PasswordGate

PasswordGate

PasswordGate adds an extra password-authentication step to Minecraft servers. Authentication runs during the login handshake, before the player enters the world, receives chunks, appears in the player list, or gets normal gameplay data.

The mod must be installed on both the client and the server

A client without PasswordGate, or with an incompatible protocol version, is rejected during login rather than being allowed into the world and kicked afterward.

Features

• Authentication before ServerPlayer creation and world entry
• Secure first-join password registration
• SRP-6a challenge-response authentication
• 3072-bit RFC 5054 SRP group with SHA-256
• Fresh cryptographic challenge for every connection
• No plaintext password or reusable password hash is transmitted
• Configurable authentication timeout
• UUID and IP-aware brute-force protection
• Temporary lockouts and controlled failure delays
• Protection against malformed, duplicated, out-of-order, and replayed packets
• Atomic, versioned server credential storage
• Dedicated-server and integrated-server support

Client password screen

PasswordGate displays a separate password screen before the normal title screen when no usable local credential is available.

Generated passwords use SecureRandom, contain upper- and lowercase letters, digits, and safe special characters, and provide at least 128 bits of entropy with the default settings.

Password storage

On Windows, PasswordGate generates a random AES-256 key, protects it with Windows DPAPI, and encrypts the password with AES-256-GCM using a new nonce for every write. Files are replaced atomically.

There is no plaintext, Base64-only, XOR, static-hash, or hard-coded-key fallback. If secure OS-backed storage is unavailable, PasswordGate asks for the password again instead of silently storing it insecurely.

The server never stores the original password. It stores only the player’s UUID, a unique salt, an SRP verifier, format versions, and authentication timestamps.

First login and offline mode

When allowFirstJoinRegistration=true, a player without an existing record can register a password during the login handshake and must immediately complete a full SRP proof before joining.

Registration also works in offline mode, but offline-mode UUIDs can be impersonated. PasswordGate logs a warning because the mod cannot make Minecraft offline identities cryptographically authentic. Use online mode whenever possible.

Administrator commands

/passwordgate status <player>
/passwordgate reset <player>
/passwordgate revoke <player>
/passwordgate authorize <player>
/passwordgate reload

Commands never display passwords, salts, verifiers, or authentication proofs.

Configuration

The server configuration includes authentication timeout, first-join registration, minimum password length, generated-password length, failed-attempt limits, failure windows, and temporary lockout duration.

Security notes

PasswordGate protects the login process from plaintext-password exposure, passive replay, reusable proof replay, malformed packets, and basic online brute-force attempts. It cannot protect a compromised client computer, a stolen unlocked operating-system account, or authenticate identities supplied by Minecraft offline mode.

PasswordGate is intended as an additional authentication layer and does not replace normal Minecraft account security, server access control, backups, or operating-system security.