Why offline-mode servers need it
Many Anvil-MC servers run with online-mode=false, because it lets Bedrock players join through Geyser, lets friends without a Java account play, and skips a Mojang session check on every connection. The price is that the server can no longer verify who anyone is. A player's name is just text typed into the client, so a stranger can log in as the owner and use every permission the owner has.
AuthSmith closes that gap. A name is no longer enough to get in; a password is. And if someone joins with a name that is already online, they are refused instead of the real player being kicked out, which is what vanilla does.
Two ways to lock the door
- Server password. One shared password for the whole server, like an invite key. Hand it to your friends and nobody else gets in. Ideal for a private server with a handful of players.
- Player accounts. Every player registers their own password and logs in with it on each visit. Their name can never be taken over by someone else.
Enable either, or both. With both on, the server password is asked only once, in the registration form; after that players use their own password. Rejoining quickly from the same address logs you in automatically, so the prompt does not get in the way.
A real login form, not a chat command
On Paper 1.21.6+ and Fabric, AuthSmith uses Minecraft's built-in dialog system. The password form appears on the loading screen, before the player enters the world. There is no frozen player standing at spawn, no typing /login hunter2 into chat on a phone keyboard, and no password sitting in the chat history.
On Spigot and on Paper versions before 1.21.6 it falls back to the classic /register and /login commands automatically, with the player frozen in place and unable to move, build, open inventories, chat, take damage or lose hunger until they log in.
Wrong passwords are counted per address and per account across reconnects, so disconnecting and rejoining does not buy extra guesses. Too many and the player is kicked and their address locked out; idle at the prompt too long and they are kicked as well.
How it compares to AuthMe and other login plugins
AuthMe Reloaded has been the standard login plugin for over a decade and has more features than AuthSmith will ever have: email password recovery, captchas, two-factor login, a dozen database backends. It is a fine choice on a PC or VPS. AuthSmith exists because a phone-hosted server has different priorities.
In short: pick AuthMe if you host on a PC and want every feature under the sun. Pick AuthSmith if you host on a phone, run Fabric, want the invite-key mode, or simply want a login screen your friends can use with one thumb.
Installing it on your Anvil-MC server
- Open your server in Anvil-MC and go to the plugin (Paper, Purpur, Spigot) or mod (Fabric) browser, search for AuthSmith and install it. Or download the jar from Modrinth and drop it into
plugins/ormods/with the file browser. - Start the server once so it generates its configuration.
- Open
plugins/AuthSmith/config.yml(orconfig/authsmith/config.ymlon Fabric) in the file browser. Player accounts are on by default; set aserver-passwordif you want an invite key. Change nothing else and it works. - Join. You will be asked to register on the loading screen, and to log in on every later visit unless you rejoin within the session window.
AuthSmith stays idle on servers with online-mode=true; Mojang already verifies those accounts. It only activates where it is needed.
Built for Anvil-MC, open to everyone
AuthSmith was written for Anvil-MC, where servers run on ARM phones with a bundled Java runtime and no room for native libraries that crash on the wrong architecture. It uses pure-Java bcrypt hashing and a single users.json file, does its password work off the main thread, and adds nothing to the idle load of the server. None of that is phone-specific, so it runs just as well on any Paper, Spigot or Fabric server. The source is on GitHub under the MIT license.
