How to Make an Enshrouded Dedicated Server Private

Set a password in the userGroups section of enshrouded_server.json, then restart the dedicated server. The older top-level password entry shown in many guides is outdated. A password limits who can join; it does not make the server invisible to anyone who knows its IP address.

Prefer not to run the server on your own PC? Godlike.Host offers hosted Enshrouded servers with free DDoS protection and up to three free backups a day.

What “private” means in Enshrouded

For an Enshrouded dedicated server, privacy is an access-control setting rather than a single “private server” switch. You make the server private by assigning a password to one or more entries in the userGroups array in enshrouded_server.json. Players must then use the appropriate password to connect.

#	Preview	Product	Price
1		Games Workshop - Warhammer 40,000 - Craftworlds Spiritseer	$29.75	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

This protects the game world from uninvited joins, but it does not provide anonymity. A server can still appear in discovery results, and anyone who obtains its address can attempt a direct connection. The password is the boundary that matters.

Current official guidance uses passwords inside userGroups. Older hosting tutorials often show a single top-level line such as "password": "..."; do not add or edit that legacy line unless the documentation for your exact server build explicitly requires it.

#1 Best Overall

Games Workshop - Warhammer 40,000 - Craftworlds Spiritseer

• Games Workshop - Warhammer 40,000 - Craftworlds Spiritseer
• Plastic multipart miniatures - assembly required - tools, paints and glue not included
• Games Workshop

$29.75

Buy on Amazon

Before changing the configuration

Confirm that you are running a dedicated server

The procedure below applies to the dedicated-server configuration file, enshrouded_server.json. It is different from hosting a multiplayer session directly from the game client. Peer-to-peer hosting may use enshrouded_user.json, and the available privacy controls are not established as the same as those for a dedicated server.

Stop the server first

Shut the server down cleanly before opening the file. Hosting software can keep an exclusive lock on the configuration while the process is running, and a live process may overwrite your edits when it saves its settings.

Make a backup

Copy enshrouded_server.json to a safe location before editing. Keep the original until you have connected successfully with the new password. A backup gives you a quick recovery path if the JSON becomes invalid or another setting is changed accidentally.

Find the file used by the active instance

Use the path configured for the server instance, not a similarly named sample file in an installation directory. On a rented server, the provider’s file manager or configuration editor normally opens the correct file for that instance.

Self-hosted method: set a password in enshrouded_server.json

1. Stop the server. Wait until the control panel, service manager, or console reports that the process has exited.
2. Open enshrouded_server.json in a plain-text editor. Avoid word processors that can add formatting characters.
3. Locate userGroups. The array contains the groups defined for the server, commonly including names such as Admin, Friend, and Guest.
4. Set the password for the group you intend to use. Replace that group’s empty value with a strong password. If you maintain separate access levels, each group can have its own password.
5. Leave the group’s other settings intact. Group entries also carry permission controls, including kick/ban authority, base-editing rights, and a reservedSlots value. Change only what you understand.
6. Save as valid JSON. Keep quotation marks, commas, braces, and brackets exactly where the existing structure requires them. A missing quote or comma can prevent the server from starting.
7. Start or restart the server. Do not test while the old process is still running; the previous configuration may still be in memory.
8. Test with a player account that does not have an existing session. Enter the password when prompted and verify that a wrong password is rejected.

Illustrative group structure

The exact file contains additional fields and may differ between builds. Use the keys already present in your file; do not replace the entire configuration with a copied example.

{
  "userGroups": [
    {
      "name": "Admin",
      "password": "replace-with-a-unique-admin-password",
      "reservedSlots": 0
    },
    {
      "name": "Friend",
      "password": "replace-with-a-unique-friend-password",
      "reservedSlots": 0
    },
    {
      "name": "Guest",
      "password": "replace-with-a-unique-guest-password",
      "reservedSlots": 0
    }
  ]
}

This example is intended to show where the password belongs, not to prescribe a complete configuration. Your existing entries may include additional permission properties. Preserve them, and make sure every string remains inside quotation marks.

How user groups affect access

A password is attached to a group, not to an abstract server-wide privacy mode. That lets you separate trusted administrators from ordinary friends or guests.

According to the official explanation, all user groups still have access to the game world once authenticated. Group permissions refine what members can do; they are not separate worlds and do not create a second privacy mechanism.

Using a rented hosting panel

Panel providers commonly expose a password field or a JSON configuration editor. The panel writes the corresponding userGroups value for you, which avoids hand-editing punctuation.

1. Stop the instance from the provider’s control panel.
2. Open the Enshrouded configuration page or file editor.
3. Enter the password in the user-group field supplied by the panel. If the panel exposes raw JSON instead, edit the relevant userGroups entry.
4. Save the configuration and start the server.
5. Allow several minutes for the new setting to propagate before testing, especially when the provider separates the panel from the game process.

Panel labels vary. If a form offers only one “server password” box, check that the provider’s current documentation says it writes a user-group password rather than an obsolete top-level property. If the panel does not document the group fields, use its raw configuration editor and compare the generated file with a backup.

Self-hosting versus a panel host

Neither route changes what a password can do. The difference is operational: self-hosting gives you direct control, while a panel reduces file-editing work and usually makes restarts easier.

Verify that the server is actually private

1. Test a valid credential. Connect with the password for the intended group and confirm normal access.
2. Test an invalid credential. Use a deliberately wrong password from a separate client. The connection should fail rather than enter the world.
3. Check the permissions. A regular-player account should not gain kick/ban or base-editing powers unless you assigned those flags to its group.
4. Test after a full restart. A successful connection before restarting can reflect the old in-memory configuration.
5. Tell players which credential to use. If you created multiple groups, provide only the password appropriate to each person.

What a password does not hide

The server may still be discoverable

There is no confirmed official “hide from browser” flag in the dedicated-server settings. Several third-party guides describe privacy as password protection rather than a separate public/private toggle.

The public server browser is reported to hide dedicated servers by default through a client-side filter. Each player may need to enable the dedicated-server option in the browser’s filters before the server appears. This behavior has been reported in community discussions and hosting documentation, not verified in an official Keen Games statement, so menu wording can change.

Anyone with the IP can try a direct connection

Players who know the server’s address can add it directly in Steam; one hosting guide reports that this places it near the top of the browser list. Direct visibility does not bypass the password. It simply gives someone a route to the login prompt.

Do not treat an obscured listing as security

Filtering, an unadvertised address, or a private Steam profile can reduce casual discovery, but none replaces a password. Share the address only with people who need it, and rotate the relevant group password if it has been posted publicly.

Removing or changing the password

From a hosting panel

1. Stop the server.
2. Clear the password field for the relevant group.
3. Save the configuration.
4. Restart the server and test from a client that is not reusing a previous session.

By editing the file

Stop the process, open enshrouded_server.json, and empty the password value for the group you want to make open. Save valid JSON, then restart. If multiple groups have passwords, clear each one whose access you want to remove; changing one group does not automatically change the others.

To change a password rather than remove it, replace the existing value, save, restart, and distribute the new credential. Players using the old value should no longer be able to authenticate after the restart.

Troubleshooting

The server will not start after editing

• Restore the backup to confirm that the failure is configuration-related.
• Check every quote, comma, brace, and bracket around userGroups.
• Make sure the file remains plain JSON and was not saved with rich-text formatting.
• Confirm that you edited the active instance’s file rather than a sample or inactive copy.
• Do not add a second top-level password line to compensate for an error; current guidance places the value inside the group entries.

The password appears to be ignored

• Stop the server again and verify that the password is in the intended userGroups object.
• Confirm that the restart completed and that the panel did not overwrite the file from a saved template.
• Wait a few minutes on a rented panel before testing.
• Try from a fresh client session so cached connection state is not mistaken for password validation.

Friends cannot find the server

• Have them enable the dedicated-server option in the server-browser filters.
• Give them the correct address and port for your instance.
• Explain which group password they should use.
• If discovery remains unreliable, have them add the server directly in Steam and authenticate with the password.

A player can join but has too much control

Check the permissions on the group whose password was shared. Kick/ban and base-editing rights are group properties. Move ordinary players to a lower-privilege group, assign that group its own password, and restart after saving.

Dedicated server versus an in-game host

The documented password procedure applies to a dedicated server. A peer-to-peer session started from the game client may use enshrouded_user.json and does not have a confirmed equivalent privacy switch in the available guidance.

One community guide suggests that a private Steam profile can prevent a peer-to-peer session from appearing in the browser, with invitations sent through the Steam friends list. That workaround is not confirmed as an official Enshrouded setting and may change with Steam or game updates. If you need predictable password-based access, use the dedicated-server configuration described above.

Security checklist

• Stop the server before every configuration edit.
• Back up enshrouded_server.json before changing it.
• Use a unique password for each group; do not reuse a personal or email password.
• Give the Admin credential only to people who need moderation powers.
• Keep regular players in a group without unnecessary kick/ban or base-editing rights.
• Do not rely on browser filters or an undisclosed IP as the security boundary.
• Rotate a password immediately if it is posted in a public chat or shared with someone who should no longer have access.
• After every change, test both a valid and an invalid password after a complete restart.

Version and documentation caveat

The available setup guides and explanations are primarily from 2024 and 2025. No separate 2026 change to the password model is established here. If your current build uses different keys, rejects the documented structure, or presents a new server-visibility control, check the current Keen Games support documentation for that build before modifying the file.

The short answer

Stop the dedicated server, put the password in the appropriate userGroups entry in enshrouded_server.json, preserve valid JSON, restart, and test. Ignore older instructions that place the password at the top level. The result is password-protected access—not a server that is invisible or unreachable by IP.

Quick Recap

Bestseller No. 1

Games Workshop - Warhammer 40,000 - Craftworlds Spiritseer

Games Workshop - Warhammer 40,000 - Craftworlds Spiritseer; Plastic multipart miniatures - assembly required - tools, paints and glue not included

$29.75

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.