the relevant console error when reporting the issue.