Where to download safe Minecraft plugins
The trusted places to get Paper and Spigot plugins (Hangar, Modrinth, SpigotMC, BukkitDev) and how to spot unsafe or abandoned plugins.
Updated · 2 min read
The safest places to download plugins for a Paper server are Hangar, Modrinth, SpigotMC and BukkitDev, or a plugin's own official website or GitHub page. Avoid random download sites and "leaked" premium plugins, which are a common way to spread malware.
Trusted plugin sources
| Source | What it is |
|---|---|
| Hangar | The official plugin repository run by the PaperMC team. Good first stop for Paper servers. |
| Modrinth | Open platform for mods and plugins. Filter by "Paper" or "Bukkit" and your Minecraft version. |
| SpigotMC Resources | The largest and oldest plugin library. Works with Paper, since Paper runs Spigot plugins. |
| BukkitDev (dev.bukkit.org) | Older catalogue hosted by CurseForge. Many plugins there are outdated, so check the version. |
| Official sites and GitHub | Big projects like EssentialsX, LuckPerms, WorldEdit and Geyser publish builds on their own sites or GitHub releases. |
Paper can run plugins made for Bukkit, Spigot and Paper. Plugins built only for Sponge, Forge or Fabric will not work.
How to judge a plugin before installing
Before you upload anything, spend a minute on the plugin page:
- Supported versions. Make sure your Minecraft version is listed. A plugin last updated years ago may still work, but often does not.
- Recent updates. Regular releases mean the author still maintains it and fixes bugs.
- Downloads and reviews. Popular plugins are more likely to be stable and safe.
- Source code. Open source plugins (with a public GitHub or GitLab link) can be checked by anyone, which is a good sign.
- Dependencies. Note anything it requires, such as Vault, ProtocolLib or WorldEdit, and get those from trusted sources as well.
- Database needs. Some plugins expect MySQL. Schokr does not include MySQL databases, so check the plugin supports SQLite or H2. See plugins that need MySQL.
Red flags
- "Free" copies of paid plugins. Leaked jars are often modified to include backdoors that give strangers operator access or steal data.
- Download links that go through ad-filled file hosts or URL shorteners.
- Plugins that ask you to run them with special startup flags or to disable security settings.
- Plugins with no description, no screenshots and no author history.
- A jar that is far larger than you would expect for what it does.
If you suspect a plugin is malicious, stop the server, delete the jar, and restore from a snapshot or backup taken before you installed it.
Keep your plugin list small
Every plugin adds startup time, memory use and possible lag. Install what you need, remove what you stopped using, and prefer one well-maintained plugin over several overlapping ones. For a starting point, see essential plugins for a new server.