UserEncrypt Minecraft Plugin
If you’ve ever run an “offline-mode” Minecraft server, you know the biggest headache is security. Because the server skips Mojang’s official authentication servers, anyone can log in with any username they want. If a random player types in the server owner’s username, they instantly get admin privileges and can nuke the server.
I built userencrypt to kill that vulnerability permanently. It’s an open-source plugin that automatically obfuscates and locks down player identities the moment they join.
How it Actually Works
When a player joins your server for the first time, UserEncrypt intercepts their login and permanently assigns them a scrambled, irreversible alias. So if you log in as “batman,” the plugin might rename you “bat7852” under the hood. To the server and all the other players, you are now “bat7852”.
If a malicious player tries to log in later as “batman,” the plugin checks its database, sees that the original “batman” identity has already been claimed and secured, and kicks the impersonator.
The Core Features
- Auto-Encryption:
- No commands required. It automatically scrambles original usernames into un-guessable aliases on first join, locking down that identity forever.
- Readable Storage Mode:
- If you don’t want completely randomized strings running around your server, you can toggle a mode that assigns unique, human-readable aliases stored safely in a local database.
What I Used to Build It
- Language: Kotlin (Because life is too short for raw Java boilerplate)
- Build System: Gradle
- Proxy Support: Velocity (for massive server networks)
- Backend Support: Paper and Spigot
- Hosting: Published straight to Modrinth and GitHub
The Result
UserEncrypt solves the oldest and most dangerous flaw of offline-mode servers. Server owners can finally go to sleep knowing someone isn’t going to log in as “Admin” and wipe their world data.
“Running an offline server always came with the constant worry of someone logging in with my admin username. Since installing UserEncrypt, that fear is gone. My players feel safer knowing their inventories and progress are protected from impersonators, and my staff can manage the server without the risk of their accounts being compromised.”