Minecraft online-mode explained: why to keep it on
What online-mode does in server.properties, why turning it off is a security risk, and what to do instead.
Updated · 2 min read
online-mode=true makes your server check every player's account with Mojang's authentication servers before letting them in. Keep it on. Turning it off lets anyone join with any username, including yours.
What online-mode does
When a player connects to a server with online mode on:
- The server asks Mojang's session service to confirm the player owns a real Minecraft Java account.
- The player's real UUID is used, so their skin, whitelist entry, op status and bans all follow their account.
- The connection is encrypted.
With online mode off, none of this happens. The server just trusts whatever username the client sends.
online-mode=true
Why offline mode is dangerous
- Impersonation. Anyone can join as your username. If you are an op, they get your op powers, and they can delete or grief your world.
- Whitelists stop working properly. A whitelist checks names, and anyone can type a whitelisted name.
- Bans are easy to dodge. A banned player just changes their name.
- UUID changes. Offline-mode players get different UUIDs from their real accounts, so switching modes later makes players lose inventories, op status and plugin data tied to their old UUID.
- No encryption on the player connection.
Auth plugins that make offline players set a password reduce the risk but do not remove it, and they add hassle for everyone.
"Failed to verify username" errors
If players see this, the cause is almost always on their side, not your server's:
- Restart the Minecraft Launcher and log in again.
- Make sure they are joining with the account that owns the game.
- Check whether Minecraft's own services are having problems.
Do not switch to offline mode to "fix" this.
The one legitimate exception: proxies
Backend servers behind a proxy such as BungeeCord or Velocity are set to online-mode=false, because the proxy does the authentication and forwards the real player data. This is only safe when the proxy is set up correctly with player info forwarding and players cannot reach the backend directly. If you are not running a proxy, this does not apply to you.
Bedrock players
Bedrock players cannot join a Java server on their own, and turning off online mode does not change that. Bedrock crossplay on Java servers is done with Geyser and Floodgate, which work with online-mode=true. See the GeyserMC documentation.