Free tools Windows power users keep installed
One-click scans. No signup required.
To disable online mode, stop the server, open server.properties, change online-mode=true to online-mode=false, save the file, and restart the server. This makes the server accept the username presented by each client instead of asking Mojang’s account service to verify it. Before allowing anyone outside a trusted group to connect, install an authentication plugin and understand the identity, security, and UUID consequences.
Godlike.Host offers hosted Minecraft Java servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
What “online mode” changes
Minecraft servers use the online-mode setting to decide whether connecting players must pass account verification. The default value, true, requires the server to ask Mojang’s account service to verify each player. A player normally joins with the identity associated with an authenticated account.
As an Amazon Associate I earn from qualifying purchases.
With online-mode=false, the server does not perform that account check. It accepts the username supplied by the client. This is also called offline mode or, in many guides, cracked mode. The setting does not make the server anonymous or secure; it removes the built-in proof that a username belongs to the person using it.
- Online mode: Mojang account verification is required before login.
- Offline mode: the presented username is accepted without Mojang verification.
- Authentication plugin: an additional password or login layer that can protect names after online mode is disabled; it does not restore Mojang verification.
Offline mode is most defensible for a small, private group that can use a separate authentication system. For a public server or a server open to unknown players, keeping online-mode=true is the safer choice.
#1 Best Overall
Decide whether disabling it is appropriate
| Situation | Recommended setting | Reason |
|---|---|---|
| Private server for a few trusted friends | online-mode=false only with an authentication plugin |
The group may accept the extra login step, but every username still needs protection. |
| Public server or open community | online-mode=true |
Unknown players can otherwise claim another player’s name. |
| Proxy network using BungeeCord or Velocity | Proxy true; backend servers false |
The proxy performs account verification while private backends accept connections from the proxy. |
| A legitimate player sees “Failed to verify username” | Investigate the client, account, or proxy first | Turning off verification changes the security model and may not address the underlying problem. |
Do not disable online mode merely to bypass a temporary verification failure. First check whether the affected account can sign in normally and whether a proxy or network configuration is interfering with the authentication request.
Before you edit the server
Make a recoverable backup
Stop the server cleanly and make a copy of the entire server directory, including the world folders, server.properties, permissions files, and plugin data. Keep the backup outside the live directory and label it with the date and the original online-mode value. A backup gives you a way to restore the previous identity mapping if player inventories or claim permissions change after the switch.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Confirm who will be allowed to connect
Write down the usernames and administrative roles that should exist after the change. Do not assume that an existing whitelist will protect them: in offline mode, a whitelist still matches usernames, and a person can attempt to connect while presenting a permitted name.
Plan authentication before opening the port
Install and configure an authentication plugin while the server is private or stopped. Commonly named options include LoginSecurity, LibreLogin, LockLogin, and AuthMeReloaded for Paper servers. These plugins can add a password gate, registration flow, or login requirement. They do not verify that the player owns the Mojang account associated with the name, so treat their passwords and administrative controls as a separate security boundary.
How to turn off online mode
- Stop the server. Use the host’s stop control or the server console’s normal shutdown procedure. Do not edit a live file while the server is rewriting it.
- Open the server root. Find
server.propertiesin the same server directory that contains the world data and server files. If your host provides a file manager, open that file there; otherwise edit it locally and upload the saved copy. - Change the authentication setting. Find
online-mode=trueand replace only the value withfalse, so the line readsonline-mode=false. Keep the spelling, hyphen, and lower-case value exactly as shown. - Save the file as plain text. Make sure the editor did not add a second extension such as
.txtor change the key name. - Review secure-profile behavior. Some guides advise setting
enforce-secure-profile=falseas well because it is checked separately fromonline-mode. This interaction is version-dependent and has not been verified for every current server release. If the server starts but rejects non-premium players at login, check this setting for your server version and test it privately rather than assuming it must always be changed. - Install or enable the authentication plugin. Follow that plugin’s own configuration for registration, password protection, and operator safeguards. Do not expose the server publicly before the login gate is working.
- Start the server. Wait for a normal startup, then connect with a test account. Confirm that the plugin asks for authentication before granting access to the world.
- Test an administrator account separately. Verify that the intended operator can log in, retain the correct permissions, and use the server without relying on an unprotected username.
If the server fails to start after the edit, stop it again, restore the backup, and compare the changed lines for spelling or formatting errors. A single malformed property can prevent the server from reading its configuration.
Why offline mode creates an impersonation risk
When online mode is disabled, any player can attempt to join under any name. A malicious visitor can type the username of an administrator or operator and appear to have that identity. If permissions are assigned by name or by the offline identity generated for that name, the intruder may receive administrative powers.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →This is why a whitelist is not a complete defense. A whitelist checks whether the presented username is allowed; it does not prove that the person presenting it owns the corresponding account. An attacker who knows a whitelisted name can still try to use it.
- Use an authentication plugin that requires the player to log in before interacting with the world.
- Use strong, unique passwords and do not share an administrator password in chat.
- Keep operator privileges limited; remove unnecessary operators before testing.
- Restrict who can reach the server and monitor authentication failures.
- Never expose a backend server directly when it is intended to accept traffic only from a proxy.
Authentication plugins reduce the chance of name theft, but they are not equivalent to Mojang verification. A player can still register a name that is not theirs, and plugin data must be protected like any other credential database.
Rank #3
- The classic UNO card game builds fun on game night with a Minecraft theme.
- UNO Minecraft features a deck and storage tin decorated with graphics from the popular video game.
- Players match colors and numbers to the card on top of the discard pile as in the classic game.
- The Creeper card unique to this deck forces other players to draw 3 cards.
- Makes a great gift for kid, teen, adult and family game nights with 2 to 10 players ages 7 years and older, especially Minecraft and video game fans.
Player UUIDs, inventories, and permissions after the switch
Changing an existing world between online and offline modes changes how player identities are represented. In online mode, a player uses a Mojang-assigned UUID. In offline mode, the server generates an offline UUID from the presented username. The same human may therefore appear as a different player after the change.
That identity change can affect anything stored against the old UUID, including:
Recommended Free Tools
- inventories, ender chests, experience, statistics, and advancements;
- claims, region ownership, homes, and other protection data;
- permissions and groups managed by plugins;
- ban, mute, or other moderation records tied to a UUID.
Do not promise players that their existing progress will automatically follow them. Record the original UUIDs and plugin data before switching. If a player appears to have an empty inventory or loses a claim, restore the backup or use the relevant plugin’s documented UUID migration procedure. Avoid editing world or plugin databases blindly; an incorrect UUID change can assign one player’s data to another name.
Proxy networks: the correct arrangement
On a BungeeCord or Velocity network, the usual arrangement is different from a standalone server. Keep online-mode=true on the proxy so it performs account verification. Set the backend Minecraft servers to online-mode=false so they accept the already-authenticated connection forwarded by the proxy.
Rank #4
- Now Minecraft lovers can play a special version of UNO!
- Same as Basic UNO but features Minecraft characters and includes special Creeper rule card. Draw this card and the other players have to draw three more cards from the pile!
- The goal is to get rid of all the cards in your hand.
- First player or team to 500 wins.
- When you're down to one card, don't forget to yell "UNO"!
The backends must not be reachable directly from the public internet. Protect them so players cannot bypass the proxy and connect with an arbitrary name. Common protections include a proxy-authentication guard such as BungeeGuard, correct IP forwarding, and network rules that allow backend connections only from the proxy. Follow the proxy and server software’s matching forwarding mode; an incorrect combination can expose identities or reject legitimate connections.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Test the network from both paths: a normal player connection through the proxy and a direct attempt to the backend. The first should preserve the verified identity; the second should be blocked rather than reaching the backend’s offline-mode login.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common failures
The server still says online mode is enabled
- Stop the server before editing; a running process may overwrite your change.
- Confirm that you edited the active server’s
server.properties, not a backup or a different instance. - Check that the line is exactly
online-mode=falsewith no duplicate key later in the file. - Restart fully and inspect the startup log for the mode that was loaded.
Non-premium players are rejected after the server starts
Check whether your server version separately enforces secure profiles. Some setup guides report that enforce-secure-profile=true can reject players even when online-mode=false. Because the setting’s behavior varies by version, verify the result on a private test instance and use the value appropriate to your release.
A legitimate player receives “Failed to verify username”
Do not immediately switch the whole server to offline mode. Check the player’s client session and account sign-in, then examine the proxy path if one is used. A temporary account-service or network problem can be unrelated to your server’s player policy. If other verified players can join, compare the affected client’s session and launcher state before changing server security.
An administrator lost permissions or items
This is consistent with the UUID change described above. Stop making further changes, preserve the current world as a second backup, and restore or migrate the affected player’s data using the plugin or server tools designed for that data. Do not grant permanent operator status to every similarly named account as a workaround.
Players can bypass the login plugin
- Confirm that the plugin is loaded and reports no startup error.
- Check that protected commands and movement are blocked until authentication.
- Test a fresh username and an existing administrator name from a separate client.
- On a proxy network, ensure the backend cannot be reached directly.
- Review plugin permissions so ordinary players cannot unregister, change another user’s password, or grant themselves privileges.
Switching back to online mode
- Stop the server and make another full backup of the current world and plugin data.
- Open
server.propertiesand changeonline-mode=falsetoonline-mode=true. - Save the file, start the server, and test with a legitimate authenticated account.
- Expect UUID-based data to change again. Inventories, claims, and permissions created while offline may not automatically match the online identities.
- Keep the authentication plugin until you have confirmed that it is no longer needed and that removing it will not delete records required for recovery.
For a proxy network, restore the proxy and backend values as a coordinated change: the proxy should remain online-mode enabled, while backends should retain the mode required by the proxy design. Recheck backend access controls after every change.
Practical security checklist
- A dated backup exists outside the live server directory.
- The server is stopped before
server.propertiesis edited. -
online-mode=falseis present only on the intended server. - An authentication plugin is installed, loaded, and tested before public access.
- Operator accounts use protected passwords and have only necessary privileges.
- The team understands that a whitelist matches names, not account ownership.
- UUID-dependent inventories, claims, and permissions have been documented.
- Proxy backends are shielded from direct connections.
- A rollback plan and a second backup exist before opening the server.
Bottom line for server owners
Disabling online mode is a one-line configuration change, but it is not a harmless compatibility toggle. It removes Mojang account verification, permits username impersonation, and can make existing player data appear under different UUIDs. Use it only for a controlled environment with an authentication plugin, protected administrative accounts, and a tested backup. If the server is public or the problem is merely a failed verification for a legitimate player, leave online mode enabled and fix the client or proxy path instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
