CraftersLogin

Unauthenticated players are fully isolated: they cannot move, chat, use items, drop items, take damage, interact with entities, or see other players until they successfully log in.

Smart Sessions: When a player reconnects from the same IP within the session window, CraftersLogin auto-authenticates them — no password required. This dramatically improves the experience for regular players without reducing security.

Brute-Force Protection: After 3 failed attempts, staff are notified. After 5 failures, a temporary IP ban is applied. After 10 consecutive failures, a permanent ban can be triggered automatically.

What it does: Defines where player accounts, hashed passwords, IPs, and session data are persisted.

H2 — embedded Java database. Zero setup, perfect for testing and small servers. Data is stored as a local file (CraftersLogin/database.mv.db).

SQLITE — lightweight file-based SQL. Also zero setup, but slightly slower than H2 for large datasets.

MYSQL / MARIADB — recommended for production servers with 50+ concurrent players or multiple servers sharing the same account pool.

What it does: Controls what unauthenticated players can and cannot do before logging in.

block-chat — Highly recommended. Prevents players from sending chat messages before login, stopping spam bots and griefers from polluting chat.

block-movement — Freezes the player at their join position. Prevents exploration of the server while unauthenticated. They will be teleported to the auth spawn if configured.

allowed-commands — Whitelist of the only commands players can run before authenticating. Always keep /login, /register, and their aliases here.

CHAT — Classic mode. Players type /login <password> in chat. Works on all clients without any extra plugins.

SIGN — When the player runs /login or /register, a native Minecraft Sign editor opens automatically. The player types their full alphanumeric password using the keyboard and clicks Done. The sign is sent via ProtocolLib packets — it is never actually placed in the world — and the block is restored instantly. This completely defeats chat-logger mods that intercept keystrokes. Requires ProtocolLib.

Anti-Alts — Limits the number of accounts that can be registered from the same IP address. Prevents account farming and ban evasion. Add shared network IPs (cybercafés, school networks) to whitelisted-ips so those players aren't blocked.

Password Complexity — Forces players to meet minimum requirements. prevent-username-as-password blocks the single most common weak password pattern.

HIBP — Checks each new password against millions of known leaked passwords. Only a 5-character SHA-1 prefix is sent (k-Anonymity). The full password never leaves the server.

Brute Force — At 3 fails: staff get a warning notification. At 5 fails: temporary IP ban for minutes-ban-after-5-fails minutes. At 10 fails: permanent ban if perm-ban-after-10-fails is true.

Captcha — If require-for-all-unauthenticated is false, captcha only appears for IPs that are new or have recent failed attempts (adaptive). If true, all players solve a captcha on every join.

What it does: Adds extra verification layers specifically for staff members (players with the crafterslogin.staff.security permission).

force-secret-answer — Staff must run /setsecurityanswer <phrase> before they can fully authenticate. If not set, they are blocked at login until configured.

check-ip-change — If a staff member connects from a different IP than their last known IP, they must answer their secret phrase before gaining staff permissions. Protects against account hijacking.

afk-timeout — Staff sessions expire after the configured minutes of inactivity, requiring a fresh login. Prevents a hijacked staff member's session from staying active indefinitely.

GeoIP — Uses an external HTTP API to look up the country of the connecting IP. Set allowed-countries to restrict logins to specific countries (ISO codes). strict-ip-lock: true goes further — the exact IP must match, not just the country.

What it does: Lets players request a one-time code sent to their registered email address when they forget their password. Each server admin configures their own SMTP credentials — emails are sent from the server's own address, not a shared Crafters Development account.

Startup validation: CraftersLogin tests the SMTP connection asynchronously when the server starts. If the credentials are wrong, a clear SEVERE error is printed immediately — you won't discover the misconfiguration when your first player tries to recover their password.

force-auth-spawn — When enabled, unauthenticated players are immediately teleported to the designated login spawn on join. This prevents them from appearing in the middle of your main world.

hide-players-while-unauthenticated — Makes unauthenticated players completely invisible to all other online players. This prevents authenticated players from interacting with or seeing unverified accounts.

isolate-inventories-until-login — Clears and securely stores the player's inventory while they are in the auth phase. The inventory is fully restored immediately after login. This prevents item duplication exploits and inventory snooping.

What it does: Stores authentication state so players don't have to re-enter their password when switching between sub-servers in a BungeeCord or Velocity network.

MEMORY mode — Sessions live in the JVM heap of the current server. Works perfectly for single-proxy setups. Sessions are cleared on restart.

REDIS mode — Sessions are stored in Redis (an external in-memory data store). Works across multiple proxies and proxy restarts. Required for high-availability or multi-proxy setups.

fallback-timeout-minutes — How long (in minutes) a session stays valid. In REDIS mode this becomes the key TTL. In MEMORY mode an internal scheduler handles expiry. 60 minutes is a good balance between security and convenience for most servers.