One Password Auth

One Password Auth

A lightweight server-side mod/plugin that protects your offline (or online) server with a single shared password. Designed for small friend groups and private communities—no per-user accounts, no complex authentication schemes, just one password everyone shares!

✅ Core Features

• Single shared password for entire server access
• Secures all players/inventories before authenticating, even those with OP access
• Disables all known attack vectors (see below) including block-breaking packets from hacked clients
• Players authenticate once with /login <password> then they’re IP whitelisted
• Customizable login title and description
• Discord webhook integration for event logging

🚀 Getting Started

Fabric: drop one-password-auth-fabric-*.jar into mods/. Needs Fabric API.

Paper: drop one-password-auth-paper-*.jar into plugins/. Nothing else needed.

That’s it! Everything should work out of the box! The next time anyone logs in, they will be greeted with a login dialogue.

Note: On first boot a phonetic password (e.g. komipu42!) is generated and written to the config file — check your console or that file, or write the config file yourself beforehand to choose your own.

Where the files live

| | Fabric | Paper |
| — | — | — |
| Config | config/one_password_auth_config.properties | plugins/OnePasswordAuth/one_password_auth_config.properties |
| IP + UUID whitelist | config/one_password_auth_ip_whitelist.txt | plugins/OnePasswordAuth/one_password_auth_ip_whitelist.txt |
| Pending sessions | config/one_password_auth_sessions.json | plugins/OnePasswordAuth/one_password_auth_sessions.json |

⚙️ Customization

Upon first boot the plugin will generate a config file with a default password (such as komipu42!) and all additional customizable settings (see the table above for where it is).

All the lines except for password= are optional! The server will kick everyone if no password is set.

To change any settings, just edit the config file and restart the server.

Settings

| Setting | Default | What it does |
| — | — | — |
| password | generated | The shared password everyone types with /login. The only required line. |
| webhook_url | none | Discord webhook for the player feed: joins, login attempts (including what was typed), successes, timeouts, and advancements earned after logging in. |
| admin_webhook_url | none | Discord webhook for security: server start, stop and crash, every connect and disconnect, and advancements earned while still unauthenticated. |
| login_title | built in | Big title on the lockdown screen. Supports § codes. |
| login_description | built in | Subtitle under it. Supports § codes. |
| timeout_seconds | 180 | Kick an unauthenticated player after this many seconds of inactivity. |

Example

password=komipu42!
webhook_url=https://discord.com/api/webhooks/xxx/yyy
admin_webhook_url=https://discord.com/api/webhooks/xxx/zzz
login_title=§6Welcome to my server!
login_description=§7Type /login <password> to join
timeout_seconds=180

Use § followed by a color/format code in login_title or login_description for styling (e.g. §6 gold, §l bold). See https://minecraft.wiki/w/Formatting_codes for the full list.

🛡️ Attack Vectors Defended

Before they log in, players are frozen in place, made invincible, blinded, and put into spectator. On top of that, this mod also blocks:

• Breaking blocks — via hacked clients that send fake packets
• Moving or teleporting away — players are locked in position on every tick
• External state drift & Mod interference — lockdown effects are re-asserted every tick
• Admin commands & OP powers — all op permissions are taken away on lockdown
• Minimized IP-spoofing — successful logins are saved as a user UUID and IP pair
• Same-account session hijacking — if they’re already logged in, a second login gets denied instead of kicking them
• Bruteforcing — 1-second cooldown, kicked after 7 tries, kicked if idle too long

🔨 Future Development

Upon request I may add features to this mod. It runs on Fabric and Paper; other platforms may follow if others are interested.