Fast, lightweight authentication for Minecraft servers.
Protect player accounts with BCrypt, SQLite or MySQL and a secure pre-login state. TrueAuth is available for Bukkit, Paper, Folia, Sponge, Velocity, and Waterfall, with separate artifacts for each platform.
TrueAuth is a small, fast, and easy-to-configure authentication solution for Minecraft networks and standalone servers. Players remain in a protected state until they register or log in, while password handling, database access, timeouts, and platform-specific scheduling are kept safe and efficient.
It works across the most common Minecraft server and proxy platforms without forcing one plugin artifact to do everything:
- Bukkit, Paper, and Folia for standalone servers and Paper-family networks
- Sponge through a dedicated Sponge 8.2.x plugin
- Velocity and Waterfall through dedicated proxy adapters
The project is designed to be lightweight in runtime overhead, quick to start, and straightforward to deploy on both small servers and multi-server networks.
- Protected void limbo with configurable bedrock platform
- Locked movement and interaction before authentication
- Temporary inventory protection and health HUD handling
- Localized titles, ActionBar prompts, and messages
- BCrypt password hashing
- SQLite or MySQL storage on Bukkit/Paper
- SQLite or MySQL storage for proxy authentication
- TLS support for proxy MySQL connections
- Authentication timeouts, rate limits, and protection against concurrent login attempts
- Saved logout locations and configurable login fallbacks
- Optional safe random respawn ring
- Permission-aware administration commands
| Minecraft | Artifact | Java | Build status |
|---|---|---|---|
| 1.20.x | TrueAuth-1.20.x.jar or TrueAuth-Spigot-1.20.x.jar |
17 | Build verified |
| 1.21.x | TrueAuth-1.21.x.jar or TrueAuth-Spigot-1.21.x.jar |
21 | Build verified |
| 26.x | TrueAuth-26.1.x.jar and TrueAuth-26.2.jar |
25 | Build verified |
TrueAuth-1.20.x.jar is compiled against Paper API 1.20.1 and is intended for Paper, Folia, Purpur, Bukkit-compatible Spigot implementations, Patina, and Leaf on Minecraft 1.20.x. Use TrueAuth-Spigot-1.20.x.jar when you specifically want the Spigot API build.
TrueAuth-1.21.x.jar and TrueAuth-Spigot-1.21.x.jar follow the same distinction for Minecraft 1.21.x. Arclight and Mohist are not separately runtime-tested and should be treated as best-effort compatibility.
Folia uses the platform scheduler adapter and folia-supported: true.
Sponge uses a separate plugin and must not load the Bukkit/Paper artifact.
- API: Sponge 8.2.x
- Artifact:
TrueAuth-Sponge-8.x.jar - Includes registration, login, BCrypt/SQLite storage, timeout handling, and pre-authentication restrictions
- Build verified; runtime testing on a Sponge server is still pending
Proxy authentication is provided by separate JARs:
TrueAuth-Velocity.jarfor Velocity 3.4.x and newer compatible Velocity 3.x proxiesTrueAuth-Waterfall.jarfor Waterfall/BungeeCord-compatible proxies using the BungeeCord API
Do not install proxy JARs in a Bukkit/Paper/Sponge server, or Bukkit JARs in a proxy.
The proxy adapters authenticate players before backend forwarding. Use MySQL when multiple proxy instances must share accounts; SQLite is intended for a single proxy instance.
Install only the artifact matching your platform:
| Platform | Artifact |
|---|---|
| Paper, Folia, Purpur, or Bukkit-compatible server on Minecraft 1.20.x | TrueAuth-1.20.x.jar |
| Spigot or a Spigot-compatible server on Minecraft 1.20.x | TrueAuth-Spigot-1.20.x.jar |
| Paper-family or Bukkit-compatible server on Minecraft 1.21.x | TrueAuth-1.21.x.jar |
| Spigot or a Spigot-compatible server on Minecraft 1.21.x | TrueAuth-Spigot-1.21.x.jar |
| Paper-family server on Minecraft 26.1.x or 26.2 | matching TrueAuth-26.*.jar |
| Sponge API 8.2.x | TrueAuth-Sponge-8.x.jar |
| Velocity 3.4.x+ | TrueAuth-Velocity.jar |
| Waterfall or BungeeCord-compatible proxy | TrueAuth-Waterfall.jar |
Do not install proxy adapters on a Bukkit, Paper, or Sponge server. Do not install Bukkit/Paper artifacts on a proxy or Sponge server.
- Download the artifact for your platform and Minecraft version.
- Put the JAR in the server
pluginsdirectory. - Start the server once.
- Edit
plugins/TrueAuth/config.ymlif needed.
For a proxy deployment, install the proxy adapter on the proxy and use MySQL when multiple proxy instances need to share accounts. SQLite is intended for a single proxy instance.
The default limbo world is trueauth_void. Stop the server before removing an old limbo world folder.
/register <password> <repeat password>
/login <password>
/changepassword <old password> <new password>
/trueauth help
/trueauth reload
/trueauth status <player>
/trueauth unregister <player>
/trueauth resetpassword <player> <new password>
/trueauth setregistration
/trueauth setloginfallback
Grant trueauth.admin for full access, or use the individual permissions trueauth.admin.reload, trueauth.admin.account, and trueauth.admin.spawn.
Player-facing text is stored in lang/<locale>.yml. Included locales are English, Russian, German, French, Italian, Spanish, and Brazilian Portuguese.
Post-authentication teleportation and random respawn are disabled by default. Enable spawns.post-auth or spawns.random-respawn when those behaviors are required.
mvn clean package -Pmc-1.20 -DskipTests
mvn clean package -Pmc-1.21 -DskipTests
mvn clean package -Pspigot-1.20 -DskipTests
mvn clean package -Pspigot-1.21 -DskipTests
mvn clean package -Pmc-26-1 -DskipTests
mvn clean package -Pmc-26 -DskipTests
mvn -f sponge/pom.xml clean package -DskipTests
mvn -f proxy-common/pom.xml clean install -DskipTests
mvn -f velocity/pom.xml clean package -DskipTests
mvn -f waterfall/pom.xml clean package -DskipTests
The 26.x profiles remain separate internally because 26.1 and 26.2 use different Paper API builds and produce separate release artifacts.
TrueAuth is distributed under the GNU General Public License v3.0. See LICENSE.
If TrueAuth is useful to your server, you can support development on Ko-fi.
For the detailed matrix and platform notes, see COMPATIBILITY.md.