Minecraft Cracked vs Premium Server (online-mode) Explained
What the online-mode setting actually verifies, the real risk of turning it off, and when that tradeoff is genuinely fine.
What online-mode actually controls
`online-mode` in server.properties decides whether your server verifies a connecting player's identity against Mojang's authentication servers. `online-mode=true` ("premium") means every player must own a legitimate Minecraft account and be logged into the official launcher — the server confirms this with Mojang on connect. `online-mode=false` ("cracked") skips that check entirely and takes whatever username the connecting client claims, with no verification at all.
The real risk of online-mode=false: username spoofing
Without Mojang verification, anyone running a modified client can connect as literally any username they want — including impersonating your actual players, admins, or even "Notch." If your server grants permissions, ops status, or anything else based on username, a cracked server has zero protection against someone claiming an identity they don't own. This is the actual security hole people mean when they warn against cracked servers, not vague "it's less safe."
When online-mode=false is a reasonable choice anyway
Small private servers for friends who already know and trust each other, servers specifically built to let players without a paid Minecraft account join (some communities deliberately do this), or servers behind their own separate auth layer (a login plugin requiring a password on first join) all have legitimate reasons to run cracked. The risk is real but manageable when the player pool is small, known, and/or separately authenticated.
When online-mode=true is close to mandatory
Any public server open to strangers, any server handling real economy/trading/valuable items, and any server where ops/admin status is tied to specific usernames should run `online-mode=true` without exception. The verification cost is essentially zero (a quick Mojang API call on connect) and the alternative is an open door to impersonation.
Login/auth plugins as a middle ground
Plugins like AuthMe (Paper/Spigot) let a cracked server require a password on first join and every subsequent reconnect, effectively building your own auth layer independent of Mojang's. This is the standard approach for communities that deliberately support non-premium players while still wanting some protection against casual impersonation — it doesn't eliminate the risk entirely but meaningfully raises the bar.
Proxy networks (Velocity/BungeeCord) need their own setting too
If you're running a proxy in front of multiple backend servers, the proxy has its own `online-mode` equivalent (`online-mode` in Velocity's config, similarly in BungeeCord) — and the backend servers behind it should typically run in "offline" mode with player info forwarding enabled instead, since the proxy already did the real auth check. Mismatching these two layers is a common source of "players can't join through the proxy" issues distinct from the simple single-server case this guide covers.
FAQ
Is it illegal to run a cracked Minecraft server?+
Running a server with online-mode=false isn't illegal — it's a server configuration choice. What's illegal is distributing pirated copies of the Minecraft client itself; a cracked server simply doesn't verify client ownership, which is a different thing from hosting or distributing pirated software.
Can players with a legitimate Minecraft account join a cracked (online-mode=false) server?+
Yes — online-mode=false doesn't block legitimate players, it just stops verifying anyone. Players with real accounts connect exactly as normal; the difference is purely that the server also accepts connections it can't verify.
What's the actual risk if I run online-mode=false on a small private server for friends?+
The risk is someone outside your trusted group discovering the server's address and connecting under a spoofed username — including potentially one of your own players' or admins' names if they know it. For a genuinely small, invite-only server with a non-obvious address, this risk is low but not zero; adding a login plugin removes most of the remaining exposure.
Does online-mode affect server performance?+
No measurably — the Mojang authentication check happens once per connection attempt, not per-tick, so it has no ongoing performance cost regardless of player count.
I want to let friends without a paid Minecraft account play — what's the safest setup?+
Run online-mode=false combined with an authentication plugin like AuthMe that requires a password on join. This supports non-premium players while still requiring something beyond a self-reported username to connect as a specific identity, which is the realistic middle ground most communities in this situation use.
Choose online-mode at setup, change it anytime
CoalHost exposes online-mode as a plain toggle in the dashboard — no file editing required. From €10.69/month.
View Minecraft Hosting →